Data Protection Policy

Version 2026-10-09

Draft — pending legal review

This text describes how Dabi works today. Details in brackets are still being confirmed, and the wording may change after legal review.

The principles Dabi AutoHub follows when it handles personal data, and how each one is put into practice.

Principles

Lawful, fair and open: we say what we collect and why in the Privacy Policy, and use data only for those purposes.
Only what’s needed: we don’t collect exact home addresses, bank details or mobile-money settlement details. Date of birth is kept only because rental eligibility can depend on age, and only an age band is shown.
Accurate: you can correct your details in Settings, and a changed phone or email is unverified until you confirm it again.
Kept no longer than needed: identity documents are deleted 90 days after the verification decision; one-time codes and sign-in records are deleted on a schedule.
Secure: see below.

Privacy by design

Every piece of personal data has a visibility class — public, logged-in members, the other party to a deal, the owner only, or the verification team only — and the server enforces it before anything leaves.
ID and licence numbers are stored as one-way codes, which still let us spot two accounts using the same number.
Phone numbers and email addresses appear only partly hidden; a logged-in member reveals the full value with a tap, each reveal is logged, and there’s an hourly limit. Email stays hidden unless the member chooses to show it.
Search results and maps show only a town or area, never an exact address.

Access by Dabi staff

Staff use separate work accounts with two-factor sign-in. Each role carries only the permissions it needs. Opening a restricted document, revealing a member’s contact details and exporting data are each logged with the staff member’s name, and the log can’t be edited.

Service providers and transfers

Providers that process data for us (hosting, database, email, Google sign-in and M-Pesa payments) do so under contract and only on our instructions. Where data leaves Kenya, we rely on the safeguards the Act requires: [SAFEGUARDS TO BE CONFIRMED].

Your requests

You can download your data and close your account yourself in Settings › Your data. Other requests (for example, to restrict a use of your data) go to our Data Protection Officer at [DPO EMAIL], and we answer within the time the Data Protection Regulations set.

Breaches

If a personal data breach is likely to put your rights at risk, we notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and tell affected members without undue delay, with what happened and what we’re doing about it.

Accountability

Dabi is registered with the ODPC as [ODPC REGISTRATION NUMBER]. We review this policy and our data protection impact assessments when the way we handle data changes.