Partner Privacy Notice

This Partner Privacy Notice explains how Francton Limited, operating as Garisea (“Garisea”, “we”, “us”), handles personal data on the partner console at partner.garisea.com. It covers you, the people on your team, and the customer data you receive.

It adds to the Garisea Privacy Policy. Where the two overlap on partner-account data, this Notice applies. If your organisation has signed a Data Processing Agreement with us, that agreement sets out where we act as your processor.

We wrote this Notice to meet the Kenya Data Protection Act, 2019 (“the Act”). It also follows the EU General Data Protection Regulation (GDPR) where that law applies.

Francton Limited, operating as Garisea, is the data controller for:

• Your account data — you and your staff seats: names, contact details, verification documents, sign-in activity, billing details and history, and settings.
• Customer data on the platform — enquiries, messages and searches that customers make on Garisea.

When a lead delivers a customer's details to your organisation, your organisation becomes an independent data controller for them under the Act, with its own duties (Section 12 and Partner Terms §22).

Our data protection contact is [email protected].

3.1 Data you give us

• Account — name, email, phone and password. We store the password only as a salted bcrypt hash.
• Organisation details — business name, address, contact phone and email, social links, operating hours, and your category (finance, insurance, service centre, auto parts, detailing, tyres, energy or other).
• Verification documents — registration certificate (required); KRA PIN and identity document (optional).
• Staff seats and branches — for each person you invite: name, email, phone, role, branch, and whether they take leads. We store only a scrambled (hashed) form of each invitation link, which works for 7 days.
• Profile content — descriptions, offers, rates, coverage areas and anything else you publish about your services, including new-owner offers you write.
• Recovery listings (finance partners) — the vehicles you list for sale: their details, photos and walkthrough videos, condition notes, price basis, closing date, viewing arrangements, and the location you pick or type. Buyers never see the number plate; the VIN (chassis number) is published with the listing.
• Charging points (energy partners) — the address, location, connectors and hours of each point you list.
• Lead handling — your replies, internal notes and follow-ups.
• Review replies — your public replies to reviews.
• Billing details — billing contact name, email, phone and address, VAT and tax IDs, and purchase-order numbers. We send pro-formas to your billing email, or your sign-in email if there is none.
• Payments — top-ups, plans, add-ons and packs you buy, and your auto top-up settings (the pack, the trigger level and the monthly limit). Card and M-Pesa details are entered on our payment provider's checkout; we never see them and receive only the result. For a bank transfer, we record the payer name, reference, amount and date.
• Garisea Assistant — what you type to the Garisea Assistant in the console and its replies, stored as the chats of the person who typed them (Section 4.3), and listing text you paste so the console can fill in a recovery listing for you.
• Support tickets — anything you send us, including reports of fake or spam enquiries.

3.2 Data we collect automatically

• Device and browser — IP address, browser, operating system, device model, language and time zone.
• Sign-in activity — including the last time each staff seat signed in, and which seat each lead was assigned to.
• Analytics — the pages you visit and actions you take, through Google Analytics, which receives your partner account ID after you sign in. It is on by default and you can switch it off (Cookie Policy, Section 5).
• Activity on your account — when you see an upgrade prompt, open a pack page or start a checkout. We keep this for 400 days.
• Audit log — account status changes, profile status changes, data exports, deletions and changes to billing or contact settings.
• Error data — when a page fails, the error, the page, your browser and your account ID; for errors on our servers this can include your email address. The console also keeps a short replay of the screen before the error, with all text masked and images blocked.
• Cookies and similar storage — see our Cookie Policy.

3.3 Data from others

• Sign in with Google or Apple — your name, email and an account ID. Never your password. We keep an Apple token, encrypted with AES-256-GCM, so we can revoke your Apple sign-in if you delete your account.
• Payment provider — the result of each payment.

• Run the console — sign you in, publish your profile, deliver leads, assign them to your staff (automatically, if you turn that on), show your performance and send notifications.
• Verify your organisation — check your documents to approve your account and award badges.
• Bill you — charge your wallet for renewals and purchases, run auto top-up within the limit you set, send pro-formas before renewals, and issue invoices and receipts.
• Use AI to help you — draft replies to leads, improve your profile text, answer questions in the Garisea Assistant (Section 4.3), and read listing text you paste into a recovery listing.
• Keep Garisea safe — detect fraud, impersonation, ad fraud and breaches of our Acceptable Use Policy.
• Keep in touch — send lead alerts, billing notices, account and security messages and, if you agree, product news. Turn marketing off in Settings → Notifications.
• Improve Garisea — use analytics to see which features partners use and where they get stuck.
• Meet legal duties — answer lawful requests, keep transaction records for 7 years and keep audit logs.

4.1 How finance and insurance enquiries reach you

• A customer who chooses your organisation always reaches you.
• A “No preference” request goes first to the partner holding first look in its category, if that partner can serve the vehicle, or otherwise to the best-ranked eligible partner. After the first-look hold ends, or at once if no one holds it, we share it with up to 5 eligible partners in total.
• If you share a first-look rota, you see your own turns and the number of other partners in the rota. Other partners never see your name, and customers never see the rota.
• A “No preference” finance request on a vehicle you are selling on your recovery desk comes to you first, for a short time, before other lenders.
• If your organisation has no paid plan, leads reach you with the customer's contact details hidden.

4.2 New-owner offers, claims and recovery enquiries

• For a new-owner offer, you see only counts: how many buyers viewed, clicked, claimed and used it. We don't tell you who viewed or clicked.
• When a buyer claims your offer, the claim reaches you as a lead with the buyer's name, email address and phone number, the car and a claim code, so you can arrange the offer. The buyer is told this before claiming.
• Enquiries and messages about a vehicle on your recovery desk reach you as the seller, with the buyer's contact details.
• Where a lead concerns a car a dealer listed, you see the dealership's public profile, never its phone number or email.

4.3 The Garisea Assistant

• Who can use it — the account's own login and its owner and manager seats.
• Whose chats they are — each person's chats are their own. Each person sees only the chats they started; colleagues can't open them, and that includes the account owner. If a seat is removed, its chats are not passed to anyone else. Authorised Garisea staff can read chats to help you, check the quality of answers and act on abuse.
• Who processes your messages — an AI service provider processes them for us, on our instructions (Section 6.3), and an automated safety check reads each message to keep abuse out. To answer, the assistant reads your account with the same access as the person signed in.
• Nothing is sent for you — replies the assistant writes are drafts, shown for you to copy. It never sends a message to a customer and never changes your requests, profile, offers or ads.
• How long we keep chats — 12 months after their last message, unless you delete them sooner (Section 7).

• Contract — most processing is needed to provide the console under our Partner Terms: your profile, leads, billing and the analytics you signed up for.
• Legitimate interests — fraud prevention, security, analytics (on by default, with an opt-out), and understanding how the console is used. We weigh these against your rights.
• Consent — marketing messages. Withdraw it at any time.
• Legal obligation — tax records, regulator requests, audit trails and breach notification.

We share your data only to provide the service, with your consent, or when the law requires it. We don't sell it, and we don't share it with advertisers.

6.1 Customers and the public

Your organisation's public profile (name, location, ratings, badges, the contact channels you enable, operating hours and service information) appears on garisea.com and in the Garisea app. We never show the email and password you sign in with.

6.2 Your own team

Owners and managers see every staff seat. A branch manager manages the agent seats in their own branch. Each seat hears only about the leads assigned to it, by in-app alert, push and email to its own address. Garisea Assistant chats are not shared: each person sees only their own, and owners and managers can't open another seat's chats (Section 4.3).

6.3 Service providers

Our service providers act on our instructions and may use your data only to provide their service to us. The kinds of provider we use are:

• Payments — to take top-ups and payments.
• Email, SMS and WhatsApp delivery — for alerts, billing notices, pro-formas, one-time codes and, with consent, marketing.
• Hosting, database and caching — encrypted in transit and at rest.
• Image, video and document hosting — for logos, profile images, verification documents, and the photos and videos of vehicles you list.
• Maps — for the location picker on recovery listings. The map provider receives your IP address and browser details, the location you pin and any address you type into the search box.
• Push notifications — to your browser.
• Analytics and error monitoring — Section 3.2.
• Bot protection — on sign-in and sign-up.
• Background jobs and internal alerts — for reminders, renewals, first-look rotas and alerting our team.
• AI — an AI provider processes your messages to the Garisea Assistant with what it needs to answer you (such as names, plan, counts, your requests and your brand's reach), your profile text, and, when you ask for a draft reply to a lead, the customer's name and the request's messages with your organisation's name and category. It doesn't receive the customer's email address or phone number. It also reads listing text you paste into a recovery listing, to fill in the form for you to check.

A full list of our service providers is available from [email protected].

6.4 Authorities

We may disclose your data when Kenyan law requires it, for example under a court order, a regulator's formal request, a criminal investigation by the Directorate of Criminal Investigations (DCI), or a binding KRA request. We will tell you about the request unless the law forbids it.

6.5 Business transfers

If Garisea is sold, merged or restructured, your data may pass to the new owner under the same privacy commitments. Where we reasonably can, we will email you at least 30 days beforehand.

We keep personal data only as long as we need it for the purposes in this Notice. Then we delete it or anonymise it.

• Encryption — TLS 1.2 or higher on every connection, and encryption at rest on our production database. Apple sign-in tokens are also encrypted with AES-256-GCM.
• Passwords — stored only as salted bcrypt hashes.
• Sign-in — access tokens last 30 minutes and refresh tokens rotate on every use. They sit in secure, httpOnly cookies.
• Signing out — Sign out ends the session on this browser only. Sign Out Everywhere (Settings → Security) ends every session on your account, and so does deleting the account; changing your password ends every session except the one you changed it from. Those other sessions stop working within moments, not when their sign-in would otherwise expire.
• Account lockout — after 5 failed sign-in attempts in 30 minutes, we lock the account for a short time and email you.
• Staff seats — seats can't close the account or change its sign-in email or password. Invitation links are stored only in hashed form and expire after 7 days.
• CSRF protection and signed webhooks — we verify a CSRF token on changes, and the signature on incoming payment, email and media notifications.
• Access controls — our staff get access to personal data by role, and we log administrative actions.
• Secrets — rotated every 90 days and at once on a suspected compromise; automated scans block accidental commits of credentials.

No system is completely secure. If a personal data breach affects you, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and tell you without undue delay where the breach puts you at real risk.

Under the Act (and GDPR Articles 15–21 where they apply) you have these rights:

• Access and portability — email [email protected] and we will send you a structured, machine-readable copy of your account data within 30 days. There is no self-service export for partner accounts yet.
• Correction — edit most details in Settings → Profile. For anything you can't change yourself, email [email protected].
• Deletion — the account's own login (not a staff seat) can delete the account in Settings → Account Deletion. When you delete the account, we cancel your subscription and stop your ads and bookings. Within 30 days we remove your public profile, remove every staff seat on the account, and remove the name, email address, phone number, photo and address from the account. We keep tax records and the audit log as the law requires. If your wallet holds money when you delete your account, it isn't forfeited: we open a payout request and pay the balance back to you (or your business); we may contact you to confirm where to send it. We keep the contact and payment details needed for that payout until it is made.
• Objection — object to processing based on our legitimate interests, for example by switching off analytics (Cookie Policy, Section 5) or marketing (Settings → Notifications), or by emailing [email protected].
• Withdrawing consent — at any time, in your settings. It doesn't affect what we did before.
• Restriction — ask us to pause processing while we look into a complaint.
• Complaint — complain to the Office of the Data Protection Commissioner (Kenya).

We respond to rights requests within the time the law requires.

Most of our servers and service providers are outside Kenya. Our main database is hosted in the United States, and most of our providers are based in the United States; our SMS and payment providers are in Kenya. When we transfer your data outside Kenya we do so under section 48 of the Act, relying on contracts that require the recipient to protect it, and on encryption in transit and at rest.

We use automated systems to:

• rank partners for customers, by the real cost for the vehicle or the advertised rate, with your plan used only to break ties;
• plan first-look rotas and route “No preference” requests (Section 4.1);
• score how likely a lead is to buy (Cold to Very Hot);
• assign leads to your staff and move an unanswered lead to the next seat, if you turn automatic assignment on;
• buy impression packs within your monthly limit, if you turn auto top-up on;
• buy the impression pack you chose for automatic top-up when your balance falls below your threshold, within your monthly limit; and
• filter clearly fraudulent activity.

None of these decisions has a legal or similarly significant effect on you within section 35 of the Act. If you think one has harmed you, for example your profile was wrongly hidden, email [email protected] and a person will review it.

When a lead delivers a customer's details (name, phone, email, message and request details) to your organisation, your organisation becomes an independent data controller for them. Under the Act and the Partner Terms you must: use the data only for the enquiry it relates to (no marketing lists, resale or passing it on); keep it secure (no unsecured WhatsApp groups beyond your staff, no customer spreadsheets on unsecured devices); delete it when you no longer need it for the enquiry; answer requests that customers make to you directly within the time the law requires; make sure everyone on your staff seats follows these rules; and tell Garisea promptly if you learn of a breach affecting customer data you got through Garisea. Finance and insurance partners must also follow the financial-services and insurance rules that apply to them in Kenya. See Partner Terms §13 and §22.

We may update this Notice as the console changes, as our providers change, or as the law requires. We will email you about a material change at least 14 days before it takes effect, and show a notice in the console. The “Last updated” date at the top shows the latest version. If you keep using the console after the change takes effect, the updated Notice applies.

For privacy questions, complaints or to use your rights:

• Privacy questions, rights requests, complaints, and trust and safety: [email protected], our data protection contact.
• Partner support: open a support ticket from your dashboard (Support), or email [email protected].
• Francton Limited, operating as Garisea.

To complain to the Kenyan regulator: Office of the Data Protection Commissioner — www.odpc.go.ke.