Data Policy

How Safiri by Citrus collects, processes, and safeguards your information

Effective Date: January 11th, 2025
Last Updated: March 17th, 2025
Contact Information:

Email: legal@citruslabs.co.ke

Mailing Address: P.O. Box 23983 - 00100

Phone: +254 112 400 000

1. Introduction & Scope

This Data Policy outlines how Safiri by Citrus ("the Platform") collects, uses, stores, and protects personal and other data from Driver account users. The purpose of this Policy is to ensure transparency and compliance with Kenyan Data Protection laws, including the Data Protection Act (2025) and any other applicable regulations. This Policy applies solely to Driver account users who use the Platform for managing real-time route updates, trip management, student pick-up and drop-off tracking, and related communication functions.

2. Definitions

Personal Data

Any information relating to an identified or identifiable natural person, including but not limited to names, contact information, and driver identification details.

Processing

Any operation or set of operations performed on personal data, whether automated or manual, such as collection, recording, organization, storage, alteration, retrieval, consultation, use, disclosure, or deletion.

Data Subject

Any Driver account user whose personal data is processed by the Platform.

Data Controller

Citrus Labs Limited, which determines the purposes and means of processing personal data.

Data Processor

Any third party engaged by Citrus Labs Limited to process personal data on its behalf.

Sensitive Data

Personal data that includes information about a data subject's health, biometric data, or any other data requiring special protection under Kenyan law.

3. Types of Data Collected

Safiri by Citrus collects the following data from Driver account users:

Personal Information

Name, contact details (email, phone number), driver's license information, vehicle details, and any unique identifiers required for account registration.

Usage Data

Information on how the Platform is accessed and used, including login timestamps, session durations, and feature usage patterns.

Device Information

Data related to the devices used to access the Platform, such as IP address, device type, operating system, and browser type.

Cookies and Tracking Data

If applicable, data collected through cookies and similar tracking technologies to enhance user experience and system functionality.

Sensitive data, if collected (e.g., biometric verification for enhanced security), will be handled with additional safeguards as required by law.

4. Legal Basis for Data Processing

The legal grounds for processing personal data under this Policy include:

Consent

Driver account users provide explicit consent when registering and using the Platform.

Contractual Necessity

Processing is necessary to fulfill the terms of service and to deliver the functionalities of the Platform.

Legal Obligation

Citrus Labs Limited processes data as required by applicable Kenyan laws and regulations.

Legitimate Interests

Processing is carried out to ensure the efficient, secure, and effective operation of the Platform, provided these interests are not overridden by the rights and freedoms of the data subjects.

User consent is obtained during the account registration process, with clear information provided on the purposes of data processing.

5. Purpose of Data Collection and Processing

Data collected from Driver account users is processed for the following purposes:

Service Delivery

To provide real-time route updates, manage trips, and track student pick-ups and drop-offs.

Customer Support

To facilitate communication and resolve issues or inquiries from Driver account users.

System Security

To maintain the integrity and security of the Platform, including fraud prevention and unauthorized access detection.

Performance Optimization

To analyze usage data and improve the Platform's functionality, user experience, and operational efficiency.

Compliance

To ensure adherence to legal, regulatory, and contractual obligations.

6. Data Storage and Security Measures

Data Storage

Personal data is stored securely on cloud-based servers and may be processed using third-party storage services that meet industry standards. Data is retained for as long as necessary to fulfill the purposes outlined in this Policy or as required by law.

Security Measures

The Platform employs robust security protocols, including:

  • Data encryption both in transit and at rest.
  • Access controls and authentication measures.
  • Regular security audits and vulnerability assessments.
  • Implementation of firewalls and intrusion detection systems.

7. Data Sharing and Third-Party Disclosures

8. User Rights and Access

Driver account users have the following rights regarding their personal data:

Right of Access

The right to request and obtain details about the personal data held by Citrus Labs Limited.

Right to Rectification

The right to request corrections to any inaccurate or incomplete personal data.

Right to Deletion

The right to request deletion of personal data, subject to legal and contractual obligations.

Right to Restrict Processing

The right to request limitations on the processing of personal data.

Right to Data Portability

The right to request the transfer of personal data to another service provider.

Right to Object

The right to object to processing based on legitimate interests.

Requests to exercise these rights can be submitted via the contact information provided in this Policy.

9. Data Retention and Deletion

Retention Period

Personal data will be retained for the duration necessary to fulfill the purposes for which it was collected, or as required by law. Specific retention periods may vary based on data type and legal requirements.

Deletion Process

When personal data is no longer required, it will be securely deleted or anonymized in accordance with Citrus Labs Limited's data retention policies and applicable legal standards.

10. Data Breach Notification and Response

Detection and Reporting

In the event of a data breach, Citrus Labs Limited will promptly investigate the incident and take appropriate remedial action.

Notification

Users will be notified of any data breach involving their personal data within a reasonable timeframe, and notifications will be provided to relevant regulatory authorities as required by Kenyan law.

Response Plan

The Platform maintains a data breach response plan to mitigate potential harm and prevent future incidents, including remedial measures and ongoing monitoring.

11. Cookies and Tracking Technologies

Use of Cookies

The Platform may use cookies and similar tracking technologies to enhance user experience and gather usage data.

User Control

Users can manage or opt out of cookie usage through their browser settings or by using tools provided on the Platform, subject to any limitations on functionality.

12. Policy Updates and Amendments

Updates

Citrus Labs Limited reserves the right to update this Data Policy as necessary. Material changes will be communicated to users via email or through a notice on the Platform.

Effective Notification

Continued use of the Platform after the effective date of any updated policy constitutes acceptance of the changes.

13. Contact Information and Complaints

For questions, clarifications, or to exercise your rights under this Data Policy, please contact us at:

Email: legal@citruslabs.co.ke

Mailing Address: P.O. Box 23983 - 00100

Phone: +254 112 400 000

If you believe your data has been mishandled, you may lodge a complaint with the relevant data protection authority in Kenya.

By using the Safiri by Citrus Driver account, you acknowledge that you have read, understood, and consent to the collection, use, and disclosure of your personal data as described in this Data Policy.

Driver Data Flow

Understanding how your data moves through our platform

Data Collection

We collect your personal and usage data when you register and use our platform.

Data Processing

Your data is processed to enable platform functionality and improve user experience.

Data Storage

We securely store your data with advanced encryption and security measures.

Data Use

Your data enables route management, student tracking, and communications.

Data Sharing

Limited sharing with authorized third parties for service delivery.

Data Deletion

Data is securely deleted or anonymized when no longer needed.

Quick Actions

Request Data Access

Request a copy of your personal data

Request Data Deletion

Request deletion of your personal data

Update Preferences

Manage your communication preferences

Ask a Question

Contact our data protection team