Privacy Policy

1. Who is responsible for your data

2safiri is the data controller for personal data processed through the platform in the course of operating your account.

Where you use the platform to manage data about your own personnel, passengers, parcel senders or recipients, you act as the controller of that data and we act as your processor in accordance with our agreement with you.

2. Personal data we collect

Account data: organisation name, account type (SACCO or personal), contact name, email address, phone number, password (stored as a hash by our identity provider).

Personnel data: names, phone numbers, role assignments, licence numbers, vehicle assignments and other staff details you choose to record.

Operational data: vehicle registration numbers, routes, route stops (latitude and longitude), travel passes, schedules, queues and maintenance records.

Passenger and parcel data: names, phone numbers, email addresses, pickup and drop-off points, parcel descriptions, weights, fares and delivery status.

Financial data: transaction amounts, payment method, M-Pesa configuration (till numbers, shortcodes, consumer keys), invoice records.

Technical data: authentication tokens, IP addresses, browser type, device information and usage logs for security and troubleshooting.

3. How we use personal data

We use personal data to: create and secure your account; provide the fleet, parcel, transactions, ads, notifications and support features of the platform; process subscription fees and produce invoices; respond to support requests; detect and prevent fraud or abuse; and comply with legal obligations.

4. Lawful basis

We rely on the following lawful bases under the Kenya Data Protection Act, 2019: performance of a contract with you; your consent, where required; compliance with a legal obligation; and our legitimate interests in operating, securing and improving the platform, balanced against your rights.

5. Sharing with third parties

We share personal data only as needed to provide the service. Our processors include: Google (Google Maps Platform) for mapping and geocoding; Safaricom (M-Pesa) for mobile money collections you initiate; Keycloak (operated on our infrastructure) for authentication; cloud hosting and email delivery providers.

We may also disclose personal data where required by law, court order or to protect the rights, property or safety of users or the public.

6. International transfers

Some of our processors may store or process data outside Kenya. Where this happens we put in place appropriate safeguards, including contractual protections aligned with the Kenya Data Protection Act, 2019.

7. Data retention

We keep personal data for as long as your account is active. After closure, we retain data only as long as needed for legitimate business purposes (for example, accounting, tax records, fraud prevention or to resolve disputes) and in line with applicable law.

Financial and tax records may be retained for up to seven (7) years under Kenyan tax law. Authentication and audit logs are kept for a shorter period sufficient for security investigation.

8. Your rights

Subject to the limits set out in the Kenya Data Protection Act, 2019, you have the right to: be informed about how your data is used; access your data; correct inaccurate data; request deletion; object to or restrict certain processing; and lodge a complaint with the Office of the Data Protection Commissioner.

You can exercise these rights by writing to support@komiut.com. We may need to verify your identity before acting on a request.

9. Security

We use technical and organisational measures including encryption in transit, password hashing, role-based access control and audit logging. No system is completely secure, and we cannot guarantee that data will never be intercepted or compromised.

10. Cookies and similar technologies

The platform stores authentication tokens and preferences in your browser. For details, see our Cookie Policy.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified through the platform or by email.

12. Contact

Questions or requests about your personal data can be sent to support@komiut.com.