Last updated: 13 October 2025

This Privacy Policy explains how Gariclaim (“we”, “us”, “our”) collects, uses, shares, and protects personal data when you use our website at gariclaim.co.ke and our garage management application (together, the “Service”).

We are the data controller for personal data processed through the Service, and we are registered as a data controller with the Office of the Data Protection Commissioner of Kenya as required by the Data Protection Act, 2019.

1. Data we collect

Account and identity data. When you sign up, we collect your name, business name, email address, phone number, and KRA PIN.

Billing data. To process subscriptions, we collect your billing address and payment details through our payment processors. We do not store full card numbers on our servers.

Business data. When you use the app, we store the records you create: customer details, vehicle records, job cards, invoices, quotations, insurance claim references, parts inventory, employee records, and accounting entries.

Usage and technical data. We automatically collect IP address, browser type, device type, operating system, and pages visited within the Service for security, analytics, and product improvement.

Communications. If you contact us by email or through our contact form, we retain the correspondence.

2. Lawful basis

We process personal data on the following lawful bases under Section 30 of the Data Protection Act, 2019:

Contract performance: to provide the Service you have signed up for
Legal obligation: to comply with KRA, employment, and other statutory requirements
Legitimate interests: to improve the Service, prevent fraud, and secure our systems
Consent: where you have explicitly opted in (for example, marketing emails)

You can withdraw consent at any time by contacting us.

3. How we use your data

We use your data to:

Provide, operate, and maintain the Service
Process payments and send invoices
Respond to your enquiries and support requests
Send service notices such as downtime, billing reminders, and security alerts
Detect, prevent, and address technical or security issues
Comply with legal obligations
Improve product features based on aggregate usage patterns

We do not sell your personal data to third parties, and we do not use your business records for advertising.

We share personal data only with:

Service providers who help us run the Service: cloud hosting, payment processing, email delivery, and analytics
Professional advisers such as lawyers and auditors, when required
Regulators and law enforcement where we are legally compelled, such as a KRA request or a court order

Where we share data with service providers, we require them to protect it under contractual terms consistent with this Policy and the Data Protection Act.

5. Cross-border transfers

Some of our service providers process data outside Kenya. Where this happens, we ensure the transfer is made under the safeguards required by the Data Protection Act, including the use of standard contractual clauses or transfer to jurisdictions with an adequacy determination.

6. Data retention

We retain personal data for as long as your account is active. After account closure:

Accounting records are retained for 7 years in line with KRA requirements
Customer, vehicle, and job records you have created are retained for as long as you keep an active backup or export
Account data is deleted within 90 days of closure, unless retention is required by law

You may export your data at any time before closure.

7. Your rights

Under the Data Protection Act, 2019, you have the right to:

Be informed about how we use your data
Access the personal data we hold about you
Correct inaccurate or incomplete data
Delete your personal data, subject to legal retention requirements
Object to processing in certain circumstances
Restrict processing in certain circumstances
Data portability: receive your data in a structured, commonly used format
Lodge a complaint with the Office of the Data Protection Commissioner

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

8. Security

We protect personal data with:

Encryption in transit using TLS
Encryption at rest for stored data
Access controls and role-based permissions
Audit logging of sensitive operations
Two-factor authentication for admin accounts
Regular backups and security reviews

No system is completely secure. If you believe your account has been compromised, contact us immediately.

9. Cookies

Our website uses cookies for:

Essential functions: keeping you logged in, remembering preferences
Analytics: understanding how visitors use the site (in aggregate)

You can disable cookies in your browser settings. Some parts of the Service may not work without essential cookies.

10. Children

The Service is not intended for use by anyone under 18. We do not knowingly collect personal data from children.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email or through a prominent notice in the Service at least 14 days before they take effect.

12. Contact

For privacy questions or to exercise your data rights:

Email: [email protected] Postal: Gariclaim, Nairobi, Kenya

For complaints that we cannot resolve, you may contact:

Office of the Data Protection Commissioner Website: odpc.go.ke Email: [email protected]