1. Who we are
FleetCrest Limited ("FleetCrest", "we", "us") is a private limited company registered in Kenya (Company No. PVT-EY1B87WD), with its registered office in Westlands, Nairobi. We provide GPS tracking, fleet management, fuel monitoring and telematics services through our website fleetcrest.co.ke and the FleetCrest app.
This policy explains what personal data we collect, why, how long we keep it, who we share it with, and your rights under the Data Protection Act, 2019 of Kenya.
Contact for anything in this policy: privacy@fleetcrest.co.ke, +254 702 760 122.
2. Our role: controller or processor
- Individuals who track their own vehicle: FleetCrest is the data controller of your account and vehicle data.
- Businesses and institutions that track their fleets: you (the customer) are the data controller of data about your drivers and vehicles, and FleetCrest acts as your data processor, handling that data only on your instructions and to provide the service. FleetCrest remains the controller of your account, billing and support data.
- Website visitors and demo users: FleetCrest is the data controller.
3. What we collect
- Account and contact data: name, phone number, email address, company name, and the role of each team member.
- Vehicle data: registration plate, vehicle type and the details needed to install and configure devices.
- Location and vehicle activity: GPS position, speed, heading, trip history, ignition status, power and tamper events, and geofence entries and exits.
- Fuel data (fuel plan): fuel tank levels from sensors, refuel and drop events, and the fuel receipts you record.
- Driver data (if you use these features): driver names, vehicle assignments and driving events such as harsh braking, acceleration and cornering, with a driving score.
- Video (only where an optional camera kit is installed): road-facing clips, and in-cabin clips only where the customer has confirmed drivers were informed and notices are displayed.
- Installation records: installation details, photos of the fitted equipment, consent forms and installation certificates.
- Usage and security data: login times, a hashed (not raw) IP address, which sections of the app are used during a demo, and an audit log of important actions such as engine immobilisation commands.
- Communications: messages you send us by WhatsApp, phone or email, and requests you submit through the website.
- Billing data: quotes, invoices and payment references. We do not store card numbers or M-Pesa PINs.
4. Why we use it (and our lawful basis)
| Purpose | Lawful basis |
|---|---|
| Providing tracking, fleet, fuel, telematics and video services you signed up for | Performance of a contract |
| Installing, configuring and supporting devices | Performance of a contract |
| Sending alerts and summaries according to your notification settings | Performance of a contract |
| Security, fraud prevention, audit logs and keeping the service reliable | Legitimate interests |
| Following up on demo requests and enquiries | Legitimate interests (you can object at any time) |
| Invoicing and keeping tax records | Legal obligation |
| In-cabin video | The customer's lawful basis, which must include informing drivers; we only enable it after the customer confirms this |
We do not sell personal data, and we do not use it for third-party advertising.
5. Drivers and other people in tracked vehicles
Customers who track vehicles driven by employees or others are responsible for having a lawful basis to do so, and for informing drivers that the vehicle is tracked (and filmed, where a camera is fitted). Drivers can contact the customer directly, or contact us at privacy@fleetcrest.co.ke and we will pass the request to the customer.
6. Who we share data with
We share data only as needed to run the service:
- Hosting: servers in data centres operated by netcup GmbH in Germany (EU).
- Encrypted backups: Backblaze, in the United States. Backups are encrypted before they leave our servers, with keys we hold.
- Maps: Mapbox, in the United States, provides map images. Your vehicle positions are not sent to Mapbox as records; map requests reveal only the map area being viewed.
- Email delivery: our email provider sends alerts and login links.
- Mobile networks: devices use mobile SIM data (e.g. Safaricom) to send positions.
- People you authorise: your team members, and organisations you choose to share with, such as a lender for a financed vehicle.
- Authorities: when the law requires it, for example a valid court order.
Transfers outside Kenya. Some providers are outside Kenya (Germany and the United States). We transfer data only with appropriate safeguards as required by the Data Protection Act: encryption in transit and at rest, access restricted to what each provider needs, and contractual terms with each provider.
7. How long we keep it
| Data | Retention |
|---|---|
| GPS, trip, fuel, alert and driving data | While the account is active, plus 90 days after it closes |
| Video clips | 30 days by default (customers can set 7–90 days) |
| Demo account data | Deleted 30 days after the demo ends; the contact record is kept for follow-up and anonymised after 12 months |
| Login and security logs | 180 days |
| Invoices and tax records | 5 years, as required by Kenyan tax law |
| Backups | Encrypted backups are kept for up to 6 months. Deleted data disappears from backups as they expire |
8. How we protect it
- Encryption in transit (HTTPS) and for backups and video at rest.
- Role-based access (Owner, Manager, Viewer).
- Separation between customer organisations.
- Audit logs for sensitive actions.
- Remote immobilisation protected by safety checks.
- Access to production systems is limited to authorised FleetCrest staff.
No system is perfectly secure. If a breach affects your personal data, we will notify the Office of the Data Protection Commissioner and affected people as the law requires.
9. Your rights
Under the Data Protection Act you have the right to:
- be informed about how your data is used;
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data deleted, where we are not required to keep it;
- object to processing based on legitimate interests (including follow-up messages);
- data portability: receive your data in a common electronic format.
Email privacy@fleetcrest.co.ke. We may need to verify your identity, and we will respond within the timelines the Act and its regulations set. If your data is held by a fleet customer (for example, your employer), we will forward your request to them.
You also have the right to complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
10. Cookies
We use only the cookies needed to keep you signed in and secure. We do not use advertising cookies or cross-site tracking.
11. Children
FleetCrest is not intended for anyone under 18. We do not knowingly collect children's personal data as account holders.
12. Changes
If we change this policy, we will update the version and date above. For significant changes, we will notify account holders by email or in the app before they take effect.