Last updated: 12 September 2026
1. Who we are
Braintree Auto ("we", "us", "our") is a vehicle import, clearing, and sales business based in Nairobi, Kenya, operating this website at braintreeauto.co.ke. For the purposes of Kenya's Data Protection Act, 2019, we are the data controller for personal data collected through this website and through your dealings with us as a customer.
Contact for privacy matters: Braintree Auto Langata Road, Nairobi, Kenya Email: info@braintreeauto.co.ke Phone: +254 722 870261
2. What this policy covers
This policy explains what personal data we collect when you use this website or do business with us, why we collect it, how we use and protect it, who we share it with, and the rights you have over it — in line with the Data Protection Act, 2019 (the "Act") and the regulations made under it.
It covers both data collected through the website (enquiry forms, browsing) and data collected as part of an actual vehicle purchase, import, or financing arrangement, since that process typically begins on this site and continues by phone, WhatsApp, or in person.
3. Personal data we collect
We collect only what we need for the purpose in question. Depending on how you interact with us, this may include:
When you submit an enquiry on this website: - Your name - Your phone number - The vehicle or service you're interested in - The content of your message
When you contact us by phone, email, or WhatsApp: - Your name and contact details - The content of our conversation, including anything you choose to share (e.g. vehicle preferences, budget, timeline) - Note: once you contact us via WhatsApp, that conversation also runs through WhatsApp's own systems — see Section 8.
If you proceed with a vehicle purchase, import, or clearing service: - National ID or passport details - KRA PIN - Logbook, registration, or export documentation - Proof of address or residence status (for exemption-based imports such as returning-resident or diplomatic duty-free applications) - Payment and banking details relevant to the transaction - Where financing is involved, information required by the financing institution (see Section 6)
Automatically, when you browse this website: - Standard web server logs (IP address, browser type, pages visited, timestamps) — generated automatically by any website, used only for security and troubleshooting - A single technical flag stored in your browser's session storage, used only to avoid showing our loading animation more than once per visit — this contains no personal information and is not a tracking cookie - We do not currently use analytics, advertising, or tracking cookies on this website
4. How we collect your data
- Directly from you, when you fill in a form, message us, call us, or provide documents for a transaction
- Automatically, through standard website server logs, as described above
- From third parties where relevant to a transaction you've asked us to facilitate — for example, a financing institution confirming your loan status, or NTSA in the course of a registration transfer
5. Why we process your data, and our legal basis for doing so
| Purpose | Legal basis under the Act |
|---|---|
| Responding to an enquiry you've submitted | Your consent, given by submitting the form |
| Arranging a vehicle purchase, import, or clearing service | Necessary to perform a contract with you |
| Facilitating vehicle financing through a lender | Your consent, and necessary to perform the financing arrangement you've requested |
| Complying with NTSA registration, KRA customs, and other legal requirements | Necessary to comply with a legal obligation |
| Keeping our website secure and functioning correctly | Our legitimate interest in operating a secure, reliable website |
| Sending you information you've specifically asked for | Your consent |
We do not use your data for purposes beyond what it was collected for, and we do not sell personal data to third parties.
6. Who we share your data with
We share personal data only where necessary for the purpose you've engaged us for:
- Financing institutions (banks, SACCOs, or asset finance providers) — only if you've asked us to help arrange financing, and only the information that lender requires
- NTSA — as part of vehicle registration or ownership transfer
- KRA — as part of customs clearance and duty assessment for imported vehicles
- Clearing agents, shipping lines, and pre-export inspection agencies — as needed to import and clear a vehicle on your behalf
- Service providers who support our own operations (for example, our web hosting provider) — under obligations to keep your data secure and use it only as we instruct
We do not share your personal data with third parties for their own marketing purposes.
7. Cross-border data transfers
Some vehicles we source are imported from Japan, and some of our website infrastructure (see Section 8) is hosted or operated outside Kenya. Where personal data is transferred outside Kenya, we only do so in line with the Act's requirements — either because the receiving country provides an adequate level of data protection, or because appropriate contractual safeguards are in place. Vehicle sourcing itself does not generally involve sending your personal data to our overseas suppliers — that relationship is between us and the exporter, not you and the exporter.
8. Third-party services we use
This website uses a small number of third-party services in the ordinary course of operating a website:
- Google Fonts — used to display this site's typography correctly. Loading these fonts sends your browser's IP address to Google's servers. You can read Google's privacy policy for how they handle this.
- WhatsApp (Meta) — if you click through to message us on WhatsApp, that conversation is subject to WhatsApp's own privacy policy, not this one.
We do not use advertising networks, social media tracking pixels, or third-party analytics on this website at this time. If that changes, we'll update this policy and, where required, ask for your consent.
9. How long we keep your data
- Enquiry form submissions we don't proceed further with are retained only as long as reasonably needed to respond to you, and are periodically deleted thereafter.
- Transaction records (completed purchases, imports, financing arrangements) are retained for as long as required by Kenyan tax, company, and consumer protection law — generally at least seven years for financial records.
- Documents required for a specific regulatory process (e.g. NTSA transfer, KRA clearance) are retained for as long as that process and any related legal obligation requires.
10. How we protect your data
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including restricting access to personal data to staff who need it to do their job, and using secure connections for data submitted through this website. No online transmission or storage system is perfectly secure, but we take this responsibility seriously and review our practices as our business grows.
11. Your rights under the Data Protection Act
As a data subject under Kenyan law, you have the right to:
- Be informed of how your data is being used (this policy is part of that)
- Access the personal data we hold about you
- Correct inaccurate or outdated personal data
- Object to processing of your data in certain circumstances
- Request erasure of your personal data, subject to our legal obligations to retain certain records
- Data portability — request your data in a portable format, where technically feasible
- Not be subject to a decision based solely on automated processing that significantly affects you (we do not currently use any such automated decision-making)
To exercise any of these rights, contact us using the details in Section 1. We'll respond within a reasonable time and in line with the Act's requirements.
If you're not satisfied with how we've handled your data or your request, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):
Office of the Data Protection Commissioner Website: www.odpc.go.ke
12. Children's privacy
This website and our services are directed at adults engaging in vehicle purchases and imports. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we'll remove it.
13. Changes to this policy
We may update this policy from time to time — to reflect changes in our practices, changes in the law, or new features on this website. We'll post the updated version here with a new "last updated" date. We encourage you to review this page periodically.
14. Contact us
If you have any questions about this policy or how we handle your personal data:
Braintree Auto Langata Road, Nairobi, Kenya Email: info@braintreeauto.co.ke Phone: +254 722 870261 WhatsApp: +254 731 870261
This policy is written to reflect Braintree Auto's actual data practices under Kenya's Data Protection Act, 2019 and its subsidiary regulations. It's a working document, not a substitute for independent legal advice — particularly around whether Braintree Auto is required to register as a data controller with the ODPC, which depends on annual turnover, employee count, and sector-specific rules that only Braintree Auto's own advisors can confirm with certainty.