Privacy policy

PRIVACY POLICY

Tui Beauty Technologies Limited

Effective Date: 30 September 2026

1. Introduction

Tui Beauty Technologies Limited (“Tui Beauty”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, store and otherwise process personal data when you visit our website, purchase products from us, interact with our customer service team, subscribe to our marketing communications, use our digital platforms, participate in promotions, or otherwise engage with Tui Beauty.

We are committed to processing personal data lawfully, fairly and transparently and in accordance with the Data Protection Act, 2019, the regulations made thereunder, and other applicable privacy and data protection laws of Kenya.

Please read this Privacy Policy carefully to understand how we handle your personal data and the rights available to you. By using our website, products or services, you acknowledge that you have read and understood this Privacy Policy.

2. About Tui Beauty

Tui Beauty Technologies Limited is the data controller responsible for the personal data described in this Privacy Policy. Our contact details are:

Company Name: Tui Beauty Technologies Limited

Registered Office: MMID Studios, Westlands Road, Office 3A, Nairobi, Kenya

Physical Address: MMID Studios, Westlands Road, Office 3A, Nairobi, Kenya

Telephone: +254 700 715 796

Email: support@tuibeauty.com

Data Protection Contact: Maxine Kinyua

3. Scope of this Policy

This Privacy Policy applies to:

visitors to our website;
customers and prospective customers;
individuals subscribing to our newsletters and marketing communications;
users of our skincare consultation and skin analysis services;
persons who contact us through our website, email, WhatsApp or social media platforms;
suppliers, business partners and service providers; and
any other individuals whose personal data we process in the course of our business.

4. Personal Data We Collect

Depending on how you interact with us, we may collect and process the following categories of personal data.

4.1 Identity Data

Full name;
Username or account details;
Gender;
Date of birth (where voluntarily provided).

4.2 Contact Data

Email address;
Telephone number;
Delivery address;
Billing address;
Social media account information where you engage with us through social media.

4.3 Transaction Data

Order history;
Products purchased;
Delivery information;
Refund and return information;
Payment references and transaction details.

Note: Tui Beauty does not intentionally store full payment card information. Payment processing is conducted through third-party payment providers, who process card and payment details in accordance with their own privacy and security policies.

4.4 Technical Data

IP address;
Browser type and version;
Device identifiers;
Operating system;
Website usage information;
Cookie and tracking information.

4.5 Marketing Data

Newsletter subscriptions;
Communication preferences;
Responses to surveys, promotions and campaigns.

4.6 Customer Support Data

Customer enquiries;
Complaint records;
Correspondence by email, WhatsApp, telephone and social media;
Information submitted through contact forms.

4.7 Skin Analysis and Personalisation Data

Where you choose to use Tui Beauty's skin analysis and personalised recommendation services, we may collect information relating to:

skin type;
skincare concerns;
beauty preferences;
lifestyle information voluntarily provided by you;
photographs, images or other information submitted for analysis; and
recommendations generated through our technology platforms.

Our skin analysis service is supported by Arioon, a third-party technology provider. Arioon's technology may process facial images, skin concerns, skin type, beauty preferences and relevant lifestyle information provided by the user.

Arioon's technology uses submitted images to generate cosmetic observations and product recommendations. It is not intended to provide medical diagnosis or treatment.

Where facial images are submitted, the images may be processed using automated or AI-enabled technology to generate these observations and recommendations.

The facial images may also be used by Arioon for the purpose of improving or training its AI technology where this has been separately disclosed to the user and the required consent has been obtained.

Images submitted for skin analysis are not used by Tui Beauty for marketing or social media purposes.

You may request deletion of your submitted images by contacting Tui Beauty. Where appropriate, Tui Beauty will communicate the request to Arioon and take reasonable steps to have the relevant images deleted.

Tui Beauty will retain raw skin-analysis images for 60 days after the analysis, after which they will be deleted or irreversibly anonymised, unless retention is reasonably necessary for a legal claim, security investigation, regulatory requirement or other lawful purpose.

Skin-analysis results and recommendations may be retained for 12 months after your last use of the skin analysis service, after which they will be deleted or anonymised unless a longer period is required or reasonably necessary for a lawful purpose.

5. How We Collect Personal Data

We may collect personal data:

directly from you when you place an order;
when you create an account;
when you subscribe to newsletters or marketing communications;
when you contact us through email, WhatsApp, telephone or our website;
when you participate in promotions, surveys or campaigns;
when you interact with our website and digital platforms;
through cookies and similar technologies;
through our skin analysis and recommendation tools; and
from publicly available sources, where lawful and appropriate.

Where we ask you to provide personal data, we will indicate whether it is required or optional. If you do not provide information needed to create an account, process an order, arrange delivery, provide customer support or provide a requested service, we may be unable to provide the relevant product or service.

6. How We Use Personal Data

We may process personal data for the following purposes:

6.1 Providing Products and Services

To:

process orders;
arrange deliveries;
provide customer support;
process returns and refunds; and
manage customer accounts.

6.2 Personalised Recommendations

To:

understand customer preferences;
provide skincare recommendations;
improve product matching; and
enhance customer experience.

6.3 Marketing and Communications

To:

send newsletters;
notify customers of new products;
communicate promotions and offers; and
conduct surveys and market research.

6.4 Website Administration

To:

maintain website functionality;
monitor website performance;
improve user experience; and
detect security incidents and fraud.

6.5 Legal and Regulatory Compliance

To:

comply with applicable laws;
respond to lawful requests from regulators and authorities; and
establish, exercise or defend legal claims.

7. Legal Basis for Processing

We process personal data on one or more of the following legal bases:

your consent;
performance of a contract with you;
compliance with a legal obligation to which we are subject;
our legitimate business interests, provided these are not overridden by your interests, rights or freedoms; and
protection of your vital interests, where necessary.

Where we rely on consent, you may withdraw that consent at any time, subject to applicable legal requirements. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

8. Disclosure of Personal Data

We may share personal data with:

payment service providers;
logistics and delivery partners;
website hosting providers;
cloud storage providers;
analytics providers;
customer support providers;
marketing and communications providers;
professional advisers, including lawyers, auditors and consultants;
regulators and governmental authorities; and
law enforcement agencies, where required by law.

We require third parties with whom we share personal data to respect the security of personal data and to treat it in accordance with the law. We do not sell personal data to third parties.

8.1 Delivery Partners

Where necessary to complete a delivery or facilitate collection, Tui Beauty may provide delivery partners with information such as:

the customer's name;
telephone number;
delivery or collection location;
general area or address; and
order reference or order number.

For certain deliveries made by individual boda riders, the information provided may be limited to the customer's first name, telephone number, general delivery area and order number, depending on what is necessary to complete the delivery.

We do not provide delivery partners with more personal information than is reasonably necessary to fulfil the delivery or collection.

9. International Transfers

Some of our service providers may store or process personal data outside Kenya.

Where personal data is transferred outside Kenya, Tui Beauty will take reasonable steps to ensure that appropriate safeguards are implemented — such as standard contractual clauses, adequacy determinations, or other mechanisms recognised under the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 — and that such transfers comply with applicable data protection laws.

10. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including legal, accounting, tax, regulatory, security and operational purposes.

Tui Beauty applies the following retention periods as a general retention schedule:

Category of Personal Data	Retention Period
Customer account/profile data	Active period plus 24 months after closure or last activity
Orders, payments, refunds and accounting records	7 years
Customer service enquiries and ordinary complaints	3 years after closure
Marketing data	Until opt-out or 24 months of inactivity
Minimal marketing opt-out record	For as long as necessary to ensure the individual is not inadvertently re-enrolled in marketing communications
Raw skin-analysis photographs/images	60 days after analysis
Skin-analysis results and recommendations	12 months after last use
Website analytics data	14 months
Data relating to data subject rights requests and material data protection incidents	6 years after closure

These periods are subject to any longer period that may be required by law, necessary for the establishment, exercise or defence of a legal claim, or reasonably necessary for a security, regulatory or other lawful investigation.

When personal data is no longer required, we will securely delete, anonymise or otherwise dispose of it in accordance with our retention procedures.

11. Security Measures

Tui Beauty implements reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Such measures may include:

access controls;
password protection;
role-based permissions;
secure hosting environments;
encryption, where appropriate;
staff confidentiality obligations; and
incident response procedures.

While we strive to protect personal data, no method of transmission over the internet, or method of electronic storage, can be guaranteed to be completely secure. In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and affected individuals in accordance with applicable law.

12. Your Rights

Subject to applicable law, you may have the right to:

be informed about the processing of your personal data;
access your personal data;
request correction of inaccurate or incomplete data;
request deletion of personal data;
object to processing of your personal data;
restrict processing of your personal data;
request portability of your personal data;
withdraw consent where processing is based on consent; and
lodge a complaint with the Office of the Data Protection Commissioner.

Requests may be submitted using the contact details provided in this Privacy Policy. We may need to verify your identity before responding to a request, and we will respond within the timeframes required under applicable law. Some rights may be subject to exemptions or limitations under the Data Protection Act, 2019.

13. Marketing Communications

Where permitted by law, we may send you marketing communications relating to products, services, promotions, events and other information that may be of interest to you.

You may opt out of receiving marketing communications at any time by:

clicking the unsubscribe link contained in marketing emails;
contacting us directly; or
updating your communication preferences, where such functionality is available.

We will continue to send service-related communications necessary for the provision of products or services you have requested, even if you have opted out of marketing communications.

14. Cookies and Similar Technologies

Our website uses cookies and similar technologies for purposes including:

essential website functionality;
personalisation;
analytics;
marketing and advertising; and
security.

Depending on the services in use, these technologies may involve providers such as Shopify, Meta/Facebook and Instagram, Google and YouTube, Judge.me and Klaviyo.

The specific cookies and technologies used may change as we update our website and services.

Where consent is required for non-essential cookies or similar technologies, Tui Beauty will provide an appropriate consent mechanism and will allow users to manage their cookie preferences.

Shopify manages cookie preferences on our website. Tui Beauty will configure and maintain its cookie settings to ensure that consent is obtained where required by applicable law.

You may also manage certain cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the website.

15. Children's Data

Our products and services are generally intended for adults.

We do not knowingly collect personal data from children in a manner that would require parental or guardian consent under applicable law, without first obtaining the necessary authorisation.

If we become aware that personal data has been collected from a child unlawfully, we will take reasonable steps to delete such information. If you believe we may have collected information from a child without appropriate consent, please contact us using the details in Section 18.

16. Complaints

If you have concerns regarding how your personal data has been handled, we encourage you to contact us first so that we may attempt to resolve the matter directly.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner in Kenya, whose contact details are available at www.odpc.go.ke.

17. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time to reflect changes in our business, technology, legal requirements or data processing practices.

The latest version of this Privacy Policy will be made available on our website and will indicate the date on which it became effective. We encourage you to review this Privacy Policy periodically.

18. Contact Us

For any questions regarding this Privacy Policy, your personal data, or the exercise of your rights, please contact us: