Privacy policy

1. Who we are

VeloCars (velocars.co.ke) is operated by VeloCars. This policy explains how we handle personal data on the public marketplace and in VeloCars accounts, in line with the Kenya Data Protection Act, 2019. Questions or requests: support@velocars.co.ke.

Dealers who use the VeloCars workspace keep their own customer records there. For those records, the dealer decides how the data is used and is responsible for it; VeloCars stores and processes it on the dealer’s behalf.

2. What we collect

When you contact a dealer

Enquiry, test-drive and callback forms collect your name, your email address or mobile number, your message, and, for test drives, your preferred time. We also record which car you asked about.

When you create or use an account

Your name and the email address or mobile number you sign in with. We send one-time codes to it to confirm it is yours. If a dealer invites you to the customer portal, we also hold the records that dealer shares with you, such as orders, payments and import approvals.

When you browse

• Usage events: which listings were shown, opened and saved, and taps on WhatsApp or call buttons. They are linked to a random visitor code, not your name, and are deleted after 35 days. We use them to rank listings fairly and to show dealers how their cars perform.
• Technical data: IP address, browser and device type, kept in server logs for security.
• Cookies and device storage: a session cookie and a security (CSRF) cookie that the site needs to work. Your browser’s local storage holds your saved cars, compare list, recent search and photo-quality choice, and that data stays on your device. We do not use advertising cookies.

When you message a dealer on WhatsApp or by phone

That conversation happens on WhatsApp or your phone network, directly with the dealer. VeloCars does not see it; we only record that the button was tapped.

3. Why we use it

• To pass your enquiry to the dealer you chose, and let them reply (performing your request).
• To run your account and sign you in securely (contract).
• To keep the marketplace safe, prevent fraud and spam, and fix problems (legitimate interests).
• To rank listings and give dealers anonymous performance figures (legitimate interests).
• To meet legal obligations, such as responding to lawful requests from authorities (legal obligation).

We do not sell your personal data, and we do not use it for third-party advertising.

4. Who we share it with

• The dealer you contact. Your enquiry goes only to the dealer named on the form. That dealer then holds your details and is responsible for how they use them.
• Service providers who help us run VeloCars, such as hosting, email delivery and SMS for sign-in codes. They may only use the data to provide that service to us.
• Authorities, when Kenyan law requires it or to protect people from fraud or harm.

Some providers may store data outside Kenya. When they do, we use providers with appropriate safeguards, as the Data Protection Act requires.

5. How long we keep it

• Usage events: 35 days.
• Enquiries: for as long as the dealer keeps them in their workspace, or until you ask us to delete them.
• Account data: while your account is open, and afterwards only as long as needed for legal, tax or dispute purposes.

6. How we protect it

Data is sent over encrypted connections. Each dealer’s workspace is kept separate from every other dealer’s, staff access depends on their role, and sign-in uses one-time codes instead of passwords.

7. Your rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• be told how your data is used;
• access your data and get a copy of it;
• have wrong data corrected;
• have data deleted;
• object to some uses of your data;
• move your data to another service, where that applies.

To use these rights, email support@velocars.co.ke. For data that a dealer holds about you, we will pass your request to that dealer. If you are not satisfied with our reply, you can complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

8. Children

VeloCars is for people aged 18 and over. We do not knowingly collect data from children.

9. Changes

We may update this policy. The date at the top shows when it last changed. We will tell account holders about significant changes.