Privacy Policy
This policy explains what personal information Vintech Engineering Solutions collects when you use our services or website, why we collect it, and how we protect it — in line with the Kenya Data Protection Act 2019.
About This Policy
Vintech Engineering Solutions (“Vintech”, “we”, “us”, or “our”) is a vehicle electronics repair shop based in Ngara, Nairobi, Kenya. We repair speed governors, GPS trackers, sound systems, electronic control boards, and related vehicle accessories.
This Privacy Policy describes how we collect, use, store, and protect your personal data whenever you visit our website, contact us by phone or email, or bring a device to our workshop for diagnosis or repair.
We are committed to processing your personal data lawfully, fairly, and transparently in accordance with the Kenya Data Protection Act 2019 (No. 24 of 2019) and the Data Protection (General) Regulations 2021.
By using our website or services, you acknowledge that you have read and understood this policy. If you have any questions, contact us at any time using the details in Section 11.
Data Controller
For the purposes of the Kenya Data Protection Act 2019, the data controller is:
Vintech Engineering Solutions
As data controller, we determine the purposes for which and the means by which your personal data is processed.
What Personal Data We Collect
Depending on how you interact with us, we may collect the following categories of personal data:
3.1 — Information You Give Us Directly
- Contact details: Full name, phone number, and email address provided when contacting us or leaving a device for repair.
- Device information: Device type, brand, model number, serial number, and a description of the fault or symptoms you report.
- Repair instructions: Special instructions, access codes, or notes you share to help us complete the repair.
- Payment details: We record the method of payment (cash or M-Pesa) and a transaction reference number for receipt and record-keeping purposes. We do not store debit or credit card details.
3.2 — Information Collected Automatically
When you visit our website, our hosting provider and any analytics tools we have enabled may automatically collect basic technical information including:
- Your IP address (used to determine approximate country)
- Browser type and version
- Pages visited and time spent on the site
- Referring website (where you came from)
- Date and time of your visit
This data is collected in aggregate and is not used to identify you personally.
3.3 — Sensitive Information
We do not intentionally collect sensitive personal data (such as biometric data, health data, or financial account numbers). If you share such information with us, please limit it to what is strictly necessary for the repair.
How We Collect Your Data
We collect personal data through the following channels:
- When you fill in our website contact form
- When you call or message us by phone
- When you email us with a repair enquiry
- When you walk into our Ngara workshop to drop off a device
- When you complete a physical repair intake form at the counter
- Automatically when you browse our website (technical/analytics data only)
Why We Use Your Data
We process your personal data for specific, legitimate purposes. The table below sets out each purpose and its legal basis under the Kenya Data Protection Act 2019:
| Purpose | Legal Basis (DPA 2019) |
|---|---|
| Provide repair and diagnostic services | Performance of a contract (Section 30(1)(b)) |
| Contact you about your repair status | Performance of a contract (Section 30(1)(b)) |
| Issue receipts and maintain financial records | Legal obligation (Section 30(1)(c)) |
| Respond to enquiries submitted via our contact form or phone | Legitimate interests (Section 30(1)(f)) |
| Improve the quality of our services | Legitimate interests (Section 30(1)(f)) |
| Comply with legal obligations (NTSA, KRA, etc.) | Legal obligation (Section 30(1)(c)) |
| Analyse anonymous website usage to improve our site | Legitimate interests (Section 30(1)(f)) |
We will only use your data for purposes compatible with those listed above. If we need to use your data for a new purpose, we will inform you and obtain your consent where required.
How Long We Keep Your Data
We keep your personal data only as long as necessary for the purpose it was collected, or as required by Kenyan law:
| Data Category | Retention Period |
|---|---|
| Repair records (name, device, fault, repair performed) | 3 years from date of repair |
| Payment records and receipts | 5 years (tax compliance) |
| Contact form submissions | 12 months |
| Phone call logs (numbers only) | 6 months |
| Website analytics data | 26 months (aggregate data only) |
After the retention period, data is securely deleted from our records and systems.
Your Rights Under Kenyan Law
Under the Kenya Data Protection Act 2019 (Part V — Rights of Data Subjects), you have the following rights:
Right of Access (S.26)
Request a copy of the personal data we hold about you.
Right to Rectification (S.27)
Ask us to correct inaccurate or incomplete data.
Right to Erasure (S.28)
Request deletion of your data where there is no legal basis for continued processing.
Right to Restriction (S.29)
Ask us to restrict processing of your data in certain circumstances.
Right to Data Portability (S.32)
Receive your data in a structured, machine-readable format.
Right to Object (S.31)
Object to processing based on legitimate interests or for direct marketing.
Right to Withdraw Consent
Where processing is based on consent, withdraw it at any time without affecting prior processing.
Right to Complain
Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your rights have been violated.
To exercise any of your rights, contact us by email at vintechengineeringkenya@gmail.com or call 0726 332 407. We will respond within 21 days. You can also contact the ODPC at www.odpc.go.ke.
Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction.
These measures include:
- Physical records stored in a locked office accessible only to authorised staff
- Digital records protected by access controls and passwords
- Our website is served over HTTPS (encrypted connection)
- Staff handling personal data are trained on data protection obligations
- Repair intake forms are kept securely and not left accessible to the public
While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we will notify you promptly of any data breach that is likely to result in a risk to your rights and freedoms, as required by the DPA 2019.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. When we make significant changes, we will update the “Last updated” date at the top of this page.
We encourage you to review this policy periodically. Continued use of our services after changes have been posted constitutes your acceptance of the updated policy.
Contact & Complaints
If you have questions about this Privacy Policy, wish to exercise your data subject rights, or want to raise a concern about how we handle your data, please contact us:
Vintech Engineering Solutions — Data Queries
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):
Office of the Data Protection Commissioner
Teleposta Towers, 10th Floor, Kenyatta Avenue, Nairobi
Website: www.odpc.go.ke
Questions?
Have a question about this policy?
We are happy to explain anything in plain language. Reach out by email or phone.