Eliners Tours

Privacy & Data Protection Policy Aligned with the Kenya Data Protection Act 2019

Last Updated: March 2026 SSL Secured

Eliners Tours and Car Hire Limited +254 724707223 datapolicy@elinerstourscarhire.com

1. Our Commitment to Privacy

Eliners Tours and Car Hire Limited ("we", "our", "us") respects your privacy and is committed to protecting your personal data in alignment with the Kenya Data Protection Act, 2019.

This Privacy Policy explains:

What personal data we collect
How we use and protect your information
Your rights under Kenyan law
How to contact us about your data

We process personal data responsibly and only for legitimate business purposes necessary to provide our transport and car hire services.

2. Data Controller & Contact Information

Company: Eliners Tours and Car Hire Limited

Data Protection Officer (DPO): datapolicy@elinerstourscarhire.com

Phone: +254 714392633

Physical Address: Eldoret, Kenya

Response Time: We acknowledge all data requests within 72 hours and respond fully within 30 days.

3. Personal Data We Collect

Full Name Phone Number Email Address National ID / Passport Pickup/Drop-off Location Travel Dates KRA PIN (invoicing) Device / IP Address Payment transaction details (processed securely through payment providers)

Identification documents (National ID/Passport) are collected strictly for verification, security, and contractual purposes related to vehicle rental.

How We Collect: Directly from you when you:

Make a booking through our website, phone, or in person
Fill in contact or inquiry forms
Communicate with our customer support team
Use our website (automatically collected technical data)

Special Note: We only collect information that is necessary to provide our services and meet legal or operational requirements.

4. Company Fleet GPS Tracking

Important: GPS tracking is installed on company-owned vehicles only - we do not track customers' personal vehicles.

Some vehicles in our rental fleet are equipped with GPS tracking devices. These trackers are installed on company-owned vehicles for legitimate operational purposes only:

Vehicle recovery in case of theft
Fleet management and operational efficiency
Safety monitoring of company assets

What This Means For You:

✅ The device tracks the vehicle's location, not your personal movements
✅ We do not monitor individual driving behavior
✅ GPS data is never used for marketing purposes
✅ Data is retained only while the vehicle is rented and deleted within 30 days after return

If you have questions about fleet tracking, please contact our Data Protection Officer.

5. Data Protection Principles (DPA 2019)

Lawful & Fair Processing

We process your data lawfully, fairly, and transparently.

Purpose Limitation

Data collected only for specified, legitimate purposes.

Data Minimization

We collect only what's necessary for our services.

Accuracy

We keep your information accurate and up-to-date.

Storage Limitation

Data retained only as long as necessary.

Integrity & Confidentiality

We protect your data with appropriate security.

6. How We Use Your Data

Purpose	Data Used	Legal Basis
Booking Processing	Name, Phone, Email, ID, Pickup/Drop-off	Contract performance
Legal Compliance	ID, KRA PIN, Booking records	Legal obligation (tax, regulatory)
Customer Support	Contact details, Booking history	Legitimate interest (resolving inquiries, improving service)
Service Improvement	Usage data, Feedback	Legitimate interest (enhancing customer experience)
Marketing Communications	Email, Phone	Consent (you can opt out anytime)
Fraud Prevention	ID, IP address, Booking patterns	Legitimate interest (protecting our business and customers)

Marketing Opt-Out: You can unsubscribe from marketing emails at any time by clicking "unsubscribe" in any message or contacting us directly.

7. Data Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

Secure Servers
Encrypted databases

Access Control
Need-to-know basis only

Firewalls & Monitoring
24/7 system monitoring

Regular Backups
Disaster recovery

SSL Encryption: All data transmitted through our website is protected using SSL encryption, ensuring your information remains private and secure during online transactions.

8. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes collected, plus any legal or regulatory requirements.

Data Type	Retention Period
Booking & Financial Records	7 years (tax/legal requirement)
Customer Support Inquiries	36 months after last contact
GPS Tracking Data (fleet vehicles)	30 days after vehicle return
Marketing Contacts	Until consent withdrawn
Website Usage Data	12 months

After these periods, data is securely deleted or anonymized.

9. Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms:

We will notify the Office of the Data Protection Commissioner (Kenya) within 72 hours of becoming aware
If the breach is likely to cause you harm, we will inform you directly
We will take immediate steps to contain and remediate the breach

Our Data Protection Officer leads our incident response team.

10. International Data Transfers

We primarily store and process data within Kenya. However, we may use cloud services (such as email, document storage, or booking platforms) that store data outside Kenya.

When we transfer data outside Kenya, we ensure:

The destination country has adequate data protection laws, OR
We have contractual safeguards (Standard Contractual Clauses) in place
The same level of protection required under Kenyan law is maintained

11. Your Rights Under Kenyan Law

Access your data

Correct inaccuracies

Request deletion

Object to processing

Restrict processing

Data portability

Withdraw consent

Lodge a complaint

How to exercise your rights: Email our DPO at datapolicy@elinerstourscarhire.com. We will respond within 30 days.

Right to Object: You have the right to object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds.

12. Children's Privacy

Our services are intended for individuals aged 18 years and above. We do not knowingly collect personal data from minors (under 18).

If you believe we have inadvertently collected data from a minor, please contact us immediately so we can delete it.

13. Cookies & Tracking Technologies

Our website uses cookies to improve functionality and analyze traffic. Cookies are small text files stored on your device.

Types of cookies we use:

Essential cookies: Required for website operation
Analytics cookies: Help us understand how visitors use our site

You can disable cookies through your browser settings. However, some website features may not function properly.

14. Data Sharing

We do not sell your personal data. Period.

We may share your data with the following categories of recipients:

Payment processors (to complete transactions)
Booking system providers (to manage reservations)
Insurance providers (when required for coverage)
Government authorities (when legally required by Kenyan law)

All third parties are contractually obligated to protect your data and use it only for the specified purposes.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in:

Legal or regulatory requirements
Our business practices
New technologies or services

The latest version will always be available on our website. For significant changes, we may notify you by email.

Last updated: March 2026

Data Protection Officer

The DPO

dataprivacy@elinerstourscarhire.com

+254 724707223

Response within 30 days

Raise a Complaint

Step 1: Contact us first. We'll do our best to resolve your concern.

Step 2: If unsatisfied, you have the right to lodge a complaint with:

Office of the Data Protection Commissioner (Kenya)

www.odpc.go.ke

Quick Help

To unsubscribe from marketing

To request your data

To update your information

Just email our DPO