1. Introduction

CarKitu ("we", "us") respects your privacy and processes your personal data in accordance with the Kenya Data Protection Act, 2019 ("DPA"). This policy describes how we collect, use, disclose and protect personal data.

2. Data Controller & Contact

CarKitu is the data controller. For privacy questions contact our Data Protection Officer (DPO): dpo@carkitu.co.ke.

3. What personal data we collect

• Account information: name, email, phone.
• Seller-specific: business name, ID documents (if provided), plan & payment records.
• Order data: buyer preferences, budgets, location (latitude/longitude when provided).
• Referral Agent information: agent name, email, phone, location, referral link identifier, and referral performance (for example counts of referred orders and completed purchases).
• Referral tracking data: when you access our Platform using a referral link, we may record the referral identifier and associate it with your order submission.
• Usage data: IP, device, cookies, performance logs.

4. How we use personal data

We use data to provide the Platform, match buyers to listings, send notifications, process payments, prevent fraud, and comply with legal obligations.

In addition, we may use personal data to:

• Administer the Referral Agent program including creating agent accounts, generating referral links, verifying email addresses, attributing referred orders, and calculating and settling commissions.
• Send referral notifications (for example notifying an agent when an order is submitted using their referral link and when a referred purchase is completed).
• Prevent abuse and fraud within the referral program, including detecting suspicious or duplicate referrals.

5. Legal bases for processing

• Contractual necessity — to provide services you requested.
• Consent — where you opt in to marketing.
• Legal obligations — record-keeping, tax, anti-fraud.
• Legitimate interests — platform maintenance and security.
• Legitimate interests / contractual necessity — to operate and administer the Referral Agent program (including attribution, analytics, communications and commission settlement).

6. Data sharing

We share data with Sellers for order fulfilment, with payment providers for payments, and with service providers who assist us. We do not sell personal data.

Where the Referral Agent program applies:

• We may share limited information with a Referral Agent about referrals attributable to them (for example order status updates such as whether a purchase is completed). We do not intentionally share unnecessary buyer personal information with agents.
• We may share agent information with service providers supporting communications (email), fraud prevention, analytics, and payment processing.

7. International transfers

If personal data is transferred outside Kenya we implement appropriate safeguards consistent with the DPA.

8. Data retention

We retain data as long as necessary to provide services, meet legal obligations, or as otherwise permitted. You may request deletion subject to legal and contractual restrictions.

Referral Agent records (including referral attribution and commission-related data) may be retained for accounting, audit, dispute resolution, fraud prevention, and legal compliance purposes.

9. Your rights under the DPA

You have rights to access, correct, erase, object to processing, and data portability. To exercise rights contact: dpo@carkitu.co.ke. We will respond in accordance with the DPA timelines.

10. Security

We implement technical and organisational measures to protect personal data including encryption, access controls and logging. However no system is 100% secure.

11. Cookies

We use cookies and similar tracking for sessions, analytics and product improvements. You can manage cookies through your browser settings.

Referral tracking: when you arrive through a referral link, we may use a cookie or session storage to remember the referral identifier for a limited time so we can attribute your order correctly.

12. Complaints

If you have complaints about how we handle personal data contact our DPO. You may also lodge a complaint with the Office of the Data Protection Commissioner — Kenya.