Privacy Policy

1. Introduction

VehikoHQ ("we", "us", "our") is a workshop management platform operated from Nairobi, Kenya. We are committed to protecting the privacy and security of personal data in accordance with the Kenya Data Protection Act, 2019 and the regulations of the Office of the Data Protection Commissioner (ODPC).

This Privacy Policy explains how we collect, use, store, and protect information when you use VehikoHQ at vehikohq.com and any associated services.

2. Data Controller

VehikoHQ acts as a data processor for workshop businesses (our customers) and a data controller for information collected directly from users who register on our platform. Each workshop tenant is the data controller for their own customer and vehicle records.

3. Information We Collect

3.1 Account & Workshop Information

• Workshop name, address, city, country
• Contact person name, email address, phone number
• KRA PIN (if voluntarily provided for invoice generation)
• Website and tagline (optional)
• Workshop logo (optional)

3.2 User Account Information

• Full name, email address, phone number
• Encrypted password (bcrypt hashed — we never store plain text passwords)
• User role (Admin, User, Technician)

3.3 Workshop Operational Data

• Customer names, phone numbers, and email addresses
• Vehicle details: registration number, VIN, make, model, year
• Job card records: descriptions, parts, labour, photos, technician assignments
• Financial records: invoices, quotations, payments, purchase orders
• Inventory and supplier information

3.4 Automatically Collected Information

• Browser type and version
• Device information
• Login timestamps
• IP address (for security purposes)

4. How We Use Your Information

We use the collected information for the following purposes:

• Service delivery: Operating the workshop management platform, including job cards, invoicing, payments, and inventory management
• Communication: Sending job assignment notifications, status updates, and service-related emails and SMS messages
• Document generation: Creating invoices, receipts, quotations, and purchase orders with your workshop branding
• Security: Protecting accounts, detecting fraud, and preventing unauthorized access
• Platform improvement: Understanding usage patterns to improve features and performance

5. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we process personal data based on:

• Consent: When you register an account and agree to these terms
• Contract performance: To provide the services you have subscribed to
• Legitimate interest: To maintain platform security and prevent abuse
• Legal obligation: Where required by Kenyan law

6. Multi-Tenant Data Isolation

VehikoHQ operates as a multi-tenant platform. This means multiple workshop businesses use the same platform, but each workshop's data is strictly isolated. Specifically:

• Workshop A cannot view, access, or modify Workshop B's customers, vehicles, invoices, or any other records
• Every database query is filtered by tenant ID
• File uploads (photos, logos) are stored privately with access controls
• User accounts are bound to their workshop tenant

7. Data Storage & Security

• Data is stored on secure, encrypted cloud infrastructure
• All connections use HTTPS/TLS encryption in transit
• Passwords are hashed using bcrypt (industry standard)
• File uploads use private cloud storage with signed URLs (no public access)
• Database access is restricted to authorized application services only
• Regular backups are maintained to prevent data loss

8. Data Sharing

We do not sell, rent, or trade your personal data. We may share data only in these limited circumstances:

• Service providers: Cloud hosting, email delivery, and SMS services that process data on our behalf under strict confidentiality agreements
• Legal requirements: When required by Kenyan law, court order, or government authority
• Business transfer: In the event of a merger or acquisition, with advance notice to affected users

9. Your Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Request your data in a structured, commonly used format
• Objection: Object to processing of your data for specific purposes
• Withdraw consent: Withdraw previously given consent at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by law.

10. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specifically:

• Active accounts: Data retained for the duration of the subscription
• Cancelled accounts: Data retained for 90 days after cancellation, then permanently deleted
• Financial records: Retained for 7 years as required by Kenyan tax law (Kenya Revenue Authority)
• Backup data: Purged within 30 days of primary data deletion

11. Cookies & Local Storage

VehikoHQ uses essential cookies for authentication and session management. We do not use tracking cookies or third-party advertising cookies. A service worker may cache certain assets locally for offline access and faster loading.

12. Children's Privacy

VehikoHQ is a business-to-business platform intended for use by workshop owners, managers, and their employees. We do not knowingly collect personal data from individuals under the age of 18.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify registered users via email and update the "Last updated" date at the top of this page. Continued use of VehikoHQ after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at:

15. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.