Privacy policy

Last updated: 22 September 2026

This Privacy Policy explains how Artisanal Fifty Five Ltd, trading as Totem Nairobi, collects, uses, shares and protects personal information.

Totem Nairobi is located at Village Market, Nairobi, Kenya. For personal information processed for Totem’s business purposes, Artisanal Fifty Five Ltd is the data controller.

This policy applies to totemnairobi.com, the Collection, Project Sourcing, Totem Scent Studio, Gifting, project and product enquiries, newsletters and other communications with Totem.

The website is hosted by Shopify.

1. Personal Information We Collect

The information collected depends on how a person engages with Totem and may include:

Identity and contact information, including a name, email address, telephone number, organisation, professional role, billing address and delivery address.
Enquiry and project information, including the nature and location of a project, product interests, briefs, specifications, budgets, timelines, approvals and correspondence.
Transaction information, including quotations, invoices, order history, payment status, delivery arrangements and records relating to returns, claims or disputes.
Gifting information, including recipient names, delivery details, personalisation instructions and gift messages supplied by a client.
Supplier and professional information, including contact, business, payment, tax and contractual information relating to makers, artists, manufacturers, consultants, carriers and other project partners.
Marketing information, including newsletter subscriptions, communication preferences and responses to Totem’s communications.
Technical and usage information, including IP address, browser, device, pages viewed, referring pages and interactions with the website.
Communications, including information provided through forms, email, telephone, messaging services or meetings.

Payment card information is handled by Shopify and the relevant payment provider. Totem does not ordinarily receive complete payment card details.

Totem does not ordinarily request sensitive personal information. Where a scent, gifting, hospitality or other project brief requires information concerning an allergy, sensitivity, accessibility requirement or similar matter, Totem will collect only the information reasonably necessary for that purpose and process it in accordance with the additional requirements that apply to sensitive personal information.

Where consent is required for that processing, it will be requested separately and may be withdrawn subject to any lawful reason requiring continued retention or processing.

2. How Information Is Collected

Personal information may be collected:

directly from the person concerned;
from a client, employer or organisation engaging Totem;
from a person arranging a gift or delivery for somebody else;
through the website, cookies and similar technologies;
from Shopify and other service providers;
from project partners, suppliers and professional advisers; and
from publicly available professional or business sources where relevant to sourcing, procurement or a commercial relationship.

A person providing information about somebody else should ensure that they are authorised to provide it and, where appropriate, that the individual has been informed of the intended use.

Totem will not use information obtained from a third party for an unrelated purpose merely because the information is available to it.

3. Why We Use Personal Information

Totem may use personal information to:

respond to enquiries and develop proposals, quotations and project briefs;
source, curate, commission, procure and deliver approved pieces or services;
communicate with makers, artists, suppliers, manufacturers and other project partners where necessary for an enquiry or approved project;
manage project approvals, supplier relationships, production and logistics;
develop scent and gifting commissions;
process payments, maintain business records and administer contracts;
communicate about an enquiry, order, project or delivery;
provide newsletters and marketing communications where the recipient has consented;
operate, secure and improve the website;
understand website use and performance;
identify and prevent fraud, misuse or unlawful activity;
establish, exercise or defend legal rights and protect Totem’s legitimate commercial interests; and
comply with tax, accounting, regulatory and other legal obligations.

Depending on the activity, Totem processes personal information because it is necessary:

to take steps requested before entering into a contract;
to perform a contract;
to comply with a legal obligation;
for Totem’s legitimate business interests, where those interests are not overridden by the person’s rights and freedoms; or
because the person has given consent for a specific purpose, such as direct marketing, non-essential cookies or other processing for which consent is required.

Where processing relies on consent, consent may be withdrawn at any time.

Withdrawal does not affect processing that was lawful before consent was withdrawn or information that Totem is entitled or required to process for another lawful reason.

4. Who Receives Personal Information

Personal information may be shared where reasonably necessary with:

Shopify, which hosts and supports the website;
payment processors and financial institutions;
makers, artists, suppliers, manufacturers and specialist production partners involved in an enquiry, commission or project;
freight companies, couriers, customs agents, insurers, storage providers and installers;
communication, email, messaging, marketing and analytics providers;
accountants, lawyers, auditors, insurers and other professional advisers;
a client, employer or organisation where the person is acting on its behalf;
regulators, courts, law-enforcement bodies and public authorities where disclosure is required or legally permitted; and
another business in connection with a genuine restructuring, investment, sale or transfer of Totem’s business, subject to appropriate confidentiality and legal safeguards.

Only information reasonably necessary for the relevant purpose will be shared.

Some recipients act as service providers processing personal information on Totem’s behalf. Others, including certain independent suppliers, makers, carriers, payment providers and professional advisers, may process information under their own legal responsibilities once it has been provided to them.

Where a client contracts directly with an independent supplier introduced or coordinated by Totem, that supplier may receive personal information required to communicate with the client, fulfil the order, arrange delivery, administer payment or deal with a claim. The supplier’s own privacy terms may also apply to its subsequent processing.

Totem does not sell personal information for monetary payment.

5. Shopify, Cookies and Online Services

Shopify hosts Totem’s website and processes personal information associated with visits to and interactions with the site.

This may include information required to:

operate and secure the website;
process enquiries or transactions;
remember visitor preferences;
understand website use and performance; and
provide personalisation, measurement or marketing functions where those functions are enabled and lawfully used.

Shopify may undertake certain processing for its own purposes rather than solely on Totem’s instructions. That processing is governed by Shopify’s own privacy terms and customer privacy controls.

Information about Shopify’s processing and the controls available to individuals is provided through the Shopify Consumer Privacy Portal.

The website uses cookies and similar technologies for functions including:

operating and securing the website;
remembering visitor preferences;
understanding website use and performance;
measuring engagement; and
providing personalisation or marketing where enabled.

Where consent is required for a cookie or similar technology, it will not be used for that purpose until the required consent has been obtained.

Available choices may be managed through the cookie banner and other customer privacy controls provided on the website. Disabling certain cookies may affect how parts of the website function.

6. International Processing and Transfers

Totem sources and works with makers, suppliers, manufacturers, logistics providers and other project partners in Kenya and internationally. Shopify and some of Totem’s other service providers also operate in multiple countries.

Personal information may therefore be processed outside Kenya where this is necessary to operate the website, respond to an enquiry, develop a project, procure approved goods or services, arrange payment, manage logistics or fulfil another legitimate business purpose described in this policy.

For example, a client’s name, project information, approved specifications, delivery details or relevant contact information may need to be shared with an overseas maker, supplier, manufacturer, freight provider or other project partner.

Totem will transfer personal information outside Kenya only where the transfer is permitted under applicable data-protection law and the required transfer condition is satisfied. Depending on the circumstances, this may include appropriate contractual or organisational safeguards, an applicable legal exception or the data subject’s consent.

Where a transfer relies on consent, the information required by law concerning the transfer and any relevant risks will be provided before consent is requested.

Sensitive personal information will be transferred internationally only where the requirements applicable to that category of information have been satisfied.

Totem will limit information shared internationally to what is reasonably necessary for the relevant purpose.

7. Retention

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected and for any related legal, tax, accounting, contractual, warranty, insurance, claims or dispute-resolution requirements.

In particular:

enquiries that do not proceed are periodically reviewed and deleted when they are no longer required;
project and transaction records may be retained while a contract, warranty, claim, tax obligation, professional obligation or legal issue remains relevant;
records of project approvals, specifications and correspondence may be retained where reasonably required to establish what was approved or supplied;
gifting recipient information is retained only for delivery, project administration and any related claim or legal requirement;
supplier, maker and professional records may be retained for the duration of the commercial relationship and any related contractual or legal period; and
marketing information is retained until the person unsubscribes, withdraws consent or the information is no longer required for that purpose.

Information that no longer needs to identify an individual may be deleted, anonymised or securely restricted.

8. Security

Totem uses reasonable administrative, organisational and technical measures appropriate to the nature of the information to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Access is limited to people who require the information for a legitimate business purpose.

Where appropriate, service providers that process personal information on Totem’s behalf are selected with regard to the nature of the information, the service being performed and the safeguards they provide.

No electronic system or method of transmission can be guaranteed to be completely secure.

Where a personal-data breach or other security incident requires notification to affected individuals, the Office of the Data Protection Commissioner or another authority under applicable law, Totem will make the required notification.

9. Marketing

Totem will use personal information for direct marketing only where the person has consented to that use and has been informed that direct marketing is one of the purposes for which the information will be used.

Marketing communications will identify Totem and provide a clear and accessible way to opt out without charge.

A person may withdraw their consent or unsubscribe from marketing at any time using the method provided in the communication or by contacting Totem.

An opt-out request will apply to direct marketing communications. It does not prevent Totem from sending communications reasonably necessary to respond to an enquiry or administer a project, order, payment, delivery, claim or existing commercial relationship.

Totem will not use sensitive personal information for direct marketing.

10. Individual Rights

Subject to applicable law, a person may have the right to:

be informed about how their personal information is used;
request access to personal information held about them;
request correction of inaccurate or misleading information;
object to some forms of processing;
request deletion of information where the applicable legal requirements are satisfied;
request restriction of processing in applicable circumstances;
receive certain information in a portable format where applicable;
withdraw consent where processing is based on consent; and
object to a decision producing legal or similarly significant effects where it is based solely on automated processing.

Totem does not ordinarily make decisions producing legal or similarly significant effects solely through automated processing.

Shopify, payment providers and security services may use automated systems to identify fraud, security risks or suspicious activity in connection with their services.

A request concerning personal information may be submitted to hello@totemnairobi.com.

Totem may request sufficient information to confirm the requester’s identity, authority where they act for somebody else, and the records to which the request relates.

Requests will be handled within the periods and subject to the conditions provided by applicable law.

A person may also lodge a complaint with Kenya’s Office of the Data Protection Commissioner.

11. Children

Totem’s website and services are not directed at children, and Totem does not knowingly collect personal information directly from children without the authority required by law.

If information concerning a child is required for a legitimate gifting, hospitality, delivery or project purpose, it must be provided by a parent, guardian or other person authorised to provide it and will be limited to what is reasonably necessary for that purpose.

12. Third-Party Websites and Independent Businesses

The website may contain links to websites operated by makers, suppliers, social media platforms and other third parties.

Those organisations control their own privacy practices. Totem is not responsible for the privacy or security practices of an independent third party merely because its website is linked from totemnairobi.com or because Totem works with that business.

Where a client enters into a direct contractual relationship with an independent supplier or service provider, that business may collect or process personal information separately from Totem and its own privacy terms may apply.

13. Changes to This Policy

This policy may be updated to reflect changes in Totem’s services, sourcing model, technology, suppliers or legal obligations.

The current version will be published on the website with its effective date.

A material change to this Privacy Policy will not retrospectively alter consent previously given for a specific purpose where fresh consent is required by law.

14. Contact

Questions, requests or complaints concerning personal information may be sent to:

Artisanal Fifty Five Ltd
Trading as Totem Nairobi
Located at Village Market, Nairobi, Kenya
Email: hello@totemnairobi.com