Data Protection

This notice summarises how personal data is protected when using Ottocare Garage ERP, with reference to the Kenya Data Protection Act, 2019 and similar frameworks.

1. Roles

• Tenant organisations act as data controllers for customer, vehicle, and operational records they enter.
• Ottocare (platform) acts as a processor for tenant operational data and as controller for platform account, subscription, and security data.

2. Lawful basis

Processing is typically necessary to perform a contract (providing the Service), for legitimate interests in securing and improving the platform, and where required to comply with law.

3. Categories of data

Identity and contact details of users; organisation identifiers; customer contact and identification fields you choose to store (for example phone, ID number, KRA PIN); vehicle and transaction records; technical and audit logs.

4. Security measures

• Authentication, optional two-factor verification, and role-based permissions.
• Tenant isolation by company scope on data access paths.
• CSRF protection, session controls, and administrative audit trails where enabled.
• Encrypted transport (HTTPS) when the deployment is correctly configured with TLS.

5. Data subject requests

Individuals may request access, correction, or deletion of their personal data. For data held inside a tenant workspace, contact that organisation first. Platform-level account requests can be directed to platform support.

6. Related documents

Privacy Policy · Cookie Policy · Data Processing · Terms of Service