Privacy Policy

Kendaall Tracking Limited is the data controller for all personal information collected through our website, platform, and IoT device network. We are registered under the laws of Kenya and operate under the regulatory oversight of the Office of the Data Protection Commissioner (ODPC) established by the Kenya Data Protection Act 2019 (DPA 2019).

Our primary place of business is located at 35644 Kasarani Mwiki Road, Nairobi, Kenya 00100. Our company specialises in next-generation asset management for logistics and heavy industry — specifically the real-time monitoring of locomotives, freight wagons, mining equipment, port machinery, and industrial assets in operational service. The platform we operate collects telemetry data from physical IoT devices installed on these assets. While the primary subject of that telemetry is the asset itself, some telemetry — such as operator identification, access event records, and driver behaviour scoring — may constitute personal data where it is linked to an identifiable natural person.

Our registered Data Protection Officer (DPO) is Amara Osei, reachable at privacy@kendaalltracking.co.ke. For enterprise clients who have signed a Data Processing Agreement (DPA) with Kendaall Tracking, the DPA takes precedence over this general Privacy Policy where the two documents address the same subject matter.

This Privacy Policy applies to all personal data processing activities conducted by Kendaall Tracking in connection with the following interactions and relationships.

• Platform Users: Any individual who creates or uses a Kendaall Tracking platform account, including operations managers, fleet supervisors, maintenance engineers, and system administrators employed by or contracted to a Kendaall Tracking client organisation.
• Website Visitors: All individuals who visit kendaalltracking.co.ke or any subdomain operated by Kendaall Tracking, regardless of whether they register for or use the platform.
• Field Personnel: Equipment operators, locomotive drivers, site supervisors, and maintenance technicians who interact with Kendaall hardware devices or the Kendaall mobile application, where such interaction generates personal data such as operator identification events, mobile app login records, or geotagged inspection submissions.
• Contact & Prospect Records: Individuals who contact Kendaall Tracking via email, telephone, or contact form for sales enquiries, support requests, or partnership discussions, whose contact details and communication records are held in our CRM system.
• Third-Party API Integrators: Developer or enterprise technical contacts who register for Kendaall API credentials and whose account registration, API key management, and access log data is processed by our platform.

This policy does not apply to personal data processed by our clients in their own systems, even where that data may have originated from Kendaall telemetry feeds. Clients are responsible for their own compliance with applicable data protection legislation in respect of data held within their own operational systems.

Kendaall Tracking collects personal data through three primary mechanisms: data you provide directly when registering for and using the platform, data generated automatically through your use of our technology, and data received from our enterprise clients in connection with deploying the platform in their operational environment.

The vast majority of data processed by our platform — vibration signatures, temperature readings, pressure measurements, GPS coordinates, fuel consumption metrics, and mechanical cycle counts — relates to physical assets, not to individuals, and does not constitute personal data under the DPA 2019 unless it is linked to a named or identifiable person.

Every processing activity conducted by Kendaall Tracking must rest on a valid legal basis under Section 30 of the Kenya Data Protection Act 2019 and, for clients operating in the European Economic Area, under Article 6 of the GDPR. We do not use a single legal basis as a catch-all; we assess the appropriate basis for each specific processing purpose separately.

• Contractual Necessity: Processing your account registration data, platform access credentials, billing contact records, and integration configuration data is necessary for us to fulfil our contract with you or your organisation.
• Legitimate Interests: Processing platform usage analytics, session data, support interaction records, and internal security monitoring to improve service performance, detect and prevent fraud, and develop new platform features — balanced against and never overriding individual data subject rights.
• Consent: Processing website analytics cookies beyond strictly necessary session management, sending optional marketing communications, and collecting optional profile information beyond core account fields. Consent may be withdrawn at any time without penalty to service delivery.
• Legal Obligation: Retaining financial transaction records, processing data required by a valid court order or regulatory demand, and maintaining compliance documentation for our own regulatory obligations.

Where Kendaall Tracking acts as a data processor for enterprise clients, the client as data controller determines and is responsible for the legal basis for that processing. Kendaall acts only on the documented instructions of the controller.

Personal data collected by Kendaall Tracking is used exclusively for purposes directly connected to delivering, maintaining, improving, and protecting our platform. We do not use personal data for profiling, automated decision-making with legal effects, advertising targeting, or any incompatible purpose.

• Platform Service Delivery: Provisioning and authenticating accounts; routing alert notifications; processing maintenance work order triggers; generating compliance documentation; syncing data with connected enterprise systems.
• Customer Support and Account Management: Responding to support tickets, troubleshooting integrations, onboarding guidance, and periodic account health reviews. Retained for 24 months for quality assurance.
• Platform Performance Improvement: Analysing aggregated and pseudonymised usage patterns to identify feature demand and UX friction points. Analysis is conducted at aggregate level.
• Security Monitoring and Fraud Prevention: Analysing access logs and session patterns to detect unauthorised access, API key abuse, and data exfiltration indicators, on a risk-triggered basis.
• Legal and Regulatory Compliance: Meeting our obligations under Kenyan law, contractual obligations, and standards including ISO 27001.
• Marketing Communications (with Consent): Newsletters, product updates, and event invitations to contacts who have opted in. All marketing emails contain a one-click unsubscribe processed within 24 hours.

Kendaall Tracking shares personal data with third parties only where strictly necessary to deliver our platform services, required by law, or expressly authorised by the data subject.

Sub-Processors we engage include: cloud infrastructure and hosting providers (ISO 27001-certified data centres); email service providers (notification and alert delivery); customer support platform providers; payment processing providers (billing contact and transaction confirmation only, not full card data); and security monitoring providers (access log data for platform security).

All sub-processors are bound by Data Processing Agreements requiring them to process data only on our documented instructions, implement equivalent security measures, notify us promptly of any breach, and return or securely delete data on termination. A current sub-processor list is available on request from our DPO.

Disclosure Required by Law: Where we receive a valid legal demand, we will comply with our obligations, notify the affected data subject where legally permitted, disclose only the minimum data responsive to the demand, and challenge overreaching demands through appropriate legal channels.

Kendaall Tracking’s primary data infrastructure is located within the African region. However, sub-processor relationships, satellite communication providers, and multinational client operations mean personal data may, in certain circumstances, be transferred to or accessed from countries outside Kenya.

Where personal data is transferred to a country not designated as providing adequate protection, we implement appropriate safeguards before transfer, including Standard Contractual Clauses (SCCs), Binding Corporate Rules where applicable, and case-by-case Transfer Impact Assessments (TIAs).

Clients operating under GDPR may request a copy of the SCCs and TIAs governing any transfer of their employees’ personal data to non-EEA sub-processors. Requests should be directed to privacy@kendaalltracking.co.ke.

Kendaall Tracking retains personal data for the minimum period necessary to fulfil its collection purpose, meet contractual obligations, and comply with legal retention requirements.

Upon expiry of the retention period, data is securely deleted or physically destroyed per ISO 27001 disposal procedures. Deletion events are logged with a certificate available to enterprise clients on request. Backups are purged within 90 days of the scheduled production deletion date.

Data security is an engineering priority at Kendaall Tracking. We hold ISO 27001 certification across our information security management system, independently audited annually.

• Encryption at Rest and in Transit: AES-256 at rest; TLS 1.3 minimum in transit with certificate pinning on mobile apps. Satellite and LoRaWAN transmissions use end-to-end application-layer encryption.
• Access Controls: Role-based access control with asset-level granularity; mandatory MFA for staff; Privileged Access Management with full audit logging.
• Security Monitoring and Incident Response: 24/7 Security Operations Centre monitoring; critical incidents escalated within 15 minutes; affected data subjects notified within 72 hours of a confirmed breach.
• Penetration Testing and Vulnerability Management: Independent tests biannually; critical/high findings remediated within 14 days.
• Staff Training and Data Minimisation: Mandatory data protection training on joining and annually thereafter; staff access limited to role-necessary minimum data.

The Kenya Data Protection Act 2019 grants specific, enforceable rights to individuals whose personal data Kendaall Tracking processes.

To exercise any right above, contact our DPO at privacy@kendaalltracking.co.ke identifying the right you wish to exercise. We verify identity, confirm receipt within 72 hours, and aim to complete requests within 30 calendar days (extendable to 60 days for complex requests, with notice).

For field personnel whose data Kendaall processes as a data processor, rights requests should be directed first to the employer (the data controller); Kendaall cooperates fully with any controller-initiated rights process.

Our website uses cookies to enable core functionality, remember preferences, and — with consent — measure audience behaviour.

Manage cookie preferences via the Cookie Preference Centre linked in our footer, or through your browser settings — noting that blocking strictly necessary cookies will impair platform login.

The Kendaall platform is a professional industrial operations tool for adults in commercial and enterprise contexts. We do not knowingly collect personal data from children or minors under 18.

If you believe we have inadvertently collected data relating to a person under 18, contact our DPO at privacy@kendaalltracking.co.ke immediately. Confirmed data will be deleted within 14 days.

We review this Privacy Policy at minimum annually and whenever a material change occurs to processing activities, sub-processor categories, applicable law, or business structure.

Where a revision is material, we notify all active account holders by email at least 30 days before it takes effect, describing the changes and linking both new and previous versions. Continued use after the effective date constitutes acceptance for processing covered by contractual necessity; new purposes previously requiring consent will need fresh consent.

Previous versions are archived and available on request from our DPO.

If you have a question about this policy, wish to exercise a right, or have a concern about how your data has been handled, your first point of contact should always be our DPO.

If dissatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC), the independent supervisory authority under the DPA 2019 with powers to investigate complaints and impose penalties.

ODPC contact: www.odpc.go.ke · +254 20 628 4000 · Teleposta Towers, Kenyatta Avenue, Nairobi, Kenya.

Data subjects in the European Economic Area retain the right to lodge a complaint with a supervisory authority in their country of residence regardless of where Kendaall Tracking is established.