Car Hire Privacy Policy

TaxiTao ("TaxiTao," "we," "us," or "our") operates a technology platform that connects car hire companies, independent vehicle hosts, and customers for vehicle rental services. This Car Hire Privacy Policy applies specifically to data collected through the car hire features of our platform.

This policy is governed by the Kenya Data Protection Act, 2019 (DPA 2019), the Kenya Information and Communications Act, 1998 (KICA), and the Consumer Protection Act, 2012 (CPA). Where applicable, we also comply with the General Data Protection Regulation (GDPR) for users in the European Union.

TaxiTao is a technology platform provider only. We are not a car hire company, vehicle owner, or party to any rental agreement between a company/host and a customer. Vehicle damage, insurance, and liability matters are solely the responsibility of the respective company/host and customer.

By accessing or using the car hire features of the TaxiTao platform, you agree to this Privacy Policy. If you do not agree, you must not use the car hire services.

When you book a vehicle through the car hire platform, we collect the following data:

KYC Verification Data:

• Full name and contact details (email, phone)
• National ID card images (front) for identity verification
• Live selfie photo for identity verification
• KRA PIN for tax compliance and regulatory purposes
• Work evidence (employment letter, payslip, work ID, business registration, or company business card) to verify employment or business status
• Driving licence details and images

Booking Data:

• Rental dates, pickup or delivery location
• Vehicle selection and rental preferences (self-drive or chauffeur)
• Communication logs with the car hire company or host
• Vehicle inspection records (photos, fuel level, odometer readings, damage reports)

Payment Data:

• M-Pesa transaction references and payment confirmations
• Bank transfer references (where applicable)
• Security deposit records and refund status
• Invoice and receipt information

When a car hire company registers on the platform, we collect:

Business Registration Data:

• Company name, business email, business phone
• Representative name and role
• Business logo
• Legal documents (business permits, incorporation certificates)
• KRA PIN
• Office and yard location (physical address with coordinates)
• Yard images

Payment Configuration:

• M-Pesa Till, Paybill, or Send Money details
• Bank account details (bank name, account name, account number, branch)

Staff Data:

• Staff name and email (used as login credentials)
• Staff permissions (fleet management, yard management, driver management, maintenance, finance access)
• Staff activity logs (actions performed on the platform)

Vehicle data listed on the car hire platform includes:

• Vehicle details: make, model, year, colour, plate number, transmission, fuel type, seating and luggage capacity
• Vehicle images (3–6 photos per listing)
• Daily rental rate, security deposit, delivery fee, wash fee, chauffeur rate
• Vehicle description and availability calendar
• Compliance documents: insurance expiry, NTSA inspection certificates
• Ownership details: owner name and contact (for third-party owned vehicles), signed rental agreements
• Vehicle performance data: total trips, total revenue, average rating, service history

Note: Vehicle owners (whether companies or independent hosts) are responsible for the accuracy of their listing data and for maintaining valid insurance and compliance documents.

We use your data to:

• Operate the car hire marketplace and connect companies/hosts with customers
• Verify customer identity through KYC processes
• Process bookings, payments, security deposits, and refunds
• Facilitate vehicle inspections and handover records
• Manage company accounts, subscriptions, and staff access
• Generate invoices, receipts, and financial reports
• Comply with legal obligations including NTSA regulations and KRA tax requirements
• Improve platform safety, prevent fraud, and resolve disputes

We process your data in accordance with the Kenya Data Protection Act, 2019. Our legal bases include:

• Performance of a contract — to provide the car hire marketplace services you request (DPA 2019, Section 30(c)).
• Legitimate interest — to improve platform safety, prevent fraud, and ensure service quality (DPA 2019, Section 30(d)).
• Compliance with legal obligations — including NTSA vehicle compliance, KRA tax reporting, and anti-money laundering requirements.
• Your consent — for optional features such as marketing communications (DPA 2019, Section 32). You may withdraw consent at any time.

We do not sell your personal data. We share data only when necessary to provide the car hire service:

• With car hire companies and hosts: Customer name, phone number, and KYC verification status (not underlying ID documents) for booking confirmation and vehicle handover.
• With customers: Company name, vehicle details, host name, and contact information for booked rentals.
• Payment processors: M-Pesa and related payment service providers for fare collection, subscription billing, and refund processing.
• Cloud hosting providers: Infrastructure providers that store and process data on our behalf, subject to strict data protection agreements.
• Government and regulatory authorities: NTSA, KRA, or other authorities when required by law, court order, or for compliance audits.

Important: When a customer grants KYC access to a company (kycGrantedflag), the company may view the customer's KYC documents for the purpose of the rental agreement. This is at the customer's discretion.

• Booking and rental records: Retained for 7 years for tax, regulatory, and dispute resolution purposes.
• Payment and financial records: Retained for 7 years for KRA tax compliance and audit purposes.
• KYC documents: Retained for the duration of your use of the car hire service and 7 years thereafter for regulatory compliance.
• Company registration data:Retained for the duration of the company's partnership and 7 years thereafter.
• Vehicle inspection records and photos:Retained for 7 years to support dispute resolution and liability claims.
• Staff activity logs: Retained for 90 days for operational auditing, then securely deleted.

Under the Kenya Data Protection Act, 2019 (Section 26) and, where applicable, the GDPR, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure — Request deletion of your account and certain data, subject to legal retention requirements.
• Right to object — Object to certain types of processing.
• Right to data portability — Request your data in a structured, commonly used, machine-readable format.
• Right to withdraw consent — Withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint — File a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.

To exercise any of these rights, contact us using the details below. We will respond within 30 days as required by the DPA 2019.

Your personal data is primarily stored and processed within Kenya. When data is transferred internationally, we ensure appropriate safeguards as required by the DPA 2019 (Section 48), including standard contractual clauses with receiving parties.

For EU users, transfers also comply with GDPR Chapter V requirements.

Our web platform uses cookies to operate effectively. See our general Privacy Policy for full cookie details.

In the event of a personal data breach, we will notify the ODPC within 72 hours and affected users without undue delay, in accordance with the DPA 2019 (Section 43).