Privacy Policy

1Introduction

This Privacy Policy explains how City Music Hub collects, uses, stores and protects personal information when you visit citymusichub.com, place an order with us, message us on WhatsApp, or contact us by phone or email.

We are committed to handling your information lawfully, fairly and transparently, in line with the Data Protection Act, 2019 and the regulations made under it. We ask for as little as we need, we use it for the purpose we collected it for, and we do not sell it.

For the purposes of the Act, City Music Hub is the data controller for the information described in this policy.

2What information we collect

Information you give us. When you place an order we collect your name, phone number, delivery address and, where you provide it, your email address. Where you contact us with a question, a warranty claim or a quotation request, we collect whatever you choose to tell us in that message, along with the contact details you send it from.

Order information. We keep a record of what you ordered, when, the amount, the payment method used and the payment reference, the delivery address and the status of the order. For business customers we may also hold a company name and, where invoicing requires it, a tax identification number.

Technical information. Like most websites, our hosting and security providers record basic technical data when a page is requested — the IP address making the request, the approximate location it maps to, the browser and device type, the pages viewed and the time of the visit. This is used to keep the site running, to defend against attacks and abuse, and to understand in aggregate which products and pages are useful.

What we do not collect. We do not collect or store card numbers, M-Pesa PINs or any other payment credentials. Those are entered with, and held by, our payment provider. We do not ask for information about your health, religion, political views or any other special category of data, and you should not send such information to us.

3How we use your information

We use your information to take and fulfil your order, to arrange and confirm delivery, to process payment and issue receipts, to answer your questions, to handle returns and warranty claims, and to keep proper business records including those required for tax purposes.

We also use it to protect the site and our customers against fraud and abuse, and to improve what we sell and how we describe it — for example by seeing in aggregate which categories customers look for most.

Our lawful bases for processing are: performance of the contract between us, where the processing is needed to supply what you ordered; compliance with a legal obligation, where the law requires us to keep records; our legitimate interests in running, securing and improving the business, balanced against your rights; and your consent, where you have specifically given it, such as for marketing messages.

4Who we share it with

We do not sell, rent or trade your personal information, and we do not share it for anyone else's marketing.

We share what is necessary, and only what is necessary, with:

• Our payment provider (SasaPay) to take and confirm payment.
• Couriers and delivery partners, who receive the recipient name, phone number and delivery address needed to complete a delivery.
• Our technology providers, who host the website, database and email on our behalf under contract.
• Manufacturers or distributors, where a warranty claim has to be registered with them on your behalf and only with the details that claim requires.
• Professional advisers and authorities, where we are required to disclose information by law, by a court, or by a regulator.

Where a provider processes information on our behalf, they act on our instructions and are bound to keep it confidential and secure.

5WhatsApp and messaging

Many of our customers prefer to order and ask questions over WhatsApp. When you message us there, the conversation is carried on WhatsApp's own platform and is subject to its privacy policy as well as this one. We use the contents of that conversation to answer you and to process any order that comes from it.

Please do not send payment credentials, identity-document images or other sensitive material over messaging. We will never ask you for an M-Pesa PIN, a card number or a password, by message or by phone. If anyone claiming to be from City Music Hub asks you for one, it is not us — please contact us directly on our published number.

6Cookies and browser storage

This site uses your browser's local storage to remember what is in your shopping cart between visits, and to keep an administrator signed in on the admin panel. This information stays on your own device and is not transmitted to us as a profile of you.

Our hosting and security provider may set cookies necessary to serve the site and to identify automated abuse. We do not use advertising cookies and we do not build advertising profiles.

You can clear or block browser storage in your browser settings. If you do, the cart will not remember items between visits.

7Marketing messages

We may contact you about an order you have placed — a confirmation, a delivery update, a question about your address — because that communication is part of supplying what you bought.

We will only send you promotional messages about new stock, offers or events if you have asked to receive them. If you have opted in and change your mind, tell us in a reply, on WhatsApp, or by email, and we will stop. Withdrawing consent for marketing does not affect the processing we do to fulfil your orders.

8How long we keep it

We keep order and transaction records for as long as the law requires us to retain accounting and tax records, and for as long as a warranty or dispute could reasonably arise on that order.

Enquiries that do not lead to an order are kept only as long as they are useful for answering you and for any follow-up you have asked for, and are then deleted. Technical logs are kept for a short period for security and troubleshooting.

When information is no longer needed for the purpose it was collected for, we delete it or anonymise it so that it can no longer identify you.

9How we protect it

The site is served over an encrypted HTTPS connection. Administrative access to our systems is restricted to authorised staff, protected by individual credentials, and access to customer data is limited to those who need it to do their job.

Payment credentials never reach our systems. Our infrastructure sits behind a commercial security layer that filters malicious traffic.

No system can be guaranteed completely secure. If a breach ever occurs that is likely to affect your rights or freedoms, we will act quickly to contain it and will notify you and the Office of the Data Protection Commissioner as the Act requires.

10Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your personal data is being used;
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• ask us to delete data where there is no good reason for us to keep it;
• object to processing that relies on our legitimate interests;
• ask us to restrict processing while a concern is being resolved; and
• receive a copy of data you gave us in a portable format.

To exercise any of these, email us at [email protected] or call 0743 968 239. We may need to verify who you are before we act, to make sure we are not disclosing your information to someone else. We will respond within the period the Act allows, and we do not charge for a reasonable request.

Some rights have limits. We may not be able to delete records we are legally required to keep, such as accounting records for a completed sale.

11Children

This site is intended for adults. We do not knowingly collect personal information from children. Where a parent, guardian, school or teacher is buying an instrument for a child, we deal with the adult placing the order and ask that you do not send us a child's personal details beyond a first name for engraving or similar, where that is needed.

12Where your information is held

Our website, database and file storage run on infrastructure operated by international technology providers, which means data may be stored or processed on servers outside Kenya. Where that is the case we rely on providers who offer contractual protections and security standards appropriate to the data involved, as required by the Act.

13Changes to this policy

We will update this policy when our practices change or when the law requires it, and will publish the updated version here with a revised date. Where a change materially affects how we use information you have already given us, we will take reasonable steps to tell you.

14Questions and complaints

If you have a question about this policy, or you believe we have mishandled your information, please contact us first — email [email protected] or call 0743 968 239 — and we will look into it.

You also have the right to complain to the Office of the Data Protection Commissioner, which is the supervisory authority for data protection in Kenya.