Privacy Policy & Data Processing Agreement

Part I – Privacy Policy

1. Scope

This Privacy Policy explains how Garisoul collects, uses, stores, processes, and protects personal and business data in accordance with the Kenya Data Protection Act 2019 and applicable international standards.

2. Information We Collect

• Business account information (garage name, registration details, contact information)
• User account credentials
• Customer records entered into the system
• Vehicle and transaction data
• Billing and payment information
• Usage data and analytics
• Referral and loyalty activity data

3. Lawful Basis for Processing

We process data based on contractual necessity, legitimate business interests, legal obligations, and user consent where applicable.

4. Purpose of Data Use

• Providing garage management services
• Generating invoices and financial reports
• Managing subscriptions and billing
• Improving platform functionality
• Fraud prevention and security monitoring
• Operating referral and loyalty programs
• Regulatory compliance

5. Data Ownership

Subscribers retain ownership of business and customer data entered into Garisoul. Garisoul acts as a data processor for subscriber-controlled information.

6. Data Security

We implement reasonable technical and organizational safeguards including encryption, access controls, authentication systems, and monitoring mechanisms. Absolute security cannot be guaranteed.

7. Data Retention

Data is retained during the subscription term and for a reasonable period thereafter to comply with legal, regulatory, and backup requirements.

8. International Transfers

Where data is transferred outside Kenya or the MEA region, safeguards consistent with recognized international standards are implemented.

9. User Rights

Users may request access, correction, restriction, or deletion of personal data in accordance with applicable law.

10. Breach Notification

In the event of a notifiable data breach, Garisoul will comply with statutory reporting and notification obligations.

Part II – Data Processing Agreement (DPA)

1. Roles of the Parties

For purposes of applicable data protection laws, the Subscriber is the Data Controller and Garisoul acts as the Data Processor with respect to Customer Data processed through the platform.

2. Subject Matter & Duration

This DPA applies for the duration of the subscription agreement and governs processing of Customer Data necessary to provide the services.

3. Nature & Purpose of Processing

Processing includes collection, storage, organization, retrieval, consultation, reporting, and deletion of data strictly for the operation of the automotive management platform.

4. Types of Data

• Customer identification details
• Vehicle records
• Transaction history
• Business financial records
• Employee performance records

5. Processor Obligations

• Process data only on documented instructions from the Subscriber
• Ensure personnel confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the Subscriber in responding to lawful data subject requests
• Notify Subscriber of data breaches without undue delay

6. Sub-Processors

Garisoul may engage vetted third-party infrastructure, hosting, and payment providers. Sub-processors are contractually bound to confidentiality and security standards.

7. Data Deletion or Return

Upon termination of services, Subscriber may request deletion or return of Customer Data within a reasonable timeframe, subject to legal retention obligations.

8. Audit Rights

Where legally required, Subscribers may request reasonable documentation demonstrating Garisoul’s compliance with applicable data protection standards.

9. Liability Allocation

Each party is responsible for its own compliance with applicable data protection laws. Liability is subject to the limitations outlined in the Terms & Conditions.

10. Governing Law

This DPA is governed by the laws of the Republic of Kenya.