Privacy Policy

1. INTRODUCTION

Chava Logistics ("we," "us," "our") is committed to protecting your privacy and complying with the Kenya Data Protection Act, 2019 . This Privacy Policy explains how we collect, use, disclose, process, and manage the personal data of our website visitors, customers, and business partners .

As a logistics company operating in Kenya with services extending to Ethiopia and Djibouti, we handle personal information necessary to provide transport, customs clearance, and freight forwarding services across East Africa .

Data Controller:
Chava Logistics
[Insert your physical business address]
Email: info@chavalogistics.co.ke
Phone: [Insert your phone number]

2. WHAT PERSONAL INFORMATION WE COLLECT

We collect only the personal information necessary to provide our logistics services .

2.1 Information You Provide Directly

CategoryInformation Collected

Customer InformationName, email address, phone number, physical address, company name, business registration number, KRA PIN (for Kenyan customers)

Shipment InformationSender and receiver names, addresses, phone numbers, shipment descriptions, cargo type, weight, dimensions

Payment InformationM-Pesa transaction details, bank account information (processed securely through third-party payment processors)

CommunicationsEmails, messages, and inquiries sent to info@chavalogistics.co.ke or via WhatsApp/Telegram

2.2 Information Collected Automatically

When you visit our website, we automatically collect:

Device Information: IP address, browser type, operating system
Usage Data: Pages visited, time spent on site, referring website
Location Information: General geographic location based on IP address

2.3 Sensitive Personal Data

We do not knowingly collect sensitive personal data (such as health information, biometric data, or religious beliefs) unless required for specific services with your explicit consent .

3. HOW WE COLLECT YOUR INFORMATION

We collect personal information directly from you in the following ways :

When you fill out contact or quote request forms on our website
When you communicate with us via email, phone, WhatsApp, or Telegram
When you engage our logistics services
When you become a supplier or business partner
Through our website's automatic data collection tools (cookies)

4. WHY WE COLLECT YOUR INFORMATION

We process your personal data only for legitimate purposes related to our logistics services :

PurposeLegal Basis (Data Protection Act, 2019)

To arrange and manage shipments between Kenya, Ethiopia, and DjiboutiContract performance

To communicate shipment status, delays, and delivery updatesContract performance

To respond to inquiries and provide customer supportLegitimate interest

To process payments via M-Pesa or bank transferContract performance

To comply with legal obligations (KRA, customs authorities)Legal obligation

To improve our website and servicesLegitimate interest

To send marketing communications about our servicesConsent (you may opt out)

We do not process personal data for purposes incompatible with those described above .

5. HOW WE PROTECT YOUR INFORMATION

We take reasonable steps to ensure the security of your personal information :

Security MeasureDescription

SSL EncryptionOur website uses HTTPS encryption to protect data in transit

Access ControlsOnly authorized personnel can access customer data

Role-Based AccessStaff only access data necessary for their specific roles (limited access principle)

Secure StorageData is stored behind firewalls on secure servers

ConfidentialityAll employees are required to treat personal information as confidential

Password ProtectionStrong passwords and secure authentication practices

Important: While we implement these security measures, the internet is not a secure environment. We cannot guarantee the security of information before it reaches us .

6. HOW WE SHARE YOUR INFORMATION

We share your personal information only when necessary to provide our services or comply with the law :

6.1 Categories of Third Parties

Third PartyReason for Sharing

Transport PartnersTo facilitate inland deliveries in Ethiopia and Djibouti (under data processing agreements)

Customs AuthoritiesKenya Revenue Authority (KRA), Kenya Ports Authority, Ethiopian and Djibouti customs for clearance

Payment ProcessorsM-Pesa, banks for payment processing

Website PlatformWix.com (data processor) for website hosting

Email Service ProviderZoho Mail for managing communications

Legal AuthoritiesWhen required by law, court order, or government regulation

6.2 Passenger Manifests

As a transport service provider, we prepare passenger manifests for verification and financial management purposes. We have implemented safeguards to ensure these manifests are accessible only to authorized personnel and are not disclosed to unauthorized third parties .

6.3 Third-Party Data Processors

Before sharing data with third parties, we ensure they:

Sign a data processing agreement (DPA)
Demonstrate adequate security controls
Agree to breach notification obligations

We do not sell, rent, or trade your personal information to third parties .

7. INTERNATIONAL DATA TRANSFERS

Since we operate logistics services across East Africa, your personal information may be transferred to and processed in:

CountryPurposeSafeguards

EthiopiaInland transport and customs clearanceData processing agreements

DjiboutiPort operations and transport servicesData processing agreements

We ensure these transfers comply with the Kenya Data Protection Act, 2019 by implementing appropriate safeguards, including contractual protections that require the same level of data protection .

Cross-Border Data Protection Framework: The East African Community (EAC) is developing a harmonized framework for data protection across the region to ensure secure cross-border data flows. We are committed to complying with regional data protection standards as they develop .

8. DATA RETENTION

We retain your personal information only as long as necessary for the purposes for which it was collected, or as required by law :

Data TypeRetention PeriodJustification

Shipment records5 yearsTax and customs compliance

Customer inquiries2 years after last contactCustomer service purposes

Employee recordsUp to 3 years after terminationPotential employment claims (Section 90, Employment Act)

Website usage data26 monthsAnalytics and site improvement

Marketing dataUntil you opt outConsent-based processing

After these retention periods, information is securely deleted or anonymized for analytical purposes .

9. YOUR RIGHTS AS A DATA SUBJECT

Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal information :

RightDescription

Right to be informedTo know what information we collect and how we use it (this Privacy Policy)

Right of accessTo request a copy of the personal information we hold about you

Right to rectificationTo correct inaccurate or incomplete information

Right to erasure (right to be forgotten)To request deletion of your personal information, subject to legal obligations

Right to restrict processingTo limit how we use your information

Right to data portabilityTo receive your information in a structured, commonly used format

Right to objectTo object to processing for direct marketing purposes

Right to withdraw consentTo withdraw previously given consent at any time

Right to complainTo lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: info@chavalogistics.co.ke

Please include:

Your full name and contact information
Specific details about your request
Any information needed to verify your identity

We will respond to your request within 30 days as required by Kenyan law .

10. CONSENT

10.1 What Constitutes Valid Consent

For consent to be valid under the Data Protection Act, 2019, it must be:

Freely given
Specific
Unambiguous
Express or by clear affirmative action

10.2 How We Obtain Consent

We obtain your consent when you:

Fill out contact or quote request forms on our website
Engage our logistics services
Subscribe to our marketing communications
Explicitly agree to specific processing activities

10.3 Withdrawing Consent

You may withdraw your consent at any time by:

Clicking "unsubscribe" in our marketing emails
Emailing info@chavalogistics.co.ke with "WITHDRAW CONSENT" in the subject line

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal .

11. COOKIES AND TRACKING TECHNOLOGIES

Our website uses cookies to improve your browsing experience. Cookies are small text files stored on your device that help us understand how visitors use our site .

11.1 Types of Cookies We Use

Cookie TypePurpose

Essential CookiesRequired for basic website functionality

Analytics CookiesHelp us understand how visitors interact with our website

Preference CookiesRemember your settings and choices

11.2 Managing Cookies

You can control cookies through your browser settings:

Block all or specific cookies
Delete existing cookies
Set preferences for future cookies

Note: Disabling essential cookies may affect website functionality.

12. CHILDREN'S PRIVACY

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you become aware that a minor has provided us with personal information, please contact us so we can take steps to delete such information .

13. THIRD-PARTY LINKS

Our website may contain links to:

Partner logistics companies
Government websites (KRA, Kenya Ports Authority)
Social media platforms (WhatsApp, Telegram, Facebook)

We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review their privacy policies before providing any information.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

Changes in our business practices or services
Changes in legal or regulatory requirements
Feedback from customers and stakeholders

When we make changes, we will:

Post the revised policy on this page
Update the "Last Updated" date at the top
Notify you of material changes via email or website notice

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information .

15. DATA PROTECTION COMPLIANCE

15.1 Registration with ODPC

Under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, transport service firms are required to register with the Office of the Data Protection Commissioner (ODPC) . Chava Logistics complies with this requirement.

15.2 Data Protection Officer (DPO)

If you have any questions regarding our data protection practices, please contact our designated officer:

Email: info@chavalogistics.co.ke
Subject: Data Protection Inquiry

Note: Under the Data Protection Act, businesses handling sensitive personal data must appoint a Data Protection Officer. Chava Logistics ensures appropriate oversight of data protection matters .

16. COMPLAINTS

If you believe we have violated your data protection rights, you have the right to lodge a complaint with:

Office of the Data Protection Commissioner (ODPC)
Website: www.odpc.go.ke
Email: complaints@odpc.go.ke
Physical Address: [Insert ODPC address as per current website]

We encourage you to contact us first so we can address your concerns directly.

17. CONTACT INFORMATION

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: info@chavalogistics.co.ke
Phone: [Insert your phone number]
Address: [Insert your physical business address]

18. JURISDICTION AND GOVERNING LAW

This Privacy Policy is governed by the Kenya Data Protection Act, 2019 and any other applicable Kenyan laws. By using our website and services, you agree to submit to the jurisdiction of Kenyan courts for any disputes arising from this Privacy Policy.

IMPORTANT LEGAL DISCLAIMER

The explanations and information provided in this Privacy Policy are based on the Kenya Data Protection Act, 2019 and current legal guidance. This document is provided for informational purposes and does not constitute legal advice. Different jurisdictions may have different legal requirements. You are responsible for ensuring you follow all relevant legislation applicable to your activities and location.

We recommend that you seek qualified legal advice to assist you in understanding and complying with your specific obligations under Kenyan and East African data protection laws .