Privacy Policy

01 Introduction

Greenroad Kenya Limited ("Greenroad Kenya", "we", "us", or "our") is a company incorporated under the laws of Kenya, providing international freight forwarding, logistics, customs clearance, and supply chain management services. We operate the website at www.greenroadkenya.com and our business management platform at erp.greenroadkenya.com (collectively, the "Platform").

This Privacy Policy describes how we collect, use, store, share, and protect personal information about you when you:

• Visit or use our website or Platform;
• Submit a quote request, enquiry, or contact form;
• Enter into a contract or service agreement with us;
• Correspond with us by email, telephone, or any other means; or
• Otherwise interact with us in the course of our business.

By accessing or using our website or Platform, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of our services.

02 Information We Collect

We collect information in the following categories depending on how you interact with us:

2.1 Personal Information

When you contact us, request a quote, or engage our services, we may collect:

• Full name and job title;
• Company name and business registration details;
• Email address and telephone number;
• Postal and physical address (for billing, delivery, or correspondence);
• National identification or passport details (where required for customs or regulatory purposes); and
• Payment and invoicing information (processed through our secure billing systems).

2.2 Account Information

If you are granted access to our internal business platform (erp.greenroadkenya.com), we collect:

• Username and encrypted password;
• User role and department;
• Account activity logs and session metadata; and
• Preferences and settings associated with your account.

2.3 Usage Data

When you interact with our website or Platform, we automatically collect:

• Pages visited, features used, and time spent on the Platform;
• Actions taken within the Platform (e.g., forms submitted, documents uploaded);
• Search queries and filters applied; and
• Error logs and diagnostic data.

2.4 Device and Browser Information

We collect technical information including:

• IP address and approximate geographic location (country/city level);
• Browser type and version;
• Operating system and device type;
• Referring URL; and
• Cookie identifiers and similar tracking technologies (see Section 4).

03 How We Use Your Information

We use the information we collect for the following purposes, relying on the legal bases indicated:

3.1 Service Delivery

• Processing and managing freight, logistics, and customs clearance requests;
• Communicating shipment status, documentation, and operational updates;
• Preparing and issuing invoices, receipts, and financial records; and
• Coordinating with carriers, customs authorities, and partner agents.

3.2 Business Operations and Administration

• Managing user accounts and access permissions on our Platform;
• Maintaining business records and audit trails;
• Processing payments and managing accounts receivable/payable; and
• Conducting internal reporting and performance analysis.

3.3 Communications and Marketing

• Responding to enquiries, quote requests, and customer service issues;
• Sending service-related notifications and updates; and
• Sending promotional communications about our services, where you have given consent or where we have a legitimate business interest and you have not opted out.

3.4 Legal and Regulatory Compliance

• Complying with customs, tax, trade, and anti-money laundering regulations;
• Responding to lawful requests from regulatory authorities, courts, or law enforcement; and
• Establishing, exercising, or defending legal claims.

3.5 Security and Fraud Prevention

• Monitoring for unauthorised access or suspicious activity;
• Investigating and preventing fraud, misuse, or security incidents; and
• Enforcing our Terms of Service and other agreements.

04 Cookies and Tracking Technologies

We use cookies and similar technologies on our website to improve functionality and understand how visitors use our site.

4.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for core website and Platform functionality, including authentication sessions and security tokens. These cannot be disabled.
• Functional Cookies: Remember your preferences (e.g., language, settings) to provide a more personalised experience.
• Analytics Cookies: Help us understand how visitors interact with our site (e.g., pages visited, time on site). We may use services such as Google Analytics for this purpose.
• Session Cookies: Temporary cookies that expire when you close your browser, used to maintain your logged-in state during a session.

4.2 Managing Cookies

You may control cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, or be notified when a new cookie is set. Please note that disabling certain cookies may affect the functionality of our website or Platform.

05 Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information in the following circumstances:

5.1 Service Providers

We engage trusted third-party companies and individuals to assist us in delivering our services, including IT hosting providers, software vendors, email service providers, and payment processors. These parties access personal data only to perform specific tasks on our behalf and are bound by confidentiality obligations.

5.2 Business Partners and Agents

In the ordinary course of providing freight and logistics services, we share necessary shipment and party information with:

• Shipping lines, airlines, and road transport carriers;
• Port authorities, customs brokers, and clearing agents;
• Warehouse operators and last-mile delivery partners; and
• Overseas agents and correspondent freight forwarders.

5.3 Legal and Regulatory Obligations

We may disclose personal information where required by applicable law, regulation, court order, or at the lawful request of a government authority, including the Kenya Revenue Authority (KRA) and Kenya Ports Authority (KPA).

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, personal data held by us may be transferred to the acquiring entity, subject to equivalent privacy protections.

5.5 With Your Consent

We may share your information with other third parties where you have given your explicit consent to do so.

06 Third-Party Services and Integrations

Our website and Platform may include links to, or integrations with, third-party websites, services, or applications that are not operated by us, including:

• Shipping line and airline tracking portals;
• Kenya Revenue Authority iTax portal;
• Kenya Ports Authority and Kenya Trade Network Agency (KenTrade) systems; and
• Payment gateways and banking platforms.

We have no control over the privacy practices of these third-party services. We encourage you to review the privacy policies of any third-party sites you visit. Our Privacy Policy does not apply to information collected by third parties.

Our website may also use Google Fonts, GSAP animation libraries, and similar content delivery network (CDN) resources. These may transmit limited technical information (such as your IP address) to their respective servers in the course of loading assets.

07 Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal obligations.

• Business and financial records: Retained for a minimum of seven (7) years as required under Kenya's Tax Procedures Act and other applicable financial regulations.
• Customs and trade documentation: Retained in accordance with applicable customs regulations and the Kenya Revenue Authority requirements.
• Account data: Retained for the duration of the active account, plus a reasonable period thereafter for security and dispute resolution purposes.
• Marketing communications: Retained until you withdraw consent or opt out.
• Website analytics data: Typically retained in aggregated or anonymised form after 26 months.

When personal data is no longer required, we will securely delete or anonymise it in accordance with our data retention procedures.

08 Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encrypted transmission of data using TLS/HTTPS protocols;
• Password hashing and salting using industry-standard algorithms;
• Role-based access controls limiting data access to authorised personnel;
• Regular system updates and security patching;
• Activity logging and audit trails; and
• Secure hosting infrastructure managed by reputable service providers.

09 International Data Transfers

Greenroad Kenya Limited operates across multiple jurisdictions, including Kenya, China (Shanghai headquarters), and various countries in Africa, Asia, the Middle East, and the Americas. As a result, your personal data may be transferred to, processed in, and stored in countries other than Kenya.

When we transfer personal data internationally, we take steps to ensure that appropriate safeguards are in place, including:

• Contractual clauses with overseas agents and partners binding them to confidentiality and data protection standards;
• Transferring only the minimum information necessary for service delivery; and
• Ensuring that recipient jurisdictions offer an adequate level of data protection, or implementing alternative safeguards.

For users in the European Economic Area (EEA) or the United Kingdom, where applicable, transfers of personal data outside those regions are made in compliance with the requirements of the General Data Protection Regulation (GDPR) or the UK GDPR respectively.

10 Your Rights and Choices

Depending on your location and applicable law, you may have the following rights in relation to your personal data:

10.1 Rights Under Kenyan Law

Kenya's Data Protection Act, 2019 grants you rights including:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to Object: Object to processing of your personal data for direct marketing purposes.
• Right to Data Portability: Request transfer of your data in a structured, commonly used format.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

10.2 Additional Rights (GDPR / CCPA)

If you are a resident of the European Economic Area or California, you may have additional rights under the GDPR or California Consumer Privacy Act (CCPA) respectively, including the right to opt out of the sale of personal information (we do not sell personal data), and the right to non-discrimination for exercising your privacy rights.

10.3 How to Exercise Your Rights

To exercise any of the above rights, please submit a written request to us using the contact details in Section 13. We will respond within 30 days. We may need to verify your identity before fulfilling your request.

10.4 Marketing Opt-Out

You may unsubscribe from marketing emails at any time by clicking the "Unsubscribe" link in any marketing email, or by contacting us directly. Opting out of marketing communications will not affect the receipt of service-related messages essential to your account or active transactions.

11 Children's Privacy

Our website and Platform are intended for use by businesses and professionals and are not directed at children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a child under 18, we will take steps to delete such information promptly.

If you believe we may have collected information from a minor, please contact us immediately using the details in Section 13.

12 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document;
• Post the revised policy on this page; and
• Where appropriate, notify registered users or business contacts by email.

We encourage you to review this Privacy Policy periodically. Your continued use of our website or services following the posting of changes constitutes your acceptance of the updated policy.

13 Contact Information

If you have questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us: