Introduction
InstaQuote Technologies Limited (“InstaQuote”, “we”, “our”, or “us”) is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy describes how we collect, use, store, share, and protect information about you when you use the InstaQuote platform and related services (the “Service”).
This Privacy Policy is issued in compliance with the Data Protection Act, 2019 (Kenya) (“DPA”), the Kenya Information and Communications Act (Cap. 411A), and any regulations issued thereunder. InstaQuote is registered as a data controller with the Office of the Data Protection Commissioner (ODPC).
By using the Service, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.
Information We Collect
2.1 Information You Provide Directly
When you register or use the Service, we collect information you voluntarily provide, including:
- Account information: full name, business name, email address, phone number, and password;
- Business information: business registration number, KRA PIN, VAT registration number, physical and postal address;
- Client information: names, contact details, and addresses of your customers that you enter into the platform;
- Product and service information: descriptions, pricing, and other details you add to the platform;
- Payment information: billing details, M-Pesa number, or card information (processed securely by our payment partners);
- Communications: messages or queries you send to our support team.
2.2 Information Collected Automatically
When you use the Service, we automatically collect certain technical information, including:
- Device information: device type, operating system, browser type and version;
- Log data: IP address, pages viewed, time and date of access, referring URL;
- Usage data: features used, quotations created, actions taken within the platform;
- Cookies and similar technologies: as further described in Section 9 of this Policy.
2.3 Information from Third Parties
We may receive information about you from third-party service providers, such as payment processors, analytics providers, and integration partners, where you have authorised such sharing.
Lawful Basis for Processing
Under the Data Protection Act 2019, we rely on the following lawful bases for processing your personal data:
- Contractual necessity: processing required to perform the Service contract with you;
- Legitimate interests: to improve the Service, detect fraud, and ensure security — where such interests are not overridden by your rights;
- Legal obligation: to comply with applicable Kenyan laws, regulatory requirements, and KRA obligations;
- Consent: where you have given your explicit consent, for example for marketing communications.
How We Use Your Information
We use the information we collect for the following purposes:
- To create and manage your account and provide access to the Service;
- To process payments and manage subscriptions;
- To enable quotation creation, management, and delivery functions;
- To provide customer support and respond to your enquiries;
- To send transactional emails, including account confirmations, invoices, and service updates;
- To send marketing communications, newsletters, or promotional offers — only where you have consented, and with the option to unsubscribe at any time;
- To monitor and analyse usage patterns to improve the Service;
- To detect, investigate, and prevent fraudulent or unauthorised activity;
- To comply with applicable Kenyan laws, regulations, and court orders;
- To enforce our Terms of Service.
Data Sharing and Disclosure
5.1 Service Providers
We may share your personal data with trusted third-party service providers who assist us in delivering the Service, including cloud hosting providers, payment processors, email service providers, and analytics tools. These providers are contractually bound to use your data only for the purpose of providing services to us and to maintain appropriate security measures.
5.2 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or substantially all of InstaQuote's assets, your personal data may be transferred as part of that transaction. You will be notified of any such transfer and your rights thereunder.
5.3 Legal Requirements
We may disclose your personal data where required to do so by law, court order, or at the direction of a competent regulatory authority, including the Office of the Data Protection Commissioner, the Kenya Revenue Authority, or law enforcement agencies. We will endeavour to notify you of such disclosure where legally permitted.
5.4 No Sale of Personal Data
InstaQuote does not sell, rent, or trade your personal data to third parties for their own marketing purposes.
Cross-Border Data Transfers
InstaQuote's infrastructure may involve data storage and processing outside Kenya, including in the European Economic Area or other jurisdictions. Any such transfers are made in accordance with the Data Protection Act 2019 and only to countries or organisations that provide an adequate level of data protection, or under appropriate contractual safeguards such as Standard Contractual Clauses approved by the ODPC.
Data Retention
We retain your personal data for as long as your account is active or as necessary to provide you with the Service. Upon termination of your account, we will retain your data for a period of five (5) years to comply with our legal and regulatory obligations under Kenyan law, including tax record retention requirements under the Tax Procedures Act 2015, after which it will be securely deleted or anonymised.
You may request earlier deletion of your data, subject to our legal retention obligations. See Section 8 for how to exercise this right.
Your Rights Under the Data Protection Act 2019
Under the Data Protection Act 2019, you have the following rights in relation to your personal data:
Request a copy of the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your data, subject to our legal obligations.
Object to processing based on legitimate interests or for direct marketing.
Receive your data in a structured, machine-readable format.
Limit the processing of your data in certain circumstances.
Withdraw consent at any time where processing is consent-based.
Lodge a complaint with the ODPC at odpc.go.ke.
To exercise any of these rights, please submit a written request to privacy@instaquote.co.ke. We will respond within 21 days as required by the Data Protection Act 2019.
Cookies and Tracking Technologies
We use cookies and similar technologies to enhance your experience on the Service. We use:
- Essential cookies: necessary for the operation of the Service, such as session authentication;
- Analytics cookies: to understand how users interact with the Service and improve functionality;
- Preference cookies: to remember your settings and preferences;
- Marketing cookies: only with your consent, to deliver relevant promotional content.
You may manage your cookie preferences through your browser settings or through the cookie consent tool available on the Service. Note that disabling essential cookies may affect the functionality of the Service.
Security of Your Information
InstaQuote implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:
- Encryption of data in transit using TLS (Transport Layer Security);
- Encryption of sensitive data at rest;
- Role-based access controls restricting employee access to personal data;
- Regular security assessments and vulnerability testing;
- Data breach response procedures.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, InstaQuote will notify the ODPC within 72 hours and notify affected users without undue delay, as required by the Data Protection Act 2019.
Children's Privacy
The Service is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data without verifiable parental consent, we will take prompt steps to delete such information. If you believe a child has submitted personal data to us, please contact us at privacy@instaquote.co.ke.
Third-Party Links and Integrations
The Service may contain links to or integrations with third-party websites, applications, or services. This Privacy Policy applies only to InstaQuote's own processing of your data. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you use in connection with InstaQuote.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. We will notify you of material changes by email to your registered address or by a notice within the Service at least 14 days before the changes take effect. The updated policy will also be posted at www.instaquote.co.ke/privacy with the revised effective date.
Your continued use of the Service after the effective date of any update constitutes your acceptance of the revised Privacy Policy.
Contact and Data Controller Information
InstaQuote Technologies Limited is the data controller responsible for your personal data. For privacy-related enquiries, requests, or complaints, please contact our Data Protection Officer.