Key points
This summary is for convenience only. The full text below is what applies.
- KakaMotors Limited is the data controller and is registered with the ODPC.
- We collect what you give us (account, ads, chats, payments) and usage data from your device.
- We use it to run the marketplace, prevent fraud, process payments and — only with consent — for marketing.
- Your phone number is shown to buyers only when they choose to reveal it. We never sell your data.
- You can access, correct, delete or port your data, object to processing, or complain to the ODPC.
1.Who we are
KakaMotors Limited (“KakaMotors”, “we”) of 4th Floor, The Mirage, Tower 2, Chiromo Road, Westlands, Nairobi, Kenya is the data controller for personal data processed through the KakaMotors website and apps. We process personal data in accordance with the Data Protection Act, 2019 (the “Act”) and the Data Protection (General) Regulations, 2021, and we are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller and processor.
Our Data Protection Officer can be reached at dpo@kakamotors.co.ke.
2.Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, mobile number, email, password (stored hashed), account type | You |
| Dealer verification | Business name, KRA PIN, business permit, yard location, ID of authorised signatory | You |
| Ad content | Vehicle details, photos, price, area you choose to show | You |
| Communications | Chats with other users, messages to support, reports you submit | You and other users |
| Payment data | M-Pesa transaction reference and phone number, card type and last four digits, invoices | You and payment partners |
| Usage and device data | Searches, saved cars, pages viewed, IP address, device and browser type, approximate location | Your device, cookies |
| Sign-in with Google, Apple or Facebook | Name, email and profile identifier shared by that provider | The provider, with your permission |
3.How we use it and our lawful basis
| Purpose | Lawful basis (section 30 of the Act) |
|---|---|
| Create and run your account, publish your ads, connect buyers and sellers | Performance of our contract with you |
| Process payments, issue VAT invoices, keep tax and accounting records | Contract; legal obligation |
| Verify dealers, detect fraud and scams, review reported ads, keep the platform safe | Legitimate interests; legal obligation |
| Answer support requests and send service messages (e.g. SMS codes, ad expiry) | Contract |
| Improve search, recommendations and the platform; produce aggregated statistics | Legitimate interests |
| Send marketing messages and offers | Consent — you can opt out at any time |
| Respond to lawful requests from authorities and enforce our Terms | Legal obligation; legitimate interests |
5.International transfers
Some of our service providers store data outside Kenya. We only transfer personal data abroad where the conditions in Part VI of the Act and the Regulations are met — for example where the recipient country has an adequate level of protection or appropriate safeguards (such as standard contractual clauses) are in place — and we keep a record of those safeguards.
6.How long we keep it
| Data | Retention |
|---|---|
| Account data | While your account is open, then 24 months after closure |
| Ads and photos | Until removed, then up to 12 months in archive for fraud prevention |
| Payment and tax records | 7 years, as required by tax law |
| Chats and reports | 24 months, longer if needed for an investigation or legal claim |
| Analytics data | Up to 26 months, then aggregated or deleted |
7.Your rights
Under section 26 of the Act you have the right to:
- be informed of how your data is used;
- access the personal data we hold about you;
- object to processing, including for direct marketing;
- have inaccurate or misleading data corrected;
- have false or misleading data deleted, and ask for erasure where we no longer need it;
- data portability, in a structured, commonly used format;
- withdraw consent at any time, without affecting earlier processing.
Email dpo@kakamotors.co.ke from your registered email, or use the contact form. We will verify your identity and respond within 7 days, or explain if we need more time as the Regulations allow. Requests are free unless manifestly unfounded or excessive.
If you are unhappy with our response you may complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
8.How we protect it
- Encryption in transit (TLS 1.2 or higher) and at rest for our databases and backups.
- Passwords stored only as salted hashes; card details handled by PCI DSS-certified partners, never by us.
- Role-based access, multi-factor authentication for staff, and access logging.
- Regular security testing and staff data-protection training.
- We will notify the ODPC within 72 hours of becoming aware of a breach that poses a real risk of harm, and tell affected users without undue delay, as section 43 of the Act requires.
9.Children
KakaMotors is not intended for anyone under 18. We do not knowingly collect children's data; if you believe a child has given us personal data, contact us and we will delete it.
11.Marketing choices
We send marketing only with your consent. Unsubscribe using the link in any email, reply STOP to marketing SMS, or change your preferences in your account settings. Service messages about your account and ads will still be sent.
12.Changes to this policy
We may update this Policy to reflect changes in law or our services. We will notify you of material changes by email or a notice on the Platform before they take effect.
13.Contact our Data Protection Officer
Data Protection Officer, KakaMotors Limited, 4th Floor, The Mirage, Tower 2, Chiromo Road, Westlands, Nairobi, Kenya, P.O. Box 14820-00800. Email dpo@kakamotors.co.ke.
Questions about this document? Email legal@kakamotors.co.ke.