Privacy Policy

1. Commitment to Privacy

Shop by Isaiah ("we", "us", "our", or "the Data Controller") is committed to safeguarding the privacy, confidentiality, and security of all personal data collected from customers, visitors, and users ("Data Subjects" or "you") through our website and associated digital services.

This Privacy Policy explains in transparent detail how we collect, use, store, share, and protect your personal data in strict compliance with the statutory data protection regimes of East Africa, including:

  • Tanzania: Personal Data Protection Act, 2022 (Act No. 11 of 2022) & Regulations, 2023.
  • Kenya: Data Protection Act, 2019 (Act No. 24 of 2019) & ODPC Regulations.
  • Uganda: Data Protection and Privacy Act, 2019 & Regulations, 2021.

2. Principles of Data Processing

We adhere to internationally recognized privacy standards, ensuring that all personal data is:

  • Processed lawfully, fairly, and in a transparent manner.
  • Collected for explicit, specified, and legitimate commercial purposes.
  • Adequate, relevant, and limited to what is strictly necessary.
  • Accurate and kept up to date.
  • Retained only for as long as necessary for the fulfillment of the stated purposes.
  • Processed with appropriate technical and organizational security measures against unauthorized access, accidental loss, destruction, or damage.

3. Categories of Personal Data We Collect

We only collect personal information that is necessary to provide you with seamless shopping, payment verification, and delivery services:

  1. Identity & Contact Information: Full legal name, active mobile phone number, WhatsApp contact number, email address, destination country (Tanzania, Kenya, or Uganda), and physical delivery address.
  2. Order & Transaction Data: Product items purchased, order references, delivery preferences, billing timestamps, and transaction status receipts.
  3. Payment Verification Data: Mobile Money transaction reference codes (e.g. M-Pesa, MTN MoMo, Airtel Money, Mixx by Yas, HaloPesa) and gateway verification tokens. Please note: We do not store banking passwords, mobile money PINs, or raw credit card numbers on our servers.
  4. Technical & Device Information: IP address, browser type, operating system, device identifiers, and anonymized website navigation telemetry to ensure platform security and fraud prevention.

4. Lawful Basis for Data Processing

Under East African data protection laws, we process your personal data under the following lawful bases:

  • Contractual Obligation: To process your order, receive payments, verify customer identity, package items, and complete doorstep or regional courier delivery.
  • Explicit Consent: When you voluntarily provide your information at checkout, register an account, or subscribe to service updates.
  • Legal & Statutory Compliance: To comply with tax obligations under regional revenue authorities (TRA, KRA, URA) and financial reporting laws.
  • Legitimate Interests: To detect and prevent fraudulent transactions, resolve dispute inquiries, and maintain high standards of platform security.

5. How We Use Your Personal Data

Your data is used exclusively for legitimate business purposes, including:

  • Processing, verifying, and fulfilling your orders.
  • Communicating real-time order confirmation, dispatch alerts, and delivery receipts via SMS, WhatsApp, or email.
  • Coordinating with verified regional delivery couriers and transport partners for accurate shipment handover.
  • Responding to your customer service requests, product inquiries, and exchange claims.
  • Improving website performance, responsiveness, and catalog curation.

6. Data Sharing & Third-Party Processors

We do not sell, rent, lease, or trade your personal information to third-party marketing agencies. We only share necessary data with trusted data processors strictly bound by confidentiality and data protection agreements:

  1. Licensed Mobile Money & Payment Providers: Vodacom (M-Pesa), Safaricom (M-Pesa Kenya), MTN MoMo, Airtel Money, Mixx by Yas, Halotel (HaloPesa), and secure card payment gateways for automated payment reconciliation.
  2. Logistics & Delivery Partners: Verified local courier riders and registered regional transport services across East Africa solely for physical delivery execution.
  3. Statutory & Regulatory Authorities: Government and judicial bodies when formally required by applicable regional laws.

7. Data Storage, Security & Retention

  • Technical Safeguards: We employ industry-standard SSL/TLS encryption, secure server firewalls, strict Content Security Policies (CSP), parameterized database queries, and role-based access controls to prevent unauthorized access.
  • Data Retention: Personal transaction records are retained for standard statutory periods (5 years) in compliance with commercial bookkeeping laws. Non-essential data is securely deleted or anonymized once the primary purpose is fulfilled.
  • Data Location: Your personal data is stored securely on servers compliant with modern international and regional data residency standards.

8. Your Rights as a Data Subject

Subject to statutory conditions, you hold the following enforceable rights across East Africa:

  • Right of Access: You have the right to request confirmation and a copy of the personal data we hold about you.
  • Right to Rectification: You have the right to request immediate correction of inaccurate or incomplete personal details.
  • Right to Erasure (Right to be Forgotten): You may request the deletion of your personal data when it is no longer necessary for the purpose it was collected, subject to statutory retention requirements.
  • Right to Object or Restrict Processing: You may object to the processing of your data for direct marketing or request restrictions on specific processing activities.
  • Right to Data Portability: You may request your personal data in a structured, commonly used, and machine-readable format.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.

9. Cookie Policy & Tracking

Our website utilizes essential session cookies necessary for core functions such as maintaining your shopping cart and remembering security tokens. We also use anonymized analytical tools to understand website traffic. You can configure your browser to reject cookies, though certain shopping features may be limited as a result.

10. Contact Our Data Protection Office & Complaints

If you wish to exercise any of your data rights, have questions regarding this policy, or wish to submit a data protection inquiry, please contact:

  • Data Controller: Shop by Isaiah
  • Physical Address: Bagamoyo Road, Victoria / Mwenge, Kinondoni, Dar es Salaam, Tanzania
  • Email: shop@isaiah.me.tz
  • Telephone / WhatsApp: +255 744 400 401

If you believe that your personal data has been handled improperly, you also have the statutory right to lodge a formal complaint with the relevant supervisory authority: the Personal Data Protection Commission (PDPC) in Tanzania, the Office of the Data Protection Commissioner (ODPC) in Kenya, or the Personal Data Protection Office (PDPO) in Uganda.

Last updated: August 24, 2026