Privacy Policy

Last updated: 13 October 2026

Capital Mabati Limited supplies roofing sheets, steel, timber, plumbing, electrical and other building materials across Kenya. This Privacy Policy explains how we collect, use, share and protect your personal data when you visit capitalmabati.co.ke, shop with us, request a quote, visit our branches or contact us by phone, email, WhatsApp or social media.

We handle personal data in line with the Data Protection Act, 2019 of Kenya and its regulations. By using our website or services, you acknowledge the practices described here.

1. Who we are

Capital Mabati Limited is the data controller responsible for your personal data. We operate from:

• Head Office: Eastern Bypass, Nairobi
• Kamakis Showroom: Kamakis, Eastern Bypass
• Kitui Branch: Kitui, Kenya

2. Personal data we collect

Information you give us

• Quote requests: your full name, phone number, email address (if you give it), project type, product category, quantities or measurements, project location, material requirements and any message you include.
• House plans and drawings: plans, roof measurements, photos or drawings you send us on WhatsApp, by email or through our website so we can calculate your materials.
• Orders and deliveries: your name, phone number, email address, delivery address or site location, the products you order and order history.
• Payments: transaction details such as M-Pesa or bank reference numbers, amount paid and payment date. We do not store full card numbers or your M-Pesa PIN.
• Enquiries and support: what you tell us when you call, email, chat on WhatsApp, message us on social media or visit a branch.
• Business customers: company name, KRA PIN and contact person details where needed for invoicing or credit accounts.

Information collected automatically

• Device and browser details, IP address, approximate location, pages viewed, products added to your cart, referring website and the ads you clicked to reach us.
• Actions you take on our website, such as submitting a quote request or tapping our call or WhatsApp buttons. We record that the action happened so we can measure our advertising; we do not record the content of your calls or WhatsApp chats through the website.
• This is collected through cookies and similar technologies (see section 5).

Information from others

• Contractors, fundis or colleagues who refer you or order on your behalf.
• Advertising and social media platforms, which may share aggregated or campaign-level information about how people interact with our ads.

3. How we use your data

• To prepare and send quotations and respond to your enquiries.
• To process, confirm, deliver and follow up on your orders, including arranging free delivery to your site or nearest town.
• To receive and reconcile payments and issue receipts, invoices and eTIMS records.
• To handle returns, quality guarantee claims and complaints.
• To run, secure and improve our website, product range and customer service.
• To measure the performance of our website and advertising, and to show you relevant ads.
• To send you offers, price updates and news where you have agreed to receive them.
• To prevent fraud and meet our legal, tax and accounting obligations.

4. Legal basis for processing

5. Cookies and tracking

Cookies are small files placed on your device when you visit a website. We use:

• Essential cookies to keep your shopping cart working and the site secure.
• Analytics cookies, including Google Analytics loaded through Google Tag Manager, to understand how visitors use the site.
• Advertising cookies, such as those from Google Ads and social media platforms (for example Meta/Facebook and TikTok), to measure which ads lead to quote requests, calls and WhatsApp messages, and to show you relevant ads.

You can block or delete cookies in your browser settings. Blocking essential cookies may stop the cart from working. You can also opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on, manage ad personalisation in your Google Ad Settings, and control ads on social media from each platform's ad settings.

6. Who we share data with

We do not sell your personal data. We share it only where needed, with:

• Delivery and transport partners who bring materials to your site.
• Payment providers such as Safaricom (M-Pesa) and our banks, to process payments.
• Technology providers who host our website, email and communication tools (including WhatsApp).
• Analytics and advertising partners such as Google and social media platforms, as described in section 5.
• Professional advisers such as auditors and lawyers.
• Government and regulatory bodies, including the Kenya Revenue Authority, where the law requires it.

Our service providers may only use your data to provide services to us and must keep it secure and confidential.

7. International transfers

Some of our technology and advertising providers store data on servers outside Kenya. Where this happens, we take steps required under the Data Protection Act, 2019 to make sure your data receives an appropriate level of protection, such as relying on providers with recognised safeguards.

8. How long we keep data

• Quote requests that do not lead to an order: up to 2 years, so we can follow up on your project.
• House plans and drawings: only as long as needed to quote, supply and support your project, and no longer than 2 years unless you place an order.
• Orders, invoices and payment records: at least 7 years, as required for tax and accounting purposes.
• Marketing contacts: until you unsubscribe or ask us to stop.
• Analytics data: according to the retention settings of the relevant provider, typically no more than 26 months.

When data is no longer needed, we delete or anonymise it securely.

9. How we protect data

We use reasonable technical and organisational measures to protect your personal data, including encrypted (HTTPS) connections, restricted staff access and secure systems. No method of transmission over the internet is completely secure, but we work to protect your information and will notify you and the Office of the Data Protection Commissioner of any data breach where the law requires.

10. Your rights

Under the Data Protection Act, 2019 you have the right to:

• Be informed of how your personal data is used.
• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete data that is false, misleading or no longer needed.
• Object to processing, including for direct marketing and advertising measurement.
• Withdraw consent at any time, without affecting earlier processing.
• Receive your data in a portable format, where applicable.

To use any of these rights, contact us using the details in section 15. We may ask you to confirm your identity and will respond within the time set by law. If you are unhappy with how we handled your request, you may complain to the Office of the Data Protection Commissioner (ODPC).

11. Marketing messages

We will only send promotional SMS, email or WhatsApp messages where you have agreed to receive them or where the law otherwise allows. You can opt out at any time by replying STOP, using the unsubscribe link in our emails, or contacting us directly.

12. Children

Our website and services are intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

13. Third-party links

Our website links to other sites and platforms, including Facebook, Instagram, TikTok, LinkedIn, YouTube and WhatsApp. Their privacy practices are their own, so please review their policies when you use them.

14. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be on this page, with the "Last updated" date shown at the top. Significant changes will be highlighted on our website.

15. Contact us

For questions about this policy or your personal data, contact: