Partner Privacy Policy
Draft for legal review.
This policy explains how WaterPAP Solutions ("WaterPAP", "we", "us"), uses personal data about the transport companies that deliver for us ("partners"), the people who run them, and their drivers and driver assistants ("crew"), when they use the partner portal, the WaterPAP Driver app or sign up on our website. We are the data controller for this data under the Kenya Data Protection Act, 2019 (the "Act").
Partners: you upload your crew's data to us, so you must tell your crew about this policy and have a lawful basis to share their data with us.
1. Data we collect
| About | Data |
|---|---|
| Partners and their contact people | Name and company name, phone, email, service areas, KRA PIN, payment and invoicing details, eTIMS invoices, sign-in details for the partner portal |
| Trucks | Registration, type and capacity, and records of the deliveries each truck made |
| Drivers and driver assistants | Name, mobile number, national ID number, driving licence number and expiry (drivers), and scans of their national ID, driving licence and certificate of good conduct |
| Drivers using the app | PIN (hashed), sign-in records, the phone's push notification token, orders offered, accepted or rejected, delivery status updates and their times, delivery statistics |
| People who sign up on the website | Name or company name, service area, phone and email |
A certificate of good conduct shows criminal record information, which the Act treats as sensitive personal data. We process it only to vet crew for customer safety, with strict access controls, and keep it no longer than needed. The Driver app does not track drivers' location.
2. How and why we use it
- Assessing sign-ups and onboarding partners (steps before a contract, and the contract).
- Vetting and approving crew before they serve customers, and checking documents stay valid (legitimate interest in customer safety, and the contract; for sensitive data, with consent given through the partner or as permitted by the Act).
- Offering orders to drivers by push alert, and recording who accepted, rejected and delivered each order (contract).
- Paying partners, processing invoices and keeping tax records (contract and legal obligation).
- Measuring service quality, such as delivery times per driver and truck, and handling customer complaints (legitimate interest).
- Security, fraud prevention and protecting our customers (legitimate interest).
3. Who we share it with
- Customers see the truck and driver delivering to them (such as the driver's name) where needed for the delivery.
- WaterPAP staff who manage partners, operations and finance; crew documents are seen only by staff who approve crew.
- Service providers: hosting (Railway, Netlify), push notifications (Google Firebase), messaging (Meta's WhatsApp Business Platform, Advanta SMS), and email delivery.
- Authorities where the law requires, such as the Kenya Revenue Authority or the police.
We never sell personal data. Some providers process data outside Kenya; we transfer data only as the Act allows, with appropriate safeguards.
4. How long we keep it
- Partner and crew records, and delivery records: while the partnership lasts and for 7 years after, for accounting and to handle claims.
- Crew document scans: while the person works on WaterPAP orders, and for 12 months after they're removed, then deleted.
- Sign-ups that don't become partners: up to 12 months.
5. Your rights
You have the rights the Act gives you: to be informed, to access, correct and delete your data (unless we must keep it), to object, to withdraw consent, to data portability, and to complain to the Office of the Data Protection Commissioner (www.odpc.go.ke). Crew members can contact us directly, not only through their partner.
6. Security
We use encrypted connections, hashed PINs and passwords, signed sign-in tokens, and access limited to the people who need it. Partners can see only their own crew and documents. We'll tell you and the Data Protection Commissioner about a breach as the Act requires.
7. Customer data you receive
Partners and crew see customers' names, phone numbers, addresses and access notes to carry out deliveries. You must use them only for those deliveries, keep them confidential, never contact customers for your own business, and follow our Partner Terms.
8. Changes and contact
We may update this policy and will tell partners of important changes.
Data protection contact: WaterPAP Solutions, email info@waterpap.com, phone +254 798 844 488.