Your data, handled like it matters.

MotorLink is operated by MotorLink Performance Systems Ltd., a company registered in Kenya (registration pending), with its office at 5th floor, Pinecrest Business Park, Waiyaki Way, Westlands, Nairobi.

For anything in this policy, our Data Protection Officer can be reached at support@motorlink.co.ke.

We only collect data we actually need to operate MotorLink. Specifically:

• Account data — your name, email, phone number, password hash.
• Listing data — for dealers: business registration number, physical address, proof of trading, plus everything you publish on a listing.
• Buyer activity — listings you view, favourite or enquire about; searches you save.
• Device data — IP address, browser type, rough geolocation (derived from IP), device identifier.
• Communications — messages you send to dealers through MotorLink, and messages you send us at our support inboxes.

We do not collect NTSA / DL data, biometric data, or precise GPS location.

Each piece of data has a specific, declared purpose:

• To create your account and let you sign back in.
• To let you publish, browse, favourite and enquire about cars.
• To route your enquiry to the correct dealer and track its reply time.
• To protect the platform against fraud, impersonation and abusive listings.
• To improve the product — measured using aggregated analytics only.
• With your explicit consent, to send you weekly deal alerts or editorial digests.

Under Kenya's Data Protection Act, we process your personal data on one of four grounds:

• Contract — you signed up and we need your data to provide the service.
• Legitimate interest — e.g. protecting the marketplace from fraud.
• Legal obligation — e.g. responding to a lawful order from ODPC.
• Consent — for marketing emails and non-essential cookies. You can withdraw at any time.

We share only the minimum data needed, only with parties that carry the same standard of protection. Specifically:

• Dealers — your name, email and phone only when you submit an enquiry on their listing.
• Service providers — cloud hosting (Vercel, AWS), email delivery (Resend), image hosting (Cloudinary). None of these are used for marketing.
• Law enforcement — only on valid legal process under Kenyan law.

We do not sell your data to third parties. Not now, not ever.

We classify cookies into three buckets. You control the last two via our cookie policy page or the cookie banner shown on first visit.

• Essential — logins, session, CSRF protection. Cannot be disabled.
• Analytics — anonymised usage stats (Plausible, self-hosted). Opt-in.
• Marketing — we currently do not use marketing cookies.

Under the Kenya Data Protection Act you have the right to:

• Ask for a copy of everything we hold about you.
• Correct inaccurate data.
• Delete your data (subject to our legal retention needs).
• Withdraw consent for anything done on the basis of consent.
• Object to processing you believe is unjustified.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

To exercise any right, write to support@motorlink.co.ke. We reply within 30 days.

We keep your data only for as long as we need it:

• Active accounts — while your account exists.
• Deleted accounts — 30-day soft-delete window, then permanently purged.
• Dealer transaction records — 7 years (to meet Kenyan tax law).
• Server logs — 90 days, then aggregated.

Passwords are hashed using Argon2. All traffic is TLS 1.3. Data at rest is encrypted via AES-256. Staff access is role-based and audited. We conduct quarterly vulnerability reviews.

If a breach affecting your data occurs, we will notify you and the ODPC within 72 hours of becoming aware — as required by law.

We update this policy when we add a feature that materially changes how data flows. We always tell you before we change it — through a banner on sign-in and an email to your registered address.