Privacy Policy – Motorplug

Effective Date: June 27, 2025
Last Updated: April 27, 2026

At Motorplug, we respect your privacy and are committed to protecting your personal data in accordance with the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.

This Privacy Policy explains what information we collect, why we collect it, how we use it, who we share it with, and your rights.

1. Introduction and Scope

Motorplug is a car dealership and acts as a Data Controller for the personal data we collect.

This Privacy Policy applies to:

• Visitors to our website
• Customers and prospective customers
• People who contact us for inquiries, test drives, financing, service, inspections, or related dealership services

Data Controller Contact Details

• Business Name: Motorplug
• Physical Address: Nairobi, Kenya
• Email: motorplughub@gmail.com
• Phone/WhatsApp: +254 729 800446

We are committed to handling personal data lawfully, fairly, and transparently.

2. Information We Collect (Data Minimization)

We only collect personal data that is necessary for legitimate dealership operations.

a) Identity Data

• Full name
• National ID number, PIN number, or Passport number (used where required for registration, transfer, financing, and legal checks)

b) Contact Data

• Phone number (including WhatsApp)
• Email address
• Physical/postal address

c) Vehicle Data

• Vehicle preferences
• Vehicle Identification Number (VIN)
• Logbook details
• Service and transaction history

d) Financial Data

• Bank/payment details
• Proof of funds or related compliance documents (used for payment processing and anti-money laundering compliance)

e) Technical Data

• IP address
• Browser/device information
• Cookies and website interaction data (pages visited, clicks, session behavior)

3. Purpose and Legal Basis for Processing

We process your data for specific lawful purposes:

a) Contractual Requirement

To:

• Process vehicle sales, purchases, leasing, transfer, and servicing
• Arrange test drives and inspections
• Deliver customer support

b) Consent

With your explicit consent, we may send:

• Promotional offers
• Marketing messages
• New stock and campaign updates

You may withdraw consent at any time.

c) Legal Obligation

To comply with applicable laws and regulatory obligations, including:

• NTSA requirements (e.g., registration/logbook transfer)
• KRA tax requirements
• Anti-money laundering and fraud prevention requirements
• Other lawful requests by authorized bodies

4. Data Sharing and Third Parties

We do not sell personal data.

We may share personal data only where necessary with:

• Financing institutions and banks (for loan/financing assessment)
• Regulatory authorities such as NTSA and KRA
• Logistics and inspection partners for delivery, inspection, shipping, and related services
• Trusted service providers (e.g., hosting, payment, CRM, communications) under confidentiality and data protection obligations

All third parties are expected to process your data securely and lawfully.

5. Your Rights Under Kenya DPA, 2019

As a data subject, you have the right to:

• Be informed about how and why your data is collected and used
• Access your personal data and request a copy
• Rectification of inaccurate or incomplete data
• Erasure (deletion) where data is no longer necessary or where lawful grounds apply
• Object to processing, including direct marketing and certain profiling
• Data portability (receive data in a structured, machine-readable format)
• Withdraw consent where processing is based on consent

To exercise these rights, contact us using the details in Section 9.

6. Data Security and Retention

We use reasonable technical and organizational safeguards to protect personal data, including:

• Secure servers and system access controls
• Password-protected systems and role-based access
• Encryption where appropriate
• Staff confidentiality and data handling controls

We keep personal data only for as long as needed for the purpose collected, or as required by law, then securely delete or anonymize it.

7. Data Breach Notification

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, Motorplug will:

• Notify the Office of the Data Protection Commissioner (ODPC) within the legally required timeline (including 72 hours where applicable), and
• Inform affected individuals without undue delay where required by law

8. Cookies and Tracking

Our website uses cookies and similar technologies to:

• Keep the site functional
• Understand user behavior and improve website performance
• Measure ad performance and marketing effectiveness (including platforms such as Google and Instagram)

You can control cookies through your browser settings. Disabling certain cookies may affect site functionality.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or service changes. The latest version will always be published on our website with the updated effective date.