Privacy Policy

Understanding how we collect, use, and protect your information

Effective Date: January 11th, 2025
Last Updated: March 17th, 2025
Contact Information:

Email: legal@citruslabs.co.ke

Mailing Address: P.O. Box 23983 - 00100

Phone: +254 112 400 000

Driver Platform Functions

This Privacy Policy applies to the following key functions of the Safiri by Citrus Driver Account:

Real-time Route Updates

Navigation and route optimization for school transportation

Trip Management

Scheduling and managing daily transportation routes

Student Pick-up/Drop-off Tracking

Monitoring and recording student transportation activities

Communication with Schools

Direct messaging with school administrators

Communication with Parents

Updates and notifications to parents about transportation

Vehicle Status Reporting

Maintenance updates and vehicle condition monitoring

1. Introduction & Overview

This Privacy Policy outlines how Safiri by Citrus ("the Platform") collects, processes, stores, and protects personal and other data from users of the Driver account. The purpose of this Policy is to ensure transparency in our data practices and to affirm our commitment to protecting the privacy of school transport drivers. This Policy complies with Kenyan Data Protection laws, including the Data Protection Act (2025), as well as any other applicable regulations. It applies exclusively to users of the Driver account, which is designed to provide real-time route updates, streamlined trip management, and tools for tracking student pick-ups and drop-offs, along with secure communication with school administrators and parents.

Compliance with Kenyan Data Protection laws

This Policy adheres to all applicable Kenyan data protection regulations, ensuring that your personal information is handled in accordance with the highest legal standards.

Specifically for Driver accounts

This Privacy Policy applies exclusively to Driver account users and the specific features and functionalities available to drivers through the Safiri by Citrus platform.

2. Definitions

Personal Data

Any information relating to an identified or identifiable natural person, such as names, contact details, driver's license information, and vehicle details.

Processing

Any operation performed on personal data, including collection, recording, storage, organization, modification, retrieval, consultation, use, disclosure, or deletion.

Data Subject

Any Driver account user whose personal data is processed by the Platform.

Data Controller

Citrus Labs Limited, which determines the purposes and means of processing personal data.

Data Processor

Any third party engaged by Citrus Labs Limited to process personal data on its behalf.

Sensitive Data

Data that requires special protection under Kenyan law, such as biometric or other sensitive personal information.

Cookies

Small data files placed on your device to enhance user experience and facilitate tracking of usage patterns.

3. Data Collection

Safiri by Citrus collects the following types of data from Driver account users:

Personal Information

Such as full name, contact details (email address, phone number), driver's license number, vehicle registration details, and any other identification information provided during registration.

Usage Data

Information about how users interact with the Platform, including login timestamps, session durations, and activity logs.

Device Information

Data related to the device used to access the Platform, such as IP address, device type, operating system, and browser type.

Cookies and Tracking Data

Information collected via cookies and similar technologies to enhance user experience and analyze usage patterns.

Sensitive Data

If applicable, any sensitive personal information provided by the user will be processed with additional safeguards in accordance with Kenyan law.

Data may be collected directly from users during account registration and through automated data collection tools integrated within the Platform.

4. Legal Basis for Data Processing

The processing of personal data is carried out on the following legal bases:

Consent

Users provide explicit consent during account registration and via subsequent consent mechanisms for specific data processing activities.

Contractual Necessity

Processing is necessary for the performance of the contract between the user and Citrus Labs Limited, including the provision of the Platform's services.

Legal Obligation

Data is processed as required to comply with applicable laws and regulatory obligations.

Legitimate Interests

Processing is conducted for the legitimate interests of Citrus Labs Limited in ensuring the efficient, secure, and effective operation of the Platform, provided these interests do not override the rights of the users.

5. Purpose & Use of Data

Data collected from Driver account users is processed for the following purposes:

Service Delivery

To provide real-time route updates, manage trip scheduling, and facilitate tracking of student pick-ups and drop-offs.

Customer Support

To address user inquiries, provide technical support, and resolve issues.

System Improvement

To analyze usage data and feedback for continuous enhancement of the Platform's functionality and user experience.

Security

To protect the Platform and its users, including fraud prevention, incident response, and monitoring for unauthorized access.

Compliance

To ensure adherence to legal and regulatory obligations.

Marketing and Communication

To send users updates about new features, security alerts, and relevant promotional information, subject to user consent.

6. Data Storage & Security Measures

Data Storage

Personal data is stored on secure, cloud-based servers managed by reputable third-party service providers. The data retention period is determined based on the purposes for which the data is collected and in compliance with applicable legal requirements.

Security Measures

To protect user data, the Platform implements:

Encryption

Data is encrypted in transit and at rest.

Access Controls

Strict access controls and multi-factor authentication are employed.

Regular Audits

Periodic security audits and vulnerability assessments to identify and mitigate risks.

Backup and Recovery

Robust data backup procedures and disaster recovery plans to prevent data loss.

7. Data Sharing & Third-Party Disclosures

8. User Rights and Access

Driver account users have the following rights regarding their personal data:

Right to Access

The right to request access to the personal data held by Citrus Labs Limited.

Right to Rectification

The right to request correction of any inaccurate or incomplete personal data.

Right to Erasure

The right to request deletion of personal data, subject to legal and contractual constraints.

Right to Restrict Processing

The right to request limitations on the processing of personal data in certain circumstances.

Right to Data Portability

The right to obtain personal data in a structured, commonly used, and machine-readable format.

Right to Object

The right to object to the processing of personal data based on legitimate interests or for direct marketing purposes.

Users may exercise these rights by contacting us using the contact details provided in Section 13.

9. Data Retention and Deletion

Retention Period

Personal data is retained for as long as necessary to fulfill the purposes for which it was collected or as required by law. Specific retention periods will be defined based on the type of data and applicable legal obligations.

Deletion Process

When personal data is no longer required, it will be securely deleted or anonymized in accordance with Citrus Labs Limited's data retention policies.

10. Data Breach Notification

Detection and Reporting

The Platform employs monitoring systems to detect any data breaches. In the event of a breach, Citrus Labs Limited will promptly investigate and take remedial measures.

Notification

Affected users will be notified of a data breach involving their personal data within a reasonable timeframe, and regulatory authorities will be informed in accordance with Kenyan law.

Response Plan

A comprehensive data breach response plan is in place to mitigate potential harm and prevent future breaches.

11. Cookies and Tracking Technologies

Use of Cookies

The Platform may use cookies and similar tracking technologies to enhance the user experience and analyze usage patterns.

Management

Users can manage or disable cookies through their browser settings, though this may affect the functionality of the Platform.

12. Policy Updates and Amendments

Updates

Citrus Labs Limited reserves the right to update this Privacy Policy periodically. Material changes will be communicated to users via email or through prominent notices on the Platform.

User Acceptance

Continued use of the Platform after any such updates constitutes acceptance of the revised Privacy Policy.

13. Contact Information and Complaints

Contact Details

Email: legal@citruslabs.co.ke

Mailing Address: P.O. Box 23983 - 00100

Phone: +254 112 400 000

Escalation Process

If you believe your personal data has been mishandled or you wish to escalate a complaint, you may also contact the relevant data protection authority in Kenya.

Request Data Access Request Data Deletion Contact Us

By using the Safiri by Citrus Platform as a Driver account user, you acknowledge that you have read, understood, and consent to the collection, processing, storage, and sharing of your personal data as described in this Privacy Policy.

Download Privacy Policy (PDF)

How We Compare

See how Safiri by Citrus prioritizes your privacy compared to industry standards

Privacy Feature Safiri by Citrus Industry Standard
Data Encryption End-to-end encryption Basic encryption
User Data Control Full control with easy access Limited control
Third-Party Sharing Limited & transparent Often extensive & unclear
Data Retention Purpose-based limits Often indefinite
Marketing Communications Opt-in by default Often opt-out required