1. Introduction

CarKitu ("we", "us", "our") respects your privacy and is committed to protecting your personal data in accordance with the Kenya Data Protection Act, 2019 (DPA). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform.

2. Data Controller & Contact

CarKitu is the data controller responsible for your personal data.

For privacy-related queries, contact our Data Protection Officer (DPO): dpo@carkitu.co.ke

3. Personal Data We Collect

• Account Data: full name, email address, phone number.
• Verification Data: email verification status, verification tokens, and SMS OTP codes used to confirm phone numbers.
• Seller & Dealership Data: business name, identification details (where required), listings, and transaction records.
• Buyer Data: vehicle preferences, budget, location, and submitted requests.
• Referral Agent Data: name, contact details, referral identifiers, and performance metrics.
• Usage Data: IP address, device information, browser type, cookies, and system logs.

4. Identity Verification

To maintain platform integrity and prevent fraud, we verify user contact details as follows:

• Email Verification: via secure verification links sent to your email address.
• Phone Verification: via one-time passwords (OTP) sent via SMS.

Verification data is used strictly for authentication, fraud prevention, and account security.

5. How We Use Personal Data

We process personal data to:

• Provide and operate the Platform;
• Match Buyers with Sellers, dealerships, and finance partners;
• Enable communication and transaction facilitation;
• Send transactional notifications (including SMS and email);
• Process payments and commissions;
• Prevent fraud, abuse, and unauthorized access;
• Comply with legal and regulatory obligations.

6. Controlled Sharing of Buyer Information

Buyer personal data (including name and contact details) is not automatically shared with sellers, dealerships, or finance partners.

Such information is only disclosed when the Buyer takes a clear consent action on the Platform, including:

• Opening or engaging with an offer;
• Clicking an “allow contact” or equivalent consent button;
• Requesting to be contacted regarding a listing or financing option.

These actions constitute explicit consent for CarKitu to share relevant contact information with the selected seller, dealership, or finance partner for the purpose of progressing a transaction.

7. Legal Basis for Processing

• Contractual Necessity: to provide requested services.
• Consent: where you explicitly agree (e.g., contact sharing, marketing).
• Legal Obligation: compliance with applicable laws.
• Legitimate Interest: platform security, fraud prevention, analytics, and service improvement.

8. Data Sharing

We may share personal data with:

• Sellers, dealerships, and finance partners (only upon user consent as described above);
• Payment providers (e.g., M-PESA);
• Service providers supporting hosting, analytics, messaging, and fraud prevention;
• Authorities where required by law.

We do not sell personal data.

9. Data Retention

We retain personal data only as long as necessary to:

• Provide services;
• Maintain transaction records;
• Resolve disputes;
• Comply with legal and regulatory requirements.

10. International Transfers

Where data is transferred outside Kenya, we implement appropriate safeguards in line with the DPA.

11. Your Rights

Under the Kenya Data Protection Act, you have the right to:

• Access your personal data;
• Request correction or deletion;
• Object to processing;
• Withdraw consent at any time;
• Request data portability.

To exercise your rights, contact: dpo@carkitu.co.ke

12. Security

We implement appropriate technical and organisational measures including encryption, access controls, and monitoring systems to protect personal data. However, no system is completely secure.

13. Cookies & Tracking

We use cookies and similar technologies for session management, analytics, and performance improvements.

Referral tracking may use cookies or session storage to attribute orders to referral agents.

14. Complaints

If you have concerns about how your data is handled, contact our DPO. You may also lodge a complaint with the Office of the Data Protection Commissioner (Kenya).