Privacy Policy

This policy explains what personal data Frontrow Art Africa ("we") collects through Dropfront, why, and what you can do about it.

What we collect

• Account & registration: full name, email address and, optionally, phone number.
• Orders: what you bought, the amounts, your delivery address and delivery instructions, and the order's progress.
• Payments: handled by Flutterwave on its own secure page. We receive a payment reference, status and amount. We never see or store your card number or M-Pesa PIN.
• Marketing preference: whether you ticked the optional box to hear about future drops, and when.
• Technical data: basic logs (e.g. IP address, browser) kept for security and fault-finding.

How we use it

• To take and deliver your order, and to email you about it (confirmation, shipping, delivery, refunds).
• To tell you when a drop you registered for opens (you can unsubscribe from these in one click).
• To send promotional emails about future drops only if you opted in.
• To prevent fraud and keep the service secure.

Who we share it with

Only the service providers needed to run the store:

• Supabase (database, sign-in and file storage)
• Flutterwave (payment processing)
• Resend (sending email)
• Vercel (website hosting)
• The courier delivering your order (name, phone number and address)

Your choices

• Edit your name, phone number, addresses and marketing preference in your account at any time.
• Unsubscribe from drop emails using the link in any of them.
• Ask us to access, correct or delete your personal data via the contact page. We may need to keep order and payment records where the law requires.

Retention & legal basis

Dropfront collects and processes personal information only where necessary to operate our platform, fulfil orders, provide customer support, maintain security, and comply with applicable legal obligations.

We process personal data on the following legal grounds:

• Performance of a contract: to manage customer accounts, process purchases, arrange shipping, and provide order updates.
• Legal obligations: to maintain records required for taxation, accounting, regulatory compliance, and lawful requests.
• Legitimate interests: to protect our platform against fraud, maintain security, resolve disputes, and improve our services, where these interests do not override your rights.
• Consent: to send optional marketing communications and process information for other purposes requiring consent. You may withdraw your consent at any time.

We retain personal information according to the following schedule:

• Order and payment records: seven years from the transaction date, where required or justified for financial reporting, taxation, and dispute resolution.
• Shipping and delivery records: for as long as necessary to fulfil orders and resolve delivery disputes, with relevant transaction evidence retained for up to seven years.
• Drop registrations: twelve months after the relevant drop ends, unless the customer makes a purchase or separately consents to continued communications.
• Customer account information: for the duration of the account, subject to any applicable legal retention requirements following closure.
• Security and access logs: ninety days, unless longer retention is necessary to investigate security incidents or meet legal obligations.
• Abandoned checkout information: thirty days.
• Customer support records: twenty-four months after the matter is resolved, unless longer retention is justified.
• Marketing consent records: for as long as necessary to demonstrate and manage consent, including applicable suppression records after withdrawal.

When retention periods expire, we securely delete or anonymise personal information unless continued retention is legally required or otherwise permitted.

Dropfront processes personal information in accordance with Kenya's Data Protection Act, 2019, and applicable regulations. We take reasonable technical and organisational measures to protect customer information and respect applicable rights to access, correction, objection, and deletion.

Where personal data is transferred or processed outside Kenya, we apply safeguards required by applicable data protection law.

Dropfront will register with the Office of the Data Protection Commissioner where registration is legally required.

Contact

If you have questions about this Privacy Policy, how your personal information is processed, or wish to exercise your data protection rights, please contact:

Privacy & Data Protection Lead
Dropfront, operated by Frontrow Art Africa
Kenya

Contact us through our Contact Page.

We will review privacy-related requests and respond within the timelines required by applicable law.

You may also raise concerns with the Office of the Data Protection Commissioner in Kenya through www.odpc.go.ke.