Privacy Policy

01About this policy

This Privacy Policy explains how SafiriOS (“SafiriOS”, “we”, “us”) handles personal data in connection with the SafiriOS platform, applications, portals, APIs and websites (the “Platform”).

SafiriOS is a white-label logistics platform. Operators run their transport business on it and present it to their own customers, drivers and transport partners under the operator’s brand. This policy covers our own processing; where we handle data on an operator’s behalf, the operator’s own privacy notice also applies.

02Our role: controller and processor

For personal data that an operator submits about its end users, customers, drivers and partners, the operator is the data controller and SafiriOS acts as a data processor, processing that data on the operator’s documented instructions to provide the Platform.

For personal data we collect directly, such as details of the operator’s own account administrators, website visitors and people who contact us, SafiriOS is the data controller.

03Information we collect

Account and contact information

Names, email addresses, phone numbers, roles and organisation details of the people who register for, administer or are invited to the Platform.

Operational data

Data generated by running a logistics operation on the Platform: orders and consignments, pickup and delivery addresses, fleet and driver records, proof-of-delivery photos and signatures, invoices, payments and settlement records.

Location data

Where the operator enables live tracking, the driver applications collect device location while a driver is on duty, so dispatch and customers can see the progress of a delivery. Drivers are shown that tracking is active and can control location permission in their device settings.

Device and usage data

Technical information such as IP address, device and browser type, app version, and logs of how the Platform is used, collected to operate, secure and improve the service.

04How we use personal data

• to provide, maintain and secure the Platform and its features;
• to authenticate users and manage access;
• to enable dispatch, live tracking, proof of delivery, invoicing and settlements;
• to provide support and respond to enquiries;
• to monitor performance, prevent abuse and troubleshoot problems;
• to send service and administrative communications;
• to comply with legal obligations and enforce our terms.

05Legal bases

Where we act as a controller, we process personal data on one or more of the following bases under the Kenya Data Protection Act, 2019 and other applicable law: performance of a contract; our legitimate interests in operating and securing the Platform; compliance with a legal obligation; and, where required, consent.

Where we act as a processor, we process personal data on the instructions of the operator, who is responsible for establishing the legal basis for that processing.

06Sharing and disclosure

We do not sell personal data. We share it only as needed to run the Platform:

• with the operator whose account the data belongs to, and the users that operator authorises;
• with service providers who process data on our behalf under contract, such as cloud hosting, mapping, messaging and error-monitoring providers (our sub-processors);
• where required by law, regulation or valid legal process, or to protect the rights, safety and security of users, the public or the Platform;
• in connection with a business transfer such as a merger or acquisition, subject to appropriate safeguards.

07International transfers and hosting

The Platform runs on globally distributed cloud infrastructure, and data may be processed on servers located outside your country to deliver a fast and reliable service. Where personal data is transferred across borders, we take steps to ensure it remains protected in line with applicable data-protection law.

08Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, PIN and password protection, and audit logging of sensitive financial actions. No system is perfectly secure, and users share responsibility by keeping their credentials confidential.

09Retention

We keep personal data for as long as needed to provide the Platform and for legitimate business and legal purposes, such as retaining invoices and financial records for the period required by law. When an operator’s account ends, we make data available for export for a reasonable period and then delete or anonymise it, subject to any legal retention obligation.

10Your rights

Subject to applicable law, individuals have rights over their personal data, including to be informed, to access, to correct inaccurate data, to request deletion, to object to or restrict certain processing, and to data portability.

Because much of the data on the Platform belongs to an operator as controller, requests about that data are usually best directed to the relevant operator, and we will support the operator in responding. To exercise rights in respect of data for which SafiriOS is the controller, contact us using the details below.

11Cookies

Our websites and portals use a small number of cookies and similar technologies that are necessary to sign in, keep sessions secure and remember basic preferences such as light or dark theme. We do not use them to build advertising profiles.

12Children

The Platform is a business tool and is not directed to children. We do not knowingly collect personal data from children.

13Changes to this policy

We may update this policy from time to time. Where changes are material, we will give reasonable notice, for example by email or an in-product notice. The “last updated” date above shows when this version took effect.

14Contact us

For questions about this policy or how your personal data is handled, contact us at hello@safirios.com. If your query concerns data managed by an operator that uses SafiriOS, please also contact that operator directly.