Privacy Policy

1. Who We Are

Barguts Tours ("we", "us", "our") is an NTSA-licensed vehicle hire and tour operator registered and operating in Kenya. Our principal office is located at Buruburu Business Shopping Complex, Suite UF21, Buruburu, Nairobi, Kenya.

We are the data controller responsible for personal information collected through our website, telephone bookings, WhatsApp communications, and in-person transactions.

2. Data We Collect

We collect personal information only when it is necessary to provide our vehicle hire services, process bookings, and comply with Kenya's legal and regulatory requirements.

2.1 Information You Provide Directly

• Identity data: Full name, date of birth, nationality
• Contact data: Phone number, WhatsApp number, email address, postal address
• Identity documents: National ID number or passport number and copy; driving licence number, class, and copy
• International visitors: International Driving Permit (IDP) details
• Payment data: M-Pesa transaction reference numbers, bank transfer details, card details (processed securely — we do not store full card numbers)
• Booking data: Hire dates, vehicle type, pickup/drop-off location, intended route, number of passengers
• Emergency contact: Name and phone number of a designated contact

2.2 Information We Collect Automatically

• Website data: IP address, browser type, pages visited, time on site, referral source (via cookies — see Section 7)
• Vehicle telematics: Some fleet vehicles are fitted with GPS tracking devices. Location data is recorded during your hire period for fleet management and security purposes. You will be informed of this before hire commences.
• CCTV: Our Buruburu office has CCTV monitoring in operation. Footage is retained for 30 days and accessed only for security incidents.
• Call recordings: Telephone calls to our booking line may be recorded for quality and training purposes.

2.3 Information from Third Parties

• NTSA driver licence verification data
• Payment confirmation from M-Pesa and banking institutions
• Referrals from corporate clients and travel agents

3. How We Use Your Data

We process your personal data on the following legal bases under the Kenya Data Protection Act, 2019 (KDPA):

3.1 Performance of a Contract

• Process and confirm your vehicle hire booking
• Verify your identity and driving eligibility as required by NTSA
• Process payments and issue receipts
• Coordinate vehicle delivery, collection, and inspection
• Manage security deposits and refunds
• Contact you regarding your booking, including changes or cancellations

3.2 Legal Obligation

• Comply with NTSA commercial vehicle hire regulations
• Respond to law enforcement requests regarding vehicle use during hire period
• Maintain records required by Kenya Revenue Authority (KRA) for tax purposes
• Assist with traffic fine or accident investigations involving our fleet vehicles

3.3 Legitimate Interests

• Send service-related communications (booking reminders, vehicle return reminders)
• Monitor vehicle GPS location for fleet security and recovery
• Review call recordings and CCTV footage to investigate disputes or incidents
• Analyse website usage to improve our online booking experience
• Prevent fraud and verify the authenticity of documents provided

3.4 With Your Consent

• Send marketing communications about new vehicles, promotions, or services (you may opt out at any time)
• Use anonymised testimonials or feedback for marketing purposes

4. Data Sharing

We do not sell your personal data. We share your information only where necessary, with the following categories of recipients:

• Insurance providers: To arrange comprehensive hire cover on your booking
• NTSA: Driver licence and operator compliance verification
• Payment processors: M-Pesa (Safaricom), banking institutions, and card processors — for payment confirmation only
• Law enforcement and courts: Where required by law, court order, or legitimate government request
• AA Kenya: In the event of a roadside breakdown requiring assistance, your location and contact details are shared
• Corporate account clients: If you travel on a corporate booking, your name and trip data may be reported to the contracting organisation in accordance with their account agreement
• Service providers: IT support, website hosting, and SMS/communication platforms — bound by confidentiality agreements and permitted to use data only to provide services to us

All third parties are required to maintain the confidentiality and security of your data in compliance with applicable Kenyan law.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention periods:

• Booking and hire records: 7 years (Kenya tax and contract law requirement)
• Identity document copies: 3 years from hire completion, then securely destroyed
• Payment records: 7 years (KRA financial record keeping)
• GPS vehicle location logs: 90 days from hire completion, unless required for an ongoing dispute
• CCTV footage: 30 days, unless retained for a specific incident investigation
• Call recordings: 6 months
• Website analytics data: 26 months (anonymised)
• Marketing consent records: Until consent is withdrawn, plus 1 year

6. Your Rights

Under the Kenya Data Protection Act, 2019 (KDPA), you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data where we have no legal basis to retain it
• Right to restrict processing: Request that we limit how we use your data in certain circumstances
• Right to data portability: Receive your data in a structured, commonly used format
• Right to object: Object to processing based on legitimate interests, including direct marketing
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing

If you are dissatisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya at odpc.go.ke.

7. Cookies

Our website uses cookies — small text files placed on your device — to improve your browsing experience and analyse site performance.

7.1 Types of Cookies We Use

• Essential cookies: Required for the website to function (e.g., session management, security). These cannot be disabled.
• Analytics cookies: Help us understand how visitors use our site (e.g., Google Analytics — data is anonymised). You may opt out via your browser settings.
• Functional cookies: Remember your preferences (e.g., form data). Disabled if you reject non-essential cookies.

7.2 Managing Cookies

You can control and delete cookies through your browser settings. Disabling essential cookies may affect site functionality. Refer to your browser's help documentation for instructions.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These include:

• Encrypted data transmission (HTTPS) on our website
• Access controls limiting staff access to personal data on a need-to-know basis
• Secure physical storage for document copies held at our office
• Regular review of data handling practices

No transmission over the internet or electronic storage is completely secure. While we take reasonable precautions, we cannot guarantee absolute security. In the event of a data breach affecting your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner as required by law.

9. Third-Party Links

Our website may contain links to third-party websites including Google Maps, WhatsApp, and social media platforms. These sites operate under their own privacy policies. We are not responsible for their content or data practices. We recommend you review the privacy policy of any third-party site you visit.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email.

Continued use of our services following any changes constitutes your acknowledgement of the updated policy. We encourage you to review this page periodically.

11. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us through any of the following channels: