Privacy Policy
This policy explains how [COMPANY LEGAL NAME] ("RYDEX", "we") collects and uses your personal data in line with the Data Protection Act, 2019 of Kenya. We are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller, registration no. [ODPC NUMBER].
1. Data we collect
- Account: name, email address, phone number, password (stored only as a secure hash).
- Identity and driving licence: legal name, ID or passport number, date of birth, licence number and expiry, and photos of your ID and licence.
- Bookings: vehicle, dates, pickup location, notes, and terms accepted.
- Payments: amounts, M-Pesa phone number and receipt numbers. We never see your M-Pesa PIN.
- Messages: SMS we send you about bookings, payments and your account.
- Technical: server logs such as IP address and request times, kept for security.
2. Why we use it (lawful basis)
- To create your account, take bookings, process payments and hand over vehicles (performance of a contract).
- To verify that drivers are eligible and licensed, and to prevent fraud and vehicle theft (legitimate interests and legal obligations).
- To keep financial records required by Kenyan tax law (legal obligation).
- To send service messages such as confirmations and reminders (contract). We do not send marketing without your consent.
3. Who we share it with
- Safaricom (M-Pesa) to process payments.
- Africa's Talking to deliver SMS.
- [HOSTING PROVIDER], which stores our servers and database in [COUNTRY].
- Our insurer, and the police or courts, where needed for an accident, claim or legal requirement.
We do not sell your personal data. [If data is hosted outside Kenya, describe the safeguards for cross-border transfer under section 48 of the Act.]
4. How long we keep it
- Account data: until you delete your account.
- ID and licence photos: until you delete your account, or [24] months after your last rental, whichever is sooner [confirm].
- Booking and payment records: [7] years, as required for tax and accounting. If you delete your account these are kept without your name or contact details.
5. How we protect it
Data is encrypted in transit (HTTPS). Passwords are hashed. Identity documents are stored privately and only authorised staff can view them. Access to our systems is restricted and logged.
6. Your rights
Under the Data Protection Act, 2019 you have the right to:
- Access your data: use Download my data on your dashboard.
- Correct inaccurate data: contact us.
- Delete your data: use Delete my account on your dashboard (financial records are kept anonymised as described above).
- Object to or restrict certain processing.
- Complain to the Office of the Data Protection Commissioner (odpc.go.ke).
7. Cookies and browser storage
We do not use advertising or tracking cookies. Your browser stores a login token and your basic profile so you stay signed in; logging out removes them.
8. Children
Our services are for adults. We do not knowingly collect data from anyone under 18.
9. Changes
We will post updates here and tell you about significant changes by SMS or email.
10. Contact our Data Protection Officer
[NAME] · [EMAIL] · [PHONE] · [ADDRESS]