1. Who we are
Arex Spectrum Partners Ltd. ("Arex Spectrum", "we") of Athi River, Machakos County, Kenya is the data controller for personal data processed through arex-spectrum.co.ke and the Arex Spectrum platform. We take our duties under the Data Protection Act, 2019 of Kenya and its regulations seriously.
This policy explains what we collect, why, who we share it with, how long we keep it and your rights. Questions go to our data protection contact at privacy@arex-spectrum.co.ke.
2. What we collect
| Who | Data |
|---|---|
| Website visitors | IP address, browser type, pages requested, date and time (security logs); details you type into the contact or quick request forms. |
| Client users | Name, work email, phone, company, role; pickup and delivery addresses, site contacts, cargo details, PO and cost-centre references; ratings, feedback and disputes; invoices and payments. |
| Partners (vehicle owners) | Name, ID or company registration number, KRA PIN, phone, email, address; M-Pesa or bank payout details; vehicle details and photos; NTSA, insurance and logbook documents; the signed agreement (name, time, IP address); listing fee payments; job offers, responses and earnings. |
| Drivers | Name, phone, national ID, driving licence number, class and expiry, and copies of these documents; job status updates; GPS location while a job is active; photos and signatures captured at pickup and delivery; incident reports. |
| Receivers at delivery | Name and signature, and photos of the delivered goods. |
| Staff | Name, work contact details, role, sign-in history and actions in the audit log. |
We do not ask for sensitive personal data (such as health, religion or ethnicity). Document photos may incidentally show such information; we use them only to verify compliance.
3. How we collect it
- Directly from you, when you register, book, upload documents, sign agreements or contact us.
- From your employer or company admin, when they create a portal login for you.
- From Partners, when they register their drivers.
- Automatically from your device, through security logs and, for drivers, location during active jobs.
- From payment providers (for example M-Pesa confirmations) and, where needed, from public registers to verify partners.
4. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and manage accounts; take, confirm, dispatch and deliver jobs; share live status | Performance of a contract |
| Vet partners and drivers (NTSA, insurance, licence, KRA) and monitor document expiry | Contract; legal obligation; legitimate interest in road and cargo safety |
| Driver location during active jobs: ETAs for clients, safety, dispute resolution | Contract; legitimate interest. Location is not tracked outside active jobs. |
| Invoicing, payments, payouts, tax records and KRA eTIMS | Contract; legal obligation (tax laws) |
| Service messages by SMS, email and in-app (confirmations, offers, reminders) | Contract; legitimate interest |
| Security: fraud prevention, rate limiting, audit logs, abuse detection | Legitimate interest; legal obligation |
| Improving service: on-time and rating statistics, partner scoring | Legitimate interest |
| Marketing messages (only if you opt in) | Consent, which you can withdraw at any time |
5. Automated suggestions
Our dispatch system suggests vehicles automatically. It always ranks the owned fleet first, then partner vehicles by a score built from distance, on-time record, client ratings, acceptance rate and Goods-in-Transit cover. A human dispatcher reviews and confirms assignments. Document expiry can suspend a vehicle automatically until a valid document is approved; you can contact us to review any such decision.
6. Who we share it with
We never sell personal data. We share only what each party needs:
- On a job: the client sees the assigned driver's name, phone and vehicle plate, plus status and location while the job is active. The driver and partner see pickup and delivery addresses, site contacts and cargo details. Partners do not see the client's price.
- Service providers under contract and confidentiality: web hosting, Safaricom (M-Pesa payments and payouts), SMS and email delivery providers, Cloudflare (security and bot protection, if enabled) and Google Fonts (website typefaces). Each sees only what is needed for its service.
- Authorities where the law requires: Kenya Revenue Authority, NTSA, police or courts, and the Office of the Data Protection Commissioner.
- Insurers and assessors, when handling a loss or damage claim.
- A buyer or investor in our business, under confidentiality, if the business is sold or restructured.
7. Transfers outside Kenya
Some providers (for example email, font delivery or security services) may process data outside Kenya. Where they do, we rely on the safeguards permitted by the Data Protection Act, 2019, such as appropriate contractual protections and providers with adequate data protection, and we transfer only what is needed.
8. How long we keep it
| Data | Kept for |
|---|---|
| Job records, invoices, payments and payouts | 7 years after the year of the transaction (tax and accounting laws) |
| Proof of delivery photos and signatures | 2 years after delivery, or longer if a claim is open |
| Partner and driver compliance documents | While the account is active, then 2 years. Rejected applications: 90 days |
| Driver GPS points | 12 months, then deleted or anonymised |
| Security and audit logs | 12 months (longer if needed for an investigation) |
| Contact form messages | 2 years |
| Closed accounts' profile data | Deleted or anonymised within 12 months of closure, unless the law requires longer |
9. How we protect it
We use encryption in transit (HTTPS) and hashed passwords. Access is role-based, so each organisation sees only its own records. Uploaded documents are stored privately and opened only through signed links. We also re-encode uploaded images to strip hidden content and location metadata, rate-limit sign-ins and forms, and keep audit logs. See our Security page. If a breach is likely to put you at risk, we will notify the Data Protection Commissioner within 72 hours and inform affected people without undue delay, as the law requires.
10. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be informed of how your data is used (this policy);
- access the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have data deleted where we no longer need it or have no lawful basis (we may need to keep some records for tax and legal reasons);
- object to processing based on legitimate interest, and to marketing at any time;
- data portability: receive your data in a common machine-readable format;
- withdraw consent, where we rely on it;
- not be subject to a decision based solely on automated processing that significantly affects you.
Use the data protection request form or email privacy@arex-spectrum.co.ke. We will verify your identity and respond within the time the law allows, normally within 7 to 14 days. There is no charge for reasonable requests. You can correct most profile details yourself under Account in the app.
11. Complaints
Please contact us first so we can put things right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), Kenya, at www.odpc.go.ke.
12. Children
The Services are for businesses and adults. We do not knowingly collect data from anyone under 18. If you believe a child's data has been submitted, contact us and we will delete it.
13. Changes to this policy
We will post updates here with a new date. For significant changes we will also notify account holders in the platform or by email.