Privacy notice
This notice is being reviewed.
Rest Executive Funeral Services Limited (“we”) is the data controller for personal data collected through this website, our WhatsApp line and our branches. We handle it under the Data Protection Act, 2019. ODPC registration number: to be added on issue.
What we collect
- Your name, phone number and, if you give it, your email address.
- Details you share about the deceased and the funeral: names, dates, places and service choices.
- Payment records: the amount, how you paid and the payment reference. We never see or store card numbers or M-Pesa PINs.
- If you create an account: your email address and a password, which we store only in a scrambled form that cannot be read back.
- For obituaries: the text and photos the family approves, and a record of who gave consent.
Why we use it
- To provide the funeral services and goods you ask for, and to contact you about them.
- To take payments and email your receipts.
- To meet legal and tax obligations, and to keep proper accounts.
Who we share it with
Only with those who help us deliver the service: Paystack (card and M-Pesa payments), Google Firebase (storing photos and documents), Ably (alerts to our staff), our email provider, and our database and hosting providers. Each processes the data only on our instructions. We do not sell personal data.
How long we keep it
Order, booking and payment records are kept for seven years, as accounting and tax law requires. Enquiries that do not lead to a service are deleted after two years. A published obituary stays online until the family asks us to remove it.
Your rights
- To be told what data we hold about you, and to receive a copy.
- To have wrong data corrected, and data we no longer need deleted.
- To object to processing, and to withdraw consent at any time.
- To complain to the Office of the Data Protection Commissioner.
Contact
Write to us at our Kisii head office, or call or WhatsApp the numbers on the Contact page and ask for the data protection contact. We respond within 7 days.
If personal data is ever exposed, we will notify the Data Commissioner within 72 hours and inform affected people where the law requires.