MOJA PRIVACY POLICY
(For users of the Nairobi Expressway)
MOJA EXPRESSWAY COMPANY LIMITED (‘MOJA’) understands that your privacy is important to you and that we care about how your personal data is used. We respect and value the privacy of all our customers and users and we will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the Data Protection legislation (as defined hereinbelow).
This is Moja Expressway Company Limited Privacy Policy (“Privacy Policy”) which may be accessed from webpage (https://www.nairobiexpressway.ke/) where you submit personal data to access the service or may be obtained as a hard copy when you submit personal data at our Service Centre(s).
MOJA operates the “Nairobi Expressway” which is the 27.1 kilometres dual carriage way with Class A Standard that connects Mlolongo with James Gichuru Road along the median strip of A8 National Road with controlled access.
We are referred to in this Privacy Policy as “MOJA”, "we" or “our” or “us”. An individual who is the subject of the personal data is referred to as “Customer”, “User” or “you”.
This Privacy Policy only covers users of Nairobi Expressway. MOJA’s employees or third-party vendors personal details are handled in-line with the terms of employment agreement or contractual relationships, or our separate policies that we provide, as relevant, independent of this Privacy Policy.
1. Information about us
MOJA EXPRESSWAY COMPANY LIMITED a limited company registered in the Republic of Kenya under company number PVT-XYUJQ62.
Registered address: Nairobi Expressway Plaza, Along Mombasa Road, Opposite City Cabanas, Embakasi, Nairobi.
Postal Address: P.O. Box 10481 - 00100
Email address: [email protected]
Telephone number: +254 111 039 777
Website: https://www.nairobiexpressway.ke
2. What does this Privacy Policy cover?
2.1 This Privacy Policy explains how we use your personal data: how it is collected, how it
is held and how it is processed. It also explains your rights under the law relating to
your personal data.
2.2 We will process any personal data we collect from you in accordance with this Privacy Policy and our Terms and Conditions of Service (together with any other documents referred to in it). Kindly carefully read this Policy carefully so that you can understand how we handle your personal data.
3. What Is Personal Data?
3.1 Processing of personal data is governed by the Data Protection Act, 2019(‘the Act’), The
Data Protection General Regulations 2021, The Data Protection (Registration of Data
Controllers and Data Processors) 2021, The Data Protection (Complaints Handling and
Enforcement Procedures) Regulations 2021 and as may be amended from time to time,
and any other regulations made thereunder (collectively, “the Data Protection
Legislation”).
3.2 Personal data refers to any information about you that enables you to be identified as
individual such as your name, contact details, identification numbers but it also covers
less obvious information such as, electronic location data, and other online identifiers.
The personal data that we use is set out in Part 4, below.
4. How do we use your Personal Data?
For us to ‘process’ your personal data legally there are a number of options available to us
under the Data Protection Legislation. We will categorically set out in this Privacy Policy
which option(s) we have chosen for the service we provide to you for processing your
personal data.
4.1 The most common for us will be:
4.1.1 Contract - for the performance taking steps prior to entering a contract or for
purposes of fulfilling a contract to which you are a party;
4.1.2 Legal obligation – where we are required to comply with any legal obligation to
which we are subject;
4.1.3 Public interest - because our focus is delivering services to you that are required on
the Nairobi Expressway;
4.1.4 Legitimate Interest – where we need to pursue the interest by us as a data
controller; and
4.1.5 Consent where applicable under Data Protection Legislation.
4.2 In some cases, we may ask for your consent to process your personal data. We will
ensure that the consent communicated to you is specific, and in a simple and clear
language so you may voluntarily give informed consent. ‘Vital Interests’ can be used as
a lawful basis where we need to share your personal data in emergency circumstances
or where it is a matter of life and death.
4.3 With your permission or where permitted by law, we may also use your personal data
for marketing purposes, which may include contacting you by email and/or telephone
and/or text message or post with information, news, and offers on our services. We will
not send you any unsolicited or unlawful marketing messages. We will always work to
fully protect your rights and comply with our obligations under the Data Protection
Legislation.
4.4 We will not use your personal data for any other purpose other than the purpose(s) for
which it was originally collected, unless we reasonably believe that another purpose is
compatible with that or those original purpose(s). If we do use your personal data in
this way and you wish us to explain how the new purpose is compatible with the
original, please contact us .
4.5 If we need to use your personal data for a purpose that is unrelated to, or incompatible
with, the purpose(s) for which it was originally collected, we will inform you and explain
the legal basis which allows us to do so or seek your consent.
4.6 In some circumstances, where permitted or required by law, we may disclose your
personal data without your knowledge or consent. This will only be done within the
bounds of the Data Protection Legislation and your legal rights.
5. What are your rights under the Data Protection Legislation?
Under the Data Protection Legislation, you have the following rights, which we will
always work to respect and uphold:
a) The right to be informed about our collection and use of your personal data. This
Privacy Policy should tell you everything you need to know, but you can always
contact us to find out more or to ask any questions.
b) The right to access the personal data we hold about you.
c) The right to have your personal data corrected if any of your personal data held by us
is false, erroneous or misleading.
d) The right to ask us to delete or otherwise dispose of any of your personal data that we
hold.
e) The right to restrict (i.e. prevent) under certain circumstances the processing of your
personal data.
f) The right to object to us to our use of your personal data for a particular purpose or
purposes.
g) The right to withdraw consent. This means that, if we are relying on your consent as
the lawful basis for using your personal data, you are free to withdraw that consent at
any time.
h) The right to data portability. You have a right to request your personal information,
which you have provided to us in a structured and commonly used format for your own
use across different services.
i) Rights relating to automated decision-making and profiling. We do not use your
personal data in this way
For more information about our use of your personal data or exercising your rights as
outlined above, please contact us.
It is important that your personal data is kept accurate and up-to-date. If any of the
personal data we hold about you changes, please contact us with the changes as long as
we have that data.
If you have any cause for complaint about our use of your personal data, you have the right
to lodge a complaint with the Office of the Data Protection Commissioner. We welcome
the opportunity to resolve your concerns ourselves, however, so please contact us first.
6. What personal data do we collect and how?
6.1 We may collect and hold some or all of the personal and non-personal data set out in
the table below, using the methods also set out in the table.
6.2 We do not collect any ‘sensitive’ personal data like data relating to your race, health
status, ethnic social origin, conscience, belief, genetic data, biometric data, property
details, marital status, family details including names of your children, parents, spouse
or spouses, sex or the sexual orientation. In future and if the need arises, we’ll only
collect sensitive data about you if we have your consent, or if required under the Data
Protection Legislation.
Details of personal data collected
| Data Collected |
How We Collect the Data |
|---|---|
|
Personal Information
For individuals - first name and surname For companies – company name and company contact person’s name. |
The manual subscriber registration form and the online subscriber registration form on our website. |
|
Contact information
For individuals – telephone number, email For companies – postal address, company contact person’s email and company telephone number. |
The manual subscriber registration form and the online subscriber registration form on our website. |
|
Identification details and documents
For individuals – copy of national identification card or passport, copy of vehicle logbook or vehicle registration certificate. For companies – copy of certificate of incorporation, copy of company Kenya Revenue Authority Personal Identification Number (PIN), copy of vehicle logbook or vehicle registration certificate. |
The manual subscriber registration form and the online subscriber registration form on our website. |
7. How do we use your personal data?
We process your personal data for one of the lawful bases of processing (“Lawful
Basis”) depending on the specific purpose for which we are using your data (see table
below)
|
What we do |
What Data We Use |
Our Lawful Basis |
|---|---|---|
|
Communication
Providing you with services and access related to Nairobi Expressway Engaging with and responding to your inquiries, service updates or feedback, including contacting you where necessary. |
For individuals – telephone number, email For companies – Postal address, company contact person’s email and company telephone number. |
Performance of our contract with you. |
|
User Identification
Identity verification, establishing and administering your OnBoard Unit (OBU) and Manual Toll Collection (MTC) card providing you with technical support. Processing payments for our service |
For individuals – copy of national identification card or passport. For companies – copy of certificate of incorporation, copy of company Kenya Revenue Authority personal identification number (PIN) |
Performance of our contract with you. |
|
Marketing
Keeping you informed about our services and any promotions we may be running for the Nairobi Expressway |
For individuals – telephone or mobile number, email.
For companies – postal address, company contact person email and company contact telephone or mobile number. |
Consent you can withdraw your consent at anytime |
|
Vehicle identification
Identify your vehicle for fitting, operating and administering an OBU and providing you with technical support Ascertain the class of vehicle at our toll stations for collection of toll fees |
A copy of vehicle logbook or vehicle registration certificate. |
Legitimate Interest of the Data Controller |
Close Circuit Television (CCTV) and Automatic Number Plate Recognition (ANPR) Privacy information
We use CCTV and ANPR system to capture:
• An overview of your vehicle;
• the vehicle registration number; and
• date, time and location of your vehicle on the Nairobi Expressway.
Why do we collect CCTV and ANPR data?
The ANPR and CCTV data we collect is for the purposes of:
• Monitoring and managing traffic on the Nairobi Expressway;
• Nairobi Expressway incident monitoring and management; and
• Security in the interest of the public.
What is the lawful basis allowing us to collect and process CCTV and ANPR information?
The lawful basis for processing personal data collected by the system is public interest
and functions of a public nature as set out in Section 30(1)(b)(vi) of The Data Protection
Act
How long do we keep CCTV and ANPR this information for?
The ANPR and CCTV data is retained for 120 days, except where an incident has been
reported in which case it will be stored for a reasonable period for purposes of
evaluating and concluding any incident and then deleted.
8. Do we share your personal data?
All data sharing will be undertaken in line with the Data Protection Legislation.
8.1 Transfer of your Personal Data outside of the Republic of Kenya.
We do not transfer your personal data outside of the Republic of Kenya. All processing of your personal data is done within Kenya within our servers located in the Republic of Kenya.
8.2 Within MOJA .
For administrative and operational purposes, we share data internally across our departments in MOJA as the departments need to access data to fulfil our service to you. The sharing across our departments is reasonable, is in line with Data Protection Legislation, and respects your rights.
We hold your personal data record for you in our service centres as to provide and fulfil
our obligations to you and have the most up-to-date contact details for you across
services to support your right to accurate data.
8.3 Outside MOJA.
A number of organisations assist us in delivering our services to you but we do not share, store or handle your information with these organisations. We may provide them access, without sharing your personal data, to our platform for purposes of facilitating our service to you. For example, banks who assist us in top-up of toll points to the On-Board Unit (OBU) and Manual Toll Collection (MTC) cards. We are responsible for your Personal Data and ensure that appropriate safeguards are in place.
We are obliged by law to share some Personal Data with Government, law and
enforcement agencies. Where possible, we make this anonymous and only share
statistics.
Where your consent is needed to transfer the data, we will make this clear to you in
simple and clear language so you may make an informed decision.
We will never share your information if it’s not legal to do so, and will always consider
your rights, and whether there is another way of achieving our aim, before doing so.
8.4 CCTV and ANPR .
We may share CCTV and ANPR data in limited circumstances as follows:
a) For safety of those using the Nairobi Expressway;
b) For detection, prevention or resolution of crime on the Nairobi Expressway;
c) Where required to share under any statute or a court order of competent
jurisdiction; and
d) With authorised third parties in furtherance of MOJA’S legitimate interest to
provide requested services to its customers.
9. How do I know my data is safe?
We use a high level of protection, both organisational and technical measures, to ensure we process our customers data safely. Some of the measures are:
• Servers that are configured to meet the highest standards for security.
• Access to data via secure log-in.
• Buildings and areas that have access only through staff passes, and secure files
stored in areas that are further restricted by passes, keys, CCTV surveillance and
security guards on duty.
• Systems are only available through strictly controlled security processes. We
ensure that only access to personal data is granted to individuals based on job
and duty roles.
10. How long do we keep your personal data?
We are required under the Data Protection Legislation to keep your personal data only for specific period as lawfully required. Some of the considerations we take into account when deciding on the retention of your data are:
• Where it is stipulated under the law; and
• The necessary time your data is needed for us to deliver the service to you.
11. How we use Cookies
We use cookies to store and collect information about your use of our website. More
information is on our Cookie Policy, which may be accessed from webpage
(https://www.nairobiexpressway.ke/)
12. How to Contact us
If you wish to contact us in respect of part of this Privacy Policy or have any questions
or would like further information regarding our handling of your personal data, please
contact us by email:
Data Protection Officer
Nairobi Expressway Plaza, Along Mombasa Road,
Opposite City Cabanas, Embakasi, Nairobi.
Email address: [email protected]
13. Amendments to this Privacy Policy
We may change, modify or adopt a new Privacy Policy from time to time. If we do so, we will post it on our website and at our Service Centres. It’s your responsibility to check the Privacy Policy every time you submit your personal data to us
14. Changes to your personal data
Please keep us informed of any changes to your personal data by emailing us with full details of the changes at [email protected]