Privacy Policy

Delace Technologies Limited (Delace, we) runs delace.co.ke and sells vehicle tracking and telematics equipment, electronics, office equipment and supplies from Nairobi, Kenya. For the personal data described in this policy we are the data controller under the Data Protection Act, 2019 (the Act).

This policy explains what we collect, why, who we share it with, where it is stored, how long we keep it, and your rights. It applies to the Site, our emails, and orders, quotations, receipts and installations we handle. Questions or requests: [email protected] or +254 717 520 648.

It is designed to give the notice required before collection under the Data Protection Act, 2019 and reflects the Data Protection (General), Registration, and Complaints Handling Regulations, 2021. It does not replace any mandatory protection available to you under Kenyan law.

We do not ask for sensitive personal data as defined in the Act (such as health, biometric, ethnic or religious data). We do not collect card numbers; future online payments will be handled by licensed payment providers.

Section 30 of the Act lets us process personal data only on a lawful basis. We rely on:

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

• We send offers and product updates only if you ticked the box to receive them (the box can be unticked when you sign up).
• Every marketing email has an Unsubscribe link that works in one click, and you can also ask us by email. We stop marketing to you promptly, as section 37 of the Act and its regulations require for commercial use of personal data.
• Unsubscribing does not stop service emails we need to send about your account, orders, quotations or receipts.
• We do not sell or rent your personal data, and we do not share it with others for their own marketing.

These are needed for the Site to work, so they do not require consent. We do not use advertising or cross-site tracking cookies. If we ever add analytics or advertising cookies, we will ask for your consent first and update this policy.

We share personal data only where needed, with service providers acting on our instructions under written contracts that require them to protect it (data processors):

We may also share data with:

• Couriers and logistics partners, to deliver your order (name, phone, delivery address).
• Payment providers such as Safaricom (M-Pesa) and Pesapal, when online payments launch, to process your payment.
• The Kenya Revenue Authority and other authorities where the law requires, and our professional advisers (such as auditors) under confidentiality.
• A buyer or successor if our business is sold or reorganised, under the same protections.

Some of our providers may store or process data outside Kenya, and their networks may route data through other countries. Under sections 48 to 50 of the Act and the Data Protection (General) Regulations, 2021, we make those transfers only where the required safeguards, lawful transfer condition or consent is in place. These may include contractual data-protection commitments, an assessment of the destination and provider, and records of the transfer.

We do not transfer sensitive personal data abroad. You can ask us for details of the safeguards for a particular transfer.

When data is no longer needed we delete it or anonymise it so it can no longer identify you.

• Data is encrypted in transit (HTTPS/TLS) and stored with providers that encrypt data at rest.
• Passwords are never stored in readable form; we keep only a salted scrypt hash.
• Access to customer data is limited to staff who need it, behind authenticated, admin-only access, and email confirmation links work once and expire.
• We limit request rates and sign-in attempts to protect accounts from automated attacks.
• If a personal data breach is likely to put your rights at risk, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it, and tell you without undue delay where there is a high risk to you, as section 43 of the Act requires.

Under section 26 and related provisions of the Act you have the right to:

• Be informed about how your data is used (this policy).
• Access the personal data we hold about you.
• Correct data that is inaccurate, out of date or incomplete.
• Delete data that is no longer needed or was processed unlawfully, subject to records we must keep by law.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, without affecting earlier processing.
• Data portability: receive your data in a structured, commonly used format, or have it sent to another controller.
• Restrict processing in certain circumstances, for example while we check its accuracy.
• Not be subject to decisions based solely on automated processing (we do not make such decisions).

To exercise a right, email [email protected] from the address on your account or tell us how to verify your identity. There is normally no charge. We will respond within the applicable time limit. For example, the General Regulations set seven days for an access request and fourteen days for an objection or restriction request; if we lawfully decline a request, we will explain why and tell you about your right to complain.

The Site is for adults and businesses. Accounts and orders are for people aged 18 or over, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

When we sell or install a GPS tracker, dashcam, fuel sensor or driver ID device, we keep the installation records listed above. The location, driving and camera data the device produces afterwards is sent to the tracking platform you choose, not to Delace, unless we have agreed in writing to provide that service.

If you use these devices on vehicles driven by employees or others, you are usually the data controller for that data. You must tell drivers what is collected and why, process it lawfully and securely, and handle their requests under the Act. Our Terms of Service set out how devices must be used.

If you are unhappy with how we handle your data, please contact us first at [email protected] so we can try to put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), the regulator in Kenya, through www.odpc.go.ke.

We review this policy at least once a year and whenever we change how we handle personal data, for example when online payments or analytics launch. The version and effective date are shown at the top. If a change is significant we will notify account holders by email before it applies.

• Delace Technologies Limited (data controller), Nairobi, Kenya
• Email: [email protected], with “Privacy” in the subject line
• Phone: +254 717 520 648 (Monday–Saturday, 8:00 AM–6:00 PM (EAT))