Legal
Privacy Policy
Last updated: 19 July 2026
AutoTrace Kenya Ltd ("AutoTrace", "we", "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect information about you when you use our vehicle history check platform ("Service").
This Policy is issued in compliance with the Kenya Data Protection Act, 2019 (No. 24 of 2019) ("DPA 2019") and the Data Protection (General) Regulations, 2021. AutoTrace Kenya Ltd is registered as a data controller with the Office of the Data Protection Commissioner (ODPC).
1. Data Controller
AutoTrace Kenya Ltd
Nairobi, Kenya
Email: support@autotrace.co.ke
For all data protection enquiries, email us with the subject line "Data Protection Request".
2. What the Service Does — and Does Not — Collect
AutoTrace is a private vehicle history marketplace. Records in reports are submitted by registered commercial Providers (dealers, importers, financiers, inspection companies, insurers, service centres). AutoTrace does not connect to, or receive data from, NTSA, KRA, or any other government agency. We do not hold government-sourced records about vehicle owners, registered keepers, or any other personally identifiable vehicle data beyond what Providers submit.
When you search a plate number, you are querying records that Providers have voluntarily uploaded to the platform. Vehicle registration numbers are not personal data about the searcher; however, we log the plate numbers you search as part of your account history (see clause 3).
3. Personal Data We Collect About You
We collect the following categories of personal data about platform users (consumers):
| Account data | Full name, email address, and authentication credentials when you create an account or sign in via a supported identity provider. |
| Search history | Vehicle registration numbers you query through the Service, stored against your account to let you revisit previous reports. |
| Payment data | Transaction reference numbers, payment method type (M-Pesa or card), and confirmation status. We do not store card numbers, CVVs, or M-Pesa PINs — these are processed exclusively by Paystack. |
| Usage data | IP address, browser type and version, device type, pages visited, time and date of access, and referring URL, collected automatically via server logs and cookies. |
| Support communications | Messages and attachments you send to our support team. |
We do not collect sensitive personal data as defined under Section 2 of the DPA 2019 (such as health data, ethnic origin, political opinions, or biometric identifiers).
4. How We Collect Your Data
- Directly from you — when you register, run a vehicle check, make a payment, or contact support.
- Automatically — through server logs and cookies when you use the platform (see clause 9).
- From identity providers — if you sign in using a third-party login option (e.g., Google), limited to the profile information you authorise that provider to share with us.
5. Purpose and Legal Basis for Processing
We process your personal data for the following purposes. The legal basis under Sections 30–32 of the DPA 2019 is shown in parentheses:
| Providing the Service | To process your vehicle check request and deliver the report you paid for. (Contract — s.30(b) DPA 2019) |
| Payment processing | To initiate, authorise, and confirm payments and prevent duplicate charges. (Contract — s.30(b)) |
| Account management | To manage your account, authenticate you, and give you access to your search history. (Contract — s.30(b)) |
| Fraud prevention and security | To detect and prevent fraudulent transactions, abuse, and security threats. (Legitimate interest — s.30(f); Legal obligation — s.30(c)) |
| Legal compliance | To comply with Kenyan law, including tax obligations and lawful court orders. (Legal obligation — s.30(c)) |
| Service improvement | To analyse aggregate, anonymised usage patterns and improve the platform. (Legitimate interest — s.30(f)) |
| Customer support | To respond to enquiries and resolve issues. (Contract / Legitimate interest) |
| Marketing (opt-in only) | To send product updates or offers by email, only where you have opted in. You may withdraw consent at any time. (Consent — s.30(a)) |
6. Sharing of Personal Data
We do not sell your personal data. We share it only in these limited circumstances:
- Paystack — our payment processor, which handles card and M-Pesa transactions under its own privacy policy and in compliance with PCI-DSS.
- Identity providers — if you sign in via a third-party login, that provider receives confirmation of a successful authentication. We do not share further data with them.
- Registered Providers — when you submit a plate number query, that registration number is passed to Providers on the platform to retrieve matching records. Your name, email, and payment data are not shared with Providers.
- Legal authorities — where required by a court order or lawful request from the Kenya Police Service, DCI, Communications Authority, KRA, or another competent authority. We will notify you to the extent permitted by law.
- Business transfers — in the event of a merger, acquisition, or sale of assets, your data may transfer to the successor entity under the same privacy protections.
7. Data Retention
| Account data | For the life of your account, plus 3 years after account closure to resolve any disputes or legal claims. |
| Payment records | 7 years from the transaction date, as required for tax compliance under the Tax Procedures Act, 2015. |
| Search history (plate queries) | 2 years from the date of search, after which they are anonymised. |
| Support communications | 2 years from the date of last contact, or until resolution of any open matter. |
| Usage / analytics data | 13 months in raw form; retained indefinitely in anonymised aggregate form. |
When data is no longer needed and no legal retention obligation applies, we securely delete or anonymise it.
8. Your Rights Under the DPA 2019
The Kenya Data Protection Act 2019 gives you the following rights regarding your personal data:
| Right of access (s.26) | Request a copy of the personal data we hold about you. |
| Right to rectification (s.26(b)) | Request correction of inaccurate or incomplete personal data. |
| Right to erasure (s.26(d)) | Request deletion of your data where it is no longer necessary, or where you withdraw consent and no other legal basis applies. |
| Right to restriction (s.26(c)) | Request that we restrict processing while accuracy is contested or an objection is pending. |
| Right to object (s.26(e)) | Object to processing based on legitimate interests. We will cease unless we can demonstrate compelling grounds. |
| Right to data portability (s.26(f)) | Receive your data in a structured, machine-readable format and, where technically feasible, have it sent to another controller. |
| Right to withdraw consent | Where processing is based on your consent, withdraw it at any time without affecting prior processing. Use the unsubscribe link in any marketing email or email us directly. |
To exercise any right, email support@autotrace.co.ke with subject line "Data Subject Request". We will respond within 21 days as required by the DPA 2019 and may ask you to verify your identity first.
9. Cookies
AutoTrace uses cookies and similar technologies to operate the platform and understand usage patterns.
| Strictly necessary | Required for core platform functions such as authentication sessions. Cannot be disabled. |
| Functional | Remember preferences such as previously searched plates. Disabling these does not break core features. |
| Analytics | Aggregate, anonymised navigation data used to improve the platform. You can opt out via your browser settings. |
You can manage or delete cookies through your browser settings. Disabling strictly necessary cookies will prevent you from using authenticated features of the Service.
10. Security
We implement appropriate technical and organisational safeguards to protect your personal data, including:
- Encryption of data in transit using TLS 1.2 or higher.
- Encryption of sensitive data at rest.
- Strict role-based access controls limiting data access to authorised personnel.
- Regular security assessments of the platform and its dependencies.
- Cryptographic signature verification and idempotency controls for payment callbacks.
In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the ODPC within 72 hours and inform you as required by Section 43 of the DPA 2019.
11. Cross-Border Transfers
We store data primarily within Kenya. Where data is processed outside Kenya (for example, by cloud infrastructure or Paystack's payment systems), we ensure such transfers are subject to adequate protections in accordance with Section 49 of the DPA 2019, including standard contractual clauses or transfers to jurisdictions recognised as adequate by the ODPC.
12. Children
The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe we have inadvertently collected such data, contact us immediately and we will delete it.
13. Changes to This Policy
We may update this Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. For material changes, we will notify registered users by email or by a prominent notice on the platform before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.
14. How to Complain
If you are unhappy with how we have handled your personal data, please contact us first at support@autotrace.co.ke. If we cannot resolve your concern, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC):
Upper Hill, Nairobi, Kenya
Website: www.odpc.go.ke
Email: info@odpc.go.ke