Draft. This page has not yet been reviewed by a lawyer. Words in [square brackets] are still to be filled in.
Ford Connect ("Ford Connect", "we") is run by [Company name], [Registered address, Nairobi, Kenya]. We are the data controller for the personal data described here. Contact us about your data at [privacy@yourdomain.co.ke]. This notice is written with Kenya's Data Protection Act, 2019 in mind.
What we collect, and why
- Your account. When you sign in with Google we receive your name and email address, so we can recognise you. We do not receive your Google password.
- Sellers. Shop name, location, phone and WhatsApp numbers, and a photo of an ID document so we can verify you. The ID document is kept in private storage that only our admins can open, and is deleted if your application is rejected. Your phone and WhatsApp numbers are shown only to a buyer who has paid to unlock them.
- Listings and photos you upload are public, except your contact details.
- Payments. To unlock a seller's contact you pay by M-Pesa. We keep your phone number, the amount, the M-Pesa receipt and the time, to give you access, to answer problems and to keep accounts. We never see your M-Pesa PIN.
- Comments. Comments are public and show only your first name.
- Service tracker. The vehicles you add (plate number, mileage, service records, mechanics and costs) are private to you. You can delete them at any time.
- Import requests and messages. What you write to us and the photos you attach, so we can answer you. Contact-form messages are deleted after 90 days.
- Analytics. Only if you accept analytics cookies: Google Analytics records which pages are visited and how, so we can improve the site. See the cookie notice.
- Technical logs. Our hosting records errors and requests for security and reliability.
Who we share it with
We do not sell your data. We use these service providers, who process data on our behalf:
- Vercel (website hosting) and Neon (database).
- Cloudflare R2 (photo and document storage).
- Safaricom M-Pesa (payments).
- Resend (sending email).
- Google (sign-in, and analytics if you accept).
- WordPress.com (the blog, which holds no personal data about visitors).
Some of these providers are outside Kenya, so your data may be processed abroad. [Lawyer to confirm the safeguards and wording for cross-border transfers.]
How long we keep it
- Account and listings: while your account is open.
- Payment records: [number] years, because we must keep accounts.
- Rejected ID documents: deleted when the application is rejected.
- Contact-form messages: 90 days.
- Raw payment callbacks from Safaricom: 90 days.
Your rights
You can ask to see the data we hold about you, correct it, delete it, or object to how we use it. Email [privacy@yourdomain.co.ke]. If you are unhappy with our answer you may complain to the Office of the Data Protection Commissioner in Kenya.
Children
Ford Connect is for adults. We do not knowingly collect data from anyone under 18.
Changes
If we change this notice we will update the date at the top.