Loading AutoGo…
0%
Please book at least 1 hour in advance— this gives our CarHosts time to prepare your vehicle.
Loading AutoGo…
Protecting Your Information When AutoGo Works With Third Parties
AutoGo only discloses personal information when there is a legitimate and lawful reason to do so, limits disclosure to what is necessary, requires appropriate safeguards, and respects the rights of the individual.
AutoGo respects your privacy and is committed to protecting the personal information you entrust to us. This policy explains when, why, how and under what safeguards AutoGo may disclose, share, transfer or otherwise make your personal information available to third parties — and, just as importantly, when it will not.
AutoGo operates a mobility marketplace in Kenya that connects customers with verified CarHosts, drivers and partners. AutoGo is not the owner of the vehicles listed on the platform. To run that marketplace and deliver the services you ask for, AutoGo works with carefully selected third parties.
Depending on the service you use, those third parties may include:
Sharing information with these parties does not mean AutoGo may sell your personal information. AutoGo does not treat your personal information as a product, and will not disclose it without a lawful basis or the authorisation required by law.
This policy sets out:
This policy works alongside AutoGo’s Privacy Policy, Terms & Conditions, Cookie Policy, KYC and verification requirements, payment terms and wider data protection practices. Where a specific policy gives more detail about a particular service, that detail applies in addition to this document.
This policy is written to align with the data protection requirements that apply in Kenya, including:
Alignment is an objective, not a claim of certified compliance. AutoGo does not state that it is fully compliant with any law, regulation, standard or certification unless that has been independently verified and confirmed in writing. Registration details, licences and certifications will only be published here once they exist and have been confirmed.
Depending on how you use AutoGo, the information covered by this policy may include the following categories. Not every user has every category on file.
Identity information
Contact information
Account information
Booking information
Location information
Payment information
AutoGo does not ask you to enter your M-Pesa PIN, card PIN or account password into the AutoGo platform, and does not require full card numbers or CVV codes to be stored on the platform in order to book. Payment credentials are entered with, and handled by, the authorised payment provider under its own terms and privacy policy. AutoGo receives the transaction information it needs to confirm, reconcile, refund and pay out on a booking.
Vehicle information (for CarHosts)
Communication information
Technical information
AutoGo will not disclose, sell, rent or otherwise make your personal information available to unrelated third parties except where there is a lawful, legitimate and documented reason to do so.
Where a disclosure is justified, AutoGo applies the following rules:
AutoGo operates a marketplace. That means some information has to move between the people involved in a booking so the booking can actually happen.
For example, when a customer books a vehicle from a CarHost, AutoGo may give the CarHost the information reasonably necessary to prepare the vehicle and hand it over. In the same way, AutoGo may give the customer limited information about the CarHost, the driver and the vehicle so the customer can find the vehicle, travel safely and complete the trip.
Only information reasonably necessary for the transaction is shared. Unnecessary personal information is not exposed to the other side of a booking.
A CarHost may be given information such as:
A CarHost is not automatically given:
Information in the second list is only disclosed where there is a specific lawful and necessary reason, such as a legal obligation or a documented fraud or safety investigation.
A customer may be given information such as:
Private information about a CarHost that is not required to complete the transaction — such as personal identification documents, home address details not used as a pickup point, or financial records — is not shared with customers.
Where a trip involves a driver, a customer may be given:
Other driver information — including identification documents, address, licence images and personal records — is not exposed to customers.
AutoGo engages service providers to deliver parts of the platform. Each is given only the information its service requires.
Payment providers
Payment providers such as M-Pesa, Paystack and other authorised providers receive the transaction information needed to take payment, confirm it, issue refunds, make payouts and reconcile accounts.
Mapping and location providers
Mapping providers such as Google Maps, Google Places and Google Routes receive location information when it is needed to show a map, search a place, calculate a route, provide navigation or find nearby facilities and charging points.
Cloud and hosting providers
Personal information may be stored and processed on infrastructure operated by hosting and cloud providers engaged by AutoGo.
Communication providers
SMS, email, push notification and messaging providers receive the contact details and message content needed to deliver a message you are entitled to receive, such as a booking confirmation or a trip alert.
Identity and KYC providers
Verification information may be shared where necessary to verify identity, a driving licence, vehicle ownership or other eligibility requirements.
Fraud and security providers
Limited information may be processed to detect fraud, abuse, account compromise and other security threats.
Analytics providers
Usage information may be processed to understand and improve the platform. Aggregated or pseudonymised information is used wherever the purpose does not require identifying an individual.
AutoGo does not publish a list of named vendors, agreements or certifications in this policy unless the arrangement exists and has been confirmed. Current vendors are recorded in AutoGo’s internal third-party processing register, which is maintained by authorised administrators.
AutoGo will never ask you to provide sensitive payment credentials through insecure channels such as SMS, email, social media or a phone call.
AutoGo will never ask you for:
Payment providers process payment information under their own terms and privacy policies. AutoGo receives only the transaction information required to confirm, reconcile, refund and manage a payment.
If anyone contacts you claiming to be from AutoGo and asks for a PIN, password or one-time code, do not share it. Report it to hello@autogo.africa.
AutoGo may disclose personal information where legally required or where a lawful request is made by:
When such a request is received:
AutoGo may disclose information where necessary for:
Disclosure remains limited to what the proceeding or claim reasonably requires.
Limited disclosure is permitted where reasonably necessary to:
Data minimisation applies to every disclosure of this kind: AutoGo shares only what the investigation or response actually requires.
AutoGo may disclose information where reasonably necessary to protect life, physical safety, security or an emergency response — for example in the case of:
Only the information reasonably necessary for the emergency is disclosed, and the disclosure is recorded afterwards.
AutoGo may operate parts of its service through authorised franchise partners. A franchise partner may receive the limited personal information necessary to operate AutoGo services in its territory — for example, bookings in that area and the contact details needed to deliver them.
Franchise partners are required to:
Where legally appropriate, these obligations are set out in written data-processing and confidentiality terms.
CarHosts, drivers and other marketplace participants receive only the limited information needed to perform their obligations for a specific booking.
They must not:
Breach of these rules may result in suspension or removal from the AutoGo marketplace, in addition to any legal consequences.
Third parties that receive personal information from AutoGo are required to accept confidentiality obligations. Where appropriate, the written arrangement should cover:
A data controller decides why and how personal data is processed. A data processor processes it on the controller’s behalf, following the controller’s documented instructions.
For most platform activity, AutoGo acts as the controller and its service providers act as processors. Some recipients — such as payment providers, regulators and, in certain respects, CarHosts operating their own business — act as controllers in their own right for the information they hold.
Processors must not use AutoGo customer information for their own unrelated purposes unless there is a lawful basis for that use and it has been appropriately disclosed.
Service providers are expected to disclose and control the subprocessors they rely on, where appropriate to the service.
AutoGo assesses material subprocessors where necessary, and expects equivalent contractual and security protections to flow down to any subprocessor that handles AutoGo user information.
Some of the providers AutoGo relies on — for example cloud hosting, mapping, email and analytics services — may process information outside Kenya. Where that happens, the transfer must be carried out in accordance with the cross-border transfer requirements of the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
Depending on the circumstances, AutoGo relies on safeguards such as:
AutoGo does not claim that any particular country is automatically approved for transfers, and does not list server locations or transfer agreements in this policy unless they have been confirmed. Confirmed processing locations are recorded in AutoGo’s internal third-party processing register.
Consent is one lawful basis for processing personal data, but it is not the basis for every activity. Requiring consent for something AutoGo must do anyway — such as complying with a court order — would be misleading.
Depending on the activity, AutoGo may rely on:
Where AutoGo relies on your consent, you may withdraw it at any time. Withdrawal does not affect processing that already took place while the consent was valid, and does not stop processing that rests on a different lawful basis.
AutoGo does not sell or hand over customer databases to third parties for unrelated direct marketing. Any marketing sharing requires an appropriate lawful basis and, where the law requires it, your consent.
AutoGo does not sell users’ personal information as a commercial product.
AutoGo does share information with authorised service providers and other recipients where necessary to operate the platform, fulfil transactions you have requested, provide services, comply with the law, or protect users. Those disclosures are described in this policy and are not sales.
This statement does not override disclosures that AutoGo is legally required to make.
AutoGo may use aggregated, statistical or anonymised information for business analysis, platform improvement, research, performance analysis, market insight and service planning.
Information is only treated as anonymised where it cannot reasonably be used to identify an individual. If information can reasonably be re-identified, AutoGo continues to treat it as personal data and protects it accordingly.
Technical safeguards used or targeted by AutoGo include:
Organisational safeguards include:
Physical safeguards apply to any AutoGo premises and equipment used to access personal information.
AutoGo does not claim to hold ISO 27001, SOC 2 or any other security certification. No security certification is claimed in this policy unless it has been independently awarded and verified. No system can be guaranteed to be completely secure.
AutoGo applies the "need to know" principle. Employees, contractors and third parties should be able to access only the information required for their authorised responsibilities.
AutoGo retains personal information only for as long as it is needed for:
When information is no longer required, it is securely deleted, anonymised or otherwise disposed of in line with applicable law and AutoGo’s retention schedule. Specific retention periods are set out in that schedule; this policy does not state a period that has not been formally defined.
If AutoGo becomes aware of unauthorised access to, or disclosure, loss, alteration or destruction of, personal data, it activates its incident response process. That process covers:
Notifications are made in accordance with the requirements of the Data Protection Act, 2019 and related regulations. This policy does not promise a fixed notification timeframe beyond what the law requires and AutoGo’s procedures can support.
Subject to applicable law, you have the right to:
Some rights are subject to lawful limitations and exceptions. For example, AutoGo may need to keep certain booking, payment and safety records even after an account is closed, in order to meet legal, tax, accounting or dispute-resolution obligations.
You can contact AutoGo to ask:
Send your request to hello@autogo.africa, or to the dedicated data protection contact listed at the top of this policy once it has been published. AutoGo may need to verify your identity before acting on a request, so that information is not released to the wrong person.
If you believe a third party — a CarHost, driver, franchise partner or service provider — has misused your information, you can raise it with AutoGo. The process is:
You may also complain directly to the Office of the Data Protection Commissioner or another competent authority. Using AutoGo’s complaint process does not remove that right.
AutoGo’s services are intended for adults who meet the eligibility requirements set out in the AutoGo Terms & Conditions, including any age and driving-licence requirements that apply to renting or driving a vehicle.
AutoGo does not intentionally collect or disclose the personal information of children except where it is legally permitted and appropriate safeguards are in place — for example, a passenger name provided by a parent or guardian for a group or family trip.
If you believe a child’s information has been provided to AutoGo inappropriately, contact hello@autogo.africa so it can be reviewed and, where appropriate, removed.
Some categories of information receive enhanced protection, including:
Where AutoGo holds information in these categories, stronger access controls and additional safeguards apply. AutoGo does not collect or disclose sensitive data simply because it is technically available — there must be a specific, lawful and necessary reason.
Location information may be shared with authorised parties where it is necessary to:
Device location is used only where you have granted the permission, and can be turned off in your device or browser settings — some features will not work without it.
Location information is not disclosed to unrelated parties without a lawful basis, and historical location and route history is not exposed beyond what a specific, justified purpose requires.
AutoGo employees, contractors and authorised personnel with access to personal information are required to keep it confidential and to use it only for their authorised responsibilities.
Before a vendor is given access to personal data, AutoGo should evaluate it. The assessment may consider:
The outcome is recorded in AutoGo’s internal third-party processing register, together with the review date.
Third parties that receive AutoGo user information are prohibited from:
Where contractually and legally appropriate, AutoGo reserves the right to monitor and audit third-party compliance with this policy. That may include:
AutoGo maintains internal registers of disclosures and of third-party processing arrangements. These registers are internal records available only to authorised administrators, and are not publicly visible.
AutoGo may update this policy when:
The effective date and last updated date are shown at the top of this page. Where the law requires it, AutoGo will give notice of material changes.
This policy is intended to operate under the laws of Kenya.
If you are located outside Kenya, mandatory data protection rights that apply to you under your local law are not displaced by this policy.
When you create an AutoGo account you are shown the following notice: "By creating an AutoGo account, you acknowledge that AutoGo may process and disclose personal information as described in its Privacy Policy and Third-Party Data Disclosure & Non-Disclosure Policy."
That acknowledgement confirms you have been informed. It is not used as consent for processing that relies on a different lawful basis. Where explicit consent is legally required — for example for certain optional processing — AutoGo asks for it separately, through an affirmative action, and never through a pre-ticked box.
Until a dedicated data protection contact is published, privacy requests and complaints should be sent to hello@autogo.africa and will be routed internally.
This policy is intended to explain AutoGo’s approach to the protection and disclosure of personal information. It should be reviewed and approved by qualified legal counsel and AutoGo’s data protection/privacy function before publication. It is not legal advice and is not a substitute for advice from qualified Kenyan privacy counsel.
Related policies
Email hello@autogo.africa or call +254 115 495 542. You can ask what we hold, who it was shared with and why, or ask us to correct or delete it.