Privacy notice
Draft of 22 October 2026 · under Kenya's Data Protection Act, 2019
This notice tells you which personal data Mobility1 keeps, why, who receives it, where it is stored, how long we keep it, and what your rights are. It covers mobility1-africa.com and the e-mails the site sends.
Who is responsible
Mobility1 is run by Alf Holdings East Africa Limited, a Kenyan company, which is the data controller for this website. Write to [email protected] about anything in this notice.
What we keep
When you visit the site
- Our server records each visit: your internet address, the page, the time and your browser. These records are deleted after 14 days. The site's technical log is kept only up to a fixed size, then overwritten.
- The public pages set no cookies. Signing in sets a session cookie, pages with a form set a security cookie against forged forms, and a short-lived cookie carries messages such as "Your offer is sent". We use no advertising or analytics cookies, and the site loads no tracking scripts.
When you open a business account
- Your company's name, business registration number and KRA PIN.
- The contact person's name, mobile number and work e-mail.
- Your password, stored only as a one-way hash: nobody at Mobility1 can read it.
- Proof that you accepted the terms: which version, when, from which internet address and with which browser.
- The result of our check of your KRA PIN and registration, and who did it.
When you make an offer, reserve or pay
- Your offers and our answers, your reservations, and the steps of each sale, such as the NTSA transfer reference.
- Your payments and refunds: the payment reference, amount and method; the M-Pesa receipt code, bank reference or card transaction number; the phone number you asked us to send an M-Pesa prompt to; and the phone or account the money came from, partly hidden.
- We never see your card number: you pay by card on the card provider's own page.
When you sell as a dealer
- Your application: the company details above, your town, the director or contact person, your registration certificate and KRA PIN certificate, and our notes on how we checked them.
- Your payout account: the account holder, bank and branch, the account or paybill number, and our notes on how we checked it.
- Your cars: make, model, year, mileage, chassis number and yard; your asking price and your private lowest price; price changes you ask for; the inspection reports and photos.
- The tax records of each sale: our eTIMS invoice number and your withholding tax certificate number.
When you e-mail us
- Your e-mail address and what you write.
We do not ask for national ID or passport numbers. Car photos are taken by our inspector; the site removes location and camera details from them, and the photo of the chassis plate is seen only by our team.
Why we use it
| What for | Why we may |
|---|---|
| Open and run your account, and check that you are a registered business | To provide the service you ask for, and to prevent fraud |
| Answer offers, reserve cars and complete sales, and tell the other side of a sale what it needs | To perform our agreement with you |
| Take, confirm and refund payments | To perform our agreement with you |
| Send you e-mails about your account, offers, reservations, payments and sales | To perform our agreement with you |
| Keep tax records: eTIMS invoices, VAT and withholding tax | Kenyan tax law requires it |
| Check dealers and payout accounts with two different people, and keep records of offers, payments and changes that cannot be altered | Our legitimate interest in preventing fraud and settling disputes |
| Keep proof of which terms you accepted | Our legitimate interest in proving the agreement |
| Keep server records and limit sign-in tries | Our legitimate interest in keeping the site safe |
We send no newsletters or adverts, and we do not sell personal data.
What you must give us
To open an account you must give your company's name, business registration number and KRA PIN, a contact person, a mobile number and an e-mail address. Without them we cannot check your business, so you cannot make offers or reserve. Dealers must also give the two documents and a business payout account; a dealer's KRA PIN also goes on the tax invoices we issue to it. You can look at every car without an account.
Where it comes from
- From you, when you fill in a form or e-mail us.
- From the registers we check: KRA's iTax for KRA PINs, the business registry on eCitizen, and NTSA records on eCitizen for a car's logbook.
- From Safaricom, your bank or our card provider, when they confirm a payment.
- From our inspector, for car reports and photos.
Who receives it
- The other side of a sale, only once a car is reserved. The buyer then sees the dealer's company name, phone, e-mail and yard, and the full chassis number; the dealer sees the buyer's company name, contact person, phone and e-mail. Before that, neither sees the other. The screen our team uses to answer offers shows a code name for the buyer, different on every car.
- Mobility1's team: the staff who check businesses, cars, payout accounts and payments, our inspectors, and the owner, each for their own task.
- Our service providers:
- Hetzner Online, which runs our server and its backups in Nuremberg, Germany;
- Cloudflare, which carries all traffic to the site, protects it, and forwards e-mails sent to [email protected];
- Brevo, which sends the site's e-mails;
- Safaricom, for M-Pesa payments;
- our bank and our card provider, for payments and refunds.
- KRA, through eTIMS invoices and tax returns, as the law requires, and other authorities only where Kenyan law obliges us.
Data sent outside Kenya
Our server and its backups are in Germany, with Hetzner. Brevo, which sends our e-mails, is a French company. Cloudflare, a US company, handles traffic to the site in its data centres around the world. So your data is processed outside Kenya, by these providers and only for the purposes in this notice.
How long we keep it
- Server records of visits: 14 days.
- Backups of the database and files: 14 days.
- Your account details: as long as your account is open.
- Records of offers, reservations, payments, refunds and sales: the site cannot change or delete them, because they are our evidence and our books.
- A link to choose a new password works for 2 hours.
How we protect it
- The site works only over an encrypted connection (HTTPS).
- Passwords are stored as one-way hashes and need at least 10 characters. The sign-in, sign-up and password forms limit how often one visitor can try.
- Company documents are stored without a public link and open only for signed-in Mobility1 staff. Car photos show only while the car is on the site.
- Public car pages show only the town and the last four characters of the chassis number. The yard and the full number appear only to the reserving buyer, the seller and our team.
- Pages with your personal details are never stored in shared caches.
- Two different people check every dealer and every payout account, and a second person records every refund.
- Records of offers, payments and changes cannot be edited or deleted.
- The server accepts no password logins, and its backups can be read only by its administrator.
Your rights
Under the Data Protection Act, 2019, you may:
- be told how your data is used (section 26): this notice;
- get a copy of your data (section 26);
- have false or misleading data corrected or deleted (sections 26 and 40);
- ask us to delete data we no longer need (section 40);
- object to our use of your data (sections 26 and 36);
- ask us to restrict its use, for example while we check a correction (section 34);
- receive your data in a common, machine-readable format, or have it sent to another company (section 38);
- withdraw your consent wherever we rely on it (section 32);
- not be subject to a decision based only on automated processing (section 35);
- refuse the use of your data for commercial purposes such as direct marketing (section 37).
To use a right, e-mail [email protected] from the address on your account, or tell us how we can check that it is you. It is free, and we answer within the time the law sets. Where the law makes us keep a record, such as a tax invoice, we keep it for the time required and tell you so.
Decisions made by rules
A person on Mobility1's team answers every offer; we never accept an offer automatically. Some steps follow fixed rules that are the same for everyone: the first payment to arrive reserves a car; an offer or counter-offer that is not answered within 24 hours closes; and a reservation ends if Mobility1's part of the price is not paid within its 72 hours. We do not profile you.
Children
Accounts are for registered businesses. We do not knowingly keep data about children.
Complaints
Please tell us first: [email protected]. You may also complain to the Office of the Data Protection Commissioner (ODPC) under section 56 of the Act: www.odpc.go.ke, [email protected].
Changes to this notice
When this notice changes, we publish the new version here, with its date.