01Who we are
This notice is issued by Ajira Telematics Limited ("Ajira", "we", "us"), a company incorporated in Kenya with its registered office at Harrison House, 3rd Ngong Avenue, Upper Hill, P.O. Box 46870-00100, Nairobi, Kenya.
Ajira is registered with the Office of the Data Protection Commissioner (ODPC) as a data controller and a data processor.
Our data protection officer can be reached at [email protected] or by post at the address above, marked "Data Protection Officer".
02When we are controller and when we are processor
Our role depends on whose data it is and why we hold it:
| Situation | Ajira’s role | What it means |
|---|---|---|
| Website visitors, enquiries, pilot bookings, marketing contacts, supplier contacts | Controller | We decide why and how the data is used and answer to you directly. |
| Customer account holders and platform users (names, log-ins, contact details, billing) | Controller | We use the data to run the contract and the account. |
| Telematics data from a customer’s vehicles: location, speed, driving events, and video from road-facing and cabin cameras | Processor | The fleet operator (our customer) is the controller. We process the data only on its documented instructions under a data processing agreement. |
| Speed-governor certificate records | Controller | We keep these to issue, verify and renew certificates and to meet regulatory requirements. |
If you are a driver or passenger in a vehicle fitted with Ajira equipment, the fleet operator you work for or travel with is responsible for telling you about the monitoring and for answering your rights requests. We will help them do so, and if you contact us directly we will pass your request to them without delay.
The Ajira platform is powered by IntelliFleet 360 (opens in a new tab), which acts as our sub-processor for hosting and running the platform under a written agreement that imposes obligations equivalent to ours.
03Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Contact and enquiry data | Name, company, job title, work e-mail, phone or WhatsApp number, fleet size, industry, depot town, message content | You, through our forms, e-mail, phone or WhatsApp |
| Account and user data | User names, log-in credentials (stored hashed), roles, audit logs of platform activity | Your organisation and you |
| Commercial and payment data | Quotes, orders, invoices, M-Pesa transaction confirmations (name, phone number, amount, reference) | You and your organisation; Safaricom M-Pesa confirmations |
| Certificate data | Vehicle registration number, certificate number, device serial, fitting and expiry dates, owner name and contact | Vehicle owner or operator; our technicians |
| Vehicle telematics data (processed for the fleet operator) | GPS location, speed, heading, ignition and engine events, harsh-driving events, AI safety alerts, driver scores, trip history | Devices fitted to the customer’s vehicles |
| Camera data (processed for the fleet operator) | Event video clips and images from road-facing and cabin-facing cameras, which may show drivers, passengers, other road users and number plates | National AI Dash Camera |
| Technical data | IP address, browser and device type, pages visited, consent choices | Your browser; see our Cookie Policy |
Sensitive personal data. Cabin-facing cameras record images of drivers. Where a customer enables AI driver identification (facial recognition), the camera processes biometric data, which is sensitive personal data under the Act. We only enable this feature where the fleet operator has confirmed in writing its lawful basis, has completed a data protection impact assessment, and has informed drivers.
Children. Our website is not directed at children. On school transport, cabin cameras may capture images of children. School and transport operators must complete a data protection impact assessment, apply the ODPC Guidance Note on processing children’s data, and restrict access to footage to authorised staff only.
04How we use personal data and our lawful basis
| Purpose | Lawful basis under the Act |
|---|---|
| Responding to enquiries, arranging pilots and preparing quotes | Steps taken at your request before entering into a contract; our legitimate interest in answering business enquiries |
| Supplying, installing and supporting hardware and the platform; billing and collections | Performance of a contract |
| Issuing and verifying speed-governor certificates; keeping tax and accounting records | Compliance with a legal obligation |
| Processing telematics and camera data for our customers | On the customer’s instructions; the customer determines its own lawful basis (usually contract of employment, legal obligation or legitimate interest) |
| Keeping our systems secure, detecting fraud and misuse | Legitimate interest |
| Sending product news and event invitations to business contacts | Consent, or legitimate interest for existing customers, always with an easy opt-out |
| Optional website analytics and preference cookies | Consent, collected through our cookie banner |
We do not sell personal data. We do not use telematics or camera data for our own marketing or for any purpose other than providing the service to the fleet operator, except in anonymised and aggregated form that cannot identify any person or vehicle, for improving the safety models and service quality.
Automated decisions. The platform produces driver scores and AI alerts. These are decision-support tools. Customers must not rely solely on an automated score to take disciplinary or employment decisions about a driver without human review, and our customer contract requires this.
06Transfers outside Kenya
Some of our service providers may store or access data outside Kenya. Where personal data is transferred outside Kenya, we do so only as permitted by the Act and the Data Protection (General) Regulations, 2021: to countries with appropriate data protection safeguards, under contractual safeguards, or with your consent where required. Sensitive personal data is transferred only with the consent of the data subject and on appropriate safeguards, as the Act requires.
07How long we keep personal data
We keep personal data only for as long as needed for the purpose we collected it, or as long as the law requires:
| Data | Retention period |
|---|---|
| Website enquiries that do not become customers | 24 months after our last contact, then deleted |
| Customer contract, invoice and payment records | At least 5 years after the end of the financial year to which they relate, to meet Kenyan tax law, and up to 7 years for contract claims |
| Speed-governor certificate records | For the life of the certificate plus the period required by NTSA |
| Event video (processed for the customer) | According to the customer’s plan: 7 days (Basic), 30 days (Advanced), 180 days with a 2-year archive (Premium), or as agreed in writing. Clips saved by the customer for an incident are kept until the customer deletes them or the contract ends. |
| Location and driving data (processed for the customer) | For the contract term, then returned or deleted within 90 days of termination on the customer’s instruction |
| Cookie consent records | 6 months, after which we ask you again |
| Marketing preferences and opt-outs | Opt-out records are kept indefinitely so we can honour them |
08How we protect personal data
We apply technical and organisational measures appropriate to the risk, including: encryption of data in transit and at rest; role-based access with the least privilege needed; multi-factor authentication for staff access to production systems; audit logs of access to video and location data; event-only video upload so routine driving is not streamed to the cloud; staff confidentiality undertakings and data protection training; and secure wiping of devices returned for repair.
If a personal data breach creates a real risk of harm, we will notify the Data Commissioner within 72 hours of becoming aware of it, and will inform the customers and individuals affected as required by the Act. Where we act as processor, we notify the customer without delay so that it can meet its own obligations.
09Your rights
Under the Data Protection Act, 2019 you have the right to:
- be informed of how your personal data is used;
- access the personal data we hold about you;
- object to the processing of all or part of your personal data;
- have false or misleading data corrected;
- have false, misleading or unlawfully held data deleted;
- receive your data in a structured, commonly used, machine-readable format (data portability);
- not be subject to a decision based solely on automated processing that significantly affects you;
- withdraw consent at any time, where we rely on consent, without affecting processing already carried out; and
- opt out of direct marketing.
To exercise a right, write to [email protected]. We will verify your identity and respond within the time limits set by the Act and its Regulations. There is no charge for a reasonable request. For telematics or camera data, we will refer you to the fleet operator, which is the controller, and support it in responding.
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
10Direct marketing
We send business news and invitations only to people who have agreed to receive them or who are existing customer contacts. Every message includes a simple way to unsubscribe. On WhatsApp, reply STOP. We never buy contact lists.
11Changes to this notice
We will update this notice when our practices or the law change. The version number and date at the top show when it was last revised. Material changes will be highlighted on this website and, for customers, notified by e-mail. This is version 1.0, last updated 21 September 2026.