Ovaji Car Rental Services Applicable Jurisdictions: Kenya and United Kingdom Effective Date: [Insert Date] Last Updated: [Insert Date]

INTRODUCTION

Ovaji operates a digital vehicle rental platform offering online booking, payment, customer verification, fleet access, and related mobility services in Kenya and, where applicable, the United Kingdom. We are committed to protecting personal data in accordance with: The Constitution of Kenya (Article 31 – Right to Privacy) The Kenya Data Protection Act, 2019 Applicable regulations issued by the Office of the Data Protection Commissioner (ODPC) The UK General Data Protection Regulation (UK GDPR) The UK Data Protection Act 2018 This Policy explains how we collect, use, store, retain, transfer, and delete personal data.

DEFINITIONS

Personal Data means any information identifying an individual directly or indirectly. Processing means collection, recording, storage, use, disclosure, deletion, or destruction of personal data. Customer means any user renting, booking, or registering for vehicle rental services. Platform means our website, mobile application, payment systems, digital fleet systems, and customer support tools.

3. DATA WE COLLECT

We may collect the following categories of personal data: 3.1 Identity Information Full names National ID / Passport / Driving Licence details Date of birth Customer photo (if required for verification) 3.2 Contact Information Phone number Email address Physical address 3.3 Booking & Rental Information Rental dates Vehicle selected Pickup and drop-off locations Rental history 3.4 Payment Information Payment confirmation references Mobile money records Card payment metadata (processed through secure third parties) 3.5 Technical Data IP address Device identifiers Browser type Login timestamps 3.6 Vehicle Use Data (where enabled) GPS location Mileage Fuel level Telematics alerts Vehicle access logs

PURPOSE OF PROCESSING

We process personal data only where lawful and necessary for: Account creation and identity verification Vehicle booking and rental management Payment processing Fraud prevention and security Vehicle recovery and asset protection Customer service support Legal compliance Regulatory reporting Dispute resolution Platform improvement and analytics

LEGAL BASIS FOR PROCESSING

We rely on one or more lawful grounds including: Performance of a contract Compliance with legal obligations Legitimate business interests Consent (where required) Protection of property, safety, or public interest

DATA RETENTION & AUTOMATIC DELETION

6.1 Standard Retention Rule All personal data collected through our digital car rental services shall be retained for 30 days only from the completion of the rental transaction or closure of customer interaction. After 30 days, personal data shall be securely: deleted, or anonymised, or irreversibly destroyed. 6.2 Exceptions to 30-Day Deletion Data may be retained beyond 30 days only where reasonably necessary for: ongoing fraud investigations theft recovery processes insurance claims court proceedings tax or accounting obligations formal requests by police, regulators, courts, or other competent lawful authorities in Kenya or the UK Enforcement of contractual rights Once such a purpose ends, data shall be deleted promptly.

VEHICLE THEFT & LIABILITY DISCLAIMER

7.1 Customer Responsibility During Rental Period Once a vehicle has been handed over or digitally released to the customer, the customer assumes full responsibility for its lawful custody, care, and security during the rental period. 7.2 Exemption from Liability The Company shall not be liable for any loss, theft, disappearance, unlawful taking, hijacking, or unauthorised use of a rented vehicle occurring during the customer’s rental period, except where such loss is directly caused by the Company’s proven gross negligence or wilful misconduct. 7.3 Cooperation with Authorities Where theft occurs, the Company may process and disclose relevant customer data, booking records, identity information, and vehicle tracking data to insurers, investigators, police, courts, and competent authorities. 7.4 Recovery Charges The Company reserves the right to recover losses, repossession costs, damages, legal fees, downtime losses, and related expenses from the responsible renter subject to applicable law.

DATA SHARING

We may share data only where necessary with: Payment processors Insurers Fleet management providers Security and telematics providers Lawyers and auditors Police and regulatory authorities Courts and dispute resolution bodies Technology vendors under confidentiality obligations We do not sell personal data.

INTERNATIONAL DATA TRANSFERS

Where data is transferred outside Kenya or the UK, we shall ensure adequate safeguards such as: contractual protections secure encryption restricted access controls lawful transfer mechanisms adequacy decisions where applicable

SECURITY MEASURES

We apply appropriate technical and organisational safeguards including: encrypted storage secure payment gateways staff confidentiality obligations access restrictions audit logs password protection role-based permissions incident response procedures

CUSTOMER RIGHTS

Subject to applicable law, individuals may request: access to their personal data correction of inaccurate data deletion of data restriction of processing objection to certain processing data portability where applicable withdrawal of consent Requests may be sent to: [Insert Email Address]

COOKIES & TRACKING

Our website or app may use cookies and analytics tools to improve performance, detect fraud, and enhance customer experience. Users may adjust browser settings where available.

CHILDREN’S DATA

Our services are intended only for persons legally eligible to rent vehicles. We do not knowingly process data from minors for rental contracts.

BREACH RESPONSE

Where a personal data breach occurs, we shall take lawful and proportionate action including containment, investigation, mitigation, and notifications where required under Kenyan or UK law.

POLICY CHANGES

We may update this Policy periodically. Updated versions shall be posted on our platform with revised effective dates.

CONTACT DETAILS

Data Protection Officer / Privacy Contact Ovaji Car Rental Services [Physical Address] [Email Address] [Phone Number]

GOVERNING LAW

This Policy shall be interpreted in accordance with: Laws of Kenya where processing occurs in Kenya UK data protection laws where UK residents or UK operations are involved Any applicable conflict-of-law principles

IMPORTANT LEGAL NOTE

This Policy should be read together with: Terms and Conditions Rental Agreement Vehicle Use Policy Fraud Prevention Policy Incident & Theft Reporting Policy This Policy does not create any contractual rights or obligations. It is a statement of our data protection practices and legal compliance commitments.