Privacy Policy
How RmSg Kenya protects and handles your personal information
Contents
1. Introduction
RmSg Kenya ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our automotive marketplace platform.
We operate in accordance with the Kenya Data Protection Act, 2019 and other applicable data protection laws. By using RmSg, you consent to the data practices described in this policy.
Data Controller: RmSg Kenya is the data controller responsible for your personal information. We determine how and why your data is processed.
2. Information We Collect
We collect information you provide directly and automatically when you use our platform.
2.1 Account Information
When you create an account, we collect:
- Full name – to identify you on the platform
- Email address – for account verification and communications
- Phone number – for verification and seller/buyer contact
- Location – county or region for vehicle listings and search
- Password – securely hashed and encrypted
- Profile photo – optional, for your profile
2.2 Vehicle Listing Information
When you list a vehicle, we collect:
- Vehicle details: brand, model, year, mileage, engine size, fuel type, transmission, body type
- Vehicle condition: Brand New, Local Used, or Foreign Used
- Vehicle price and images
- Location of the vehicle (county, specific location)
- Vehicle description and features
2.3 Transaction Information
For sponsored listings and payments, we collect:
- Payment amount and transaction reference
- Payment status (pending, success, failed, expired)
- Payment method used (M-Pesa, etc.)
- Billing information
2.4 Automatically Collected Information
When you visit our platform, we automatically collect:
- Usage Data: Pages visited, time spent, actions taken
- Session Data: Login status, session duration
- Analytics Data: Interactions with listings, search behavior
2.5 Communication Data
When you contact us or communicate with other users:
- Support tickets and inquiries
- Email correspondence
- Phone call records (with consent)
Consent: We will obtain your explicit consent before collecting sensitive personal data or using your data for purposes not outlined in this policy.
3. How We Use Your Information
We use your personal information for the following purposes:
3.1 Providing and Improving Services
- Creating and managing your user account
- Processing vehicle listings and making them visible to buyers
- Enabling communication between buyers and sellers
- Processing sponsored listing payments via M-Pesa
- Personalizing your experience and search results
- Improving our platform based on user feedback and analytics
3.2 Communication
- Sending you updates about your listings
- Sending account verification and password reset emails
- Providing payment confirmations and receipts
- Sending promotional offers (with your consent)
- Responding to support inquiries and feedback
3.3 Security and Fraud Prevention
- Verifying your identity through email verification
- Detecting and preventing fraudulent activities
- Using Google reCAPTCHA to prevent automated abuse
- Monitoring for suspicious login attempts and account activity
- Enforcing our Terms and Conditions
- Complying with legal and regulatory requirements
3.4 Analytics and Research
- Analyzing user behavior to improve our platform
- Understanding market trends and user preferences
- Conducting surveys and user research
- Measuring the effectiveness of marketing campaigns
5. How We Share Your Information
We share your information only when necessary and with appropriate safeguards.
5.1 With Other Users
- Listings: Your vehicle listings are publicly visible on the platform
- Contact Information: When you express interest in a vehicle, sellers can see your name and contact details
- Reviews: If you leave a review, it is visible to other users
5.2 With Service Providers
- M-Pesa: Payment processing for sponsored listings
- Hosting Providers: Server and database hosting
- Email Services: Sending transactional emails
- Analytics Providers: Performance analysis and improvement
- Security Services: Fraud detection and prevention
5.3 With Legal Authorities
We may disclose your information when required by law, such as:
- Complying with court orders or legal processes
- Responding to requests from law enforcement
- Investigating or preventing fraud
- Protecting the rights and safety of our users
- Enforcing our Terms and Conditions
We do not sell your personal information to third parties for marketing or advertising purposes.
6. Data Security
We implement comprehensive security measures to protect your data:
6.1 Technical Measures
- Encryption: End-to-end encryption for sensitive data
- HTTPS: All data transmitted is encrypted in transit
- Password Hashing: Passwords are securely hashed using industry-standard algorithms
- Rate Limiting: Prevents brute force attacks
- reCAPTCHA: Prevents automated abuse and spam
- Monitoring: Continuous monitoring for security threats
6.2 Organizational Measures
- Regular security audits and penetration testing
- Access controls limiting employee data access
- Staff training on data protection
- Incident response procedures
- Data breach notification protocols
6.3 User Responsibilities
You play an important role in protecting your data:
- Use a strong, unique password
- Enable two-factor authentication when available
- Log out after each session
- Contact us immediately if you suspect unauthorized access
- Keep your account information up to date
7. Your Rights Under the Kenya Data Protection Act
Under the Kenya Data Protection Act, 2019, you have the following rights:
Right to Access
Request a copy of your personal data
Right to Rectification
Correct inaccurate or incomplete data
Right to Erasure
Request deletion of your data (subject to legal obligations)
Right to Restriction
Limit how we use your data
Right to Object
Object to certain data processing
Right to Portability
Receive your data in a portable format
Right to Withdraw Consent
Withdraw consent at any time
Right to Complain
Lodge a complaint with the ODPC
How to Exercise Your Rights
To exercise any of your rights, please contact us using the information below.
We will respond to your request within 30 days as required by law.
You may need to verify your identity before we process your request.
8. Data Retention
We retain your data for as long as necessary to provide our services and comply with legal obligations.
8.1 Retention Periods
| Data Type | Retention Period |
|---|---|
| Account Information | Until account deletion + 30 days |
| Vehicle Listings | 30 days after listing expiry + 90 days |
| Transaction Records | 7 years (for tax compliance) |
| Communication Logs | 2 years |
| Analytics Data | 2 years (aggregated thereafter) |
8.2 Data Deletion
When you delete your account:
- Your account information will be removed
- Vehicle listings will be deactivated
- Personal identifiers will be anonymized
- Some data may be retained for legal or regulatory compliance
- You can request a full data deletion (subject to legal obligations)
9. International Data Transfers
Some of our service providers may be located outside Kenya. When we transfer data internationally, we ensure appropriate safeguards are in place.
9.1 Safeguards
- Standard Contractual Clauses (SCCs) approved by the ODPC
- Data processing agreements with service providers
- Adequacy decisions where applicable
- Encryption during transmission
9.2 Countries We Transfer To
- United States (hosting, analytics)
- European Union (service providers)
- United Kingdom (email services)
10. Children's Privacy
Our platform is not intended for persons under 18 years of age. We do not knowingly collect personal information from minors. If we discover we have collected data from a minor, we will take steps to delete it.
Parents or guardians who suspect their child has provided us with personal information should contact us immediately.
11. Updates to This Privacy Policy
We may update this policy from time to time. We will notify you of significant changes through:
- Email notification
- Platform notices
- Website announcements
Please review this policy periodically for any changes. Continued use of the platform constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us: