Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Data Protection Officer (DPO)

In accordance with Section 24 of the Data Protection Act, 2019, we have designated a Data Protection Officer who acts as the contact point for the Data Commissioner and data subjects on all data protection matters.

3. Introduction

Ma3flow Technologies Limited (“Ma3flow,” “we,” “us,” or “our”) is committed to protecting your personal data in accordance with the Kenya Data Protection Act, 2019 (the “DPA”), the Data Protection (General) Regulations, 2021, and all other applicable data protection laws and regulations in Kenya.

4. Personal Data We Collect

We collect personal data in three ways: when you provide it directly, when you use the platform, and from third-party services. We apply the principle of data minimisation — collecting only what is necessary for the specified purposes (Section 39(b) DPA).

5. Lawful Basis for Processing

Under Section 30 of the DPA, we process your personal data only when we have a lawful basis to do so. The table below sets out the legal basis for each processing activity:

6. How We Use Your Data

In compliance with the purpose limitation principle (Section 39(a) DPA), we use your personal data only for the specific purposes for which it was collected:

7. Data Sharing and Recipients

We do not sell, rent, or trade your personal data. We share data only in these specific circumstances and with the following categories of recipients (Section 25(1)(c) DPA):

8. GPS and Location Data

9. Data Security

In accordance with Section 41 of the DPA, we implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction:

10. Cross-Border Data Transfers

Under Section 48 of the DPA, personal data shall not be transferred outside Kenya unless the recipient country provides adequate data protection safeguards, the data subject has consented, or there are appropriate contractual clauses in place.

All cross-border transfers are subject to Data Protection Impact Assessments (DPIAs) as required by Section 31 of the DPA. We ensure the recipient country provides adequate safeguards or that appropriate contractual measures are in place.

11. Data Retention

In accordance with Section 39(c) of the DPA (storage limitation principle), personal data shall not be retained for longer than is necessary to fulfill the purposes for which it was collected. We maintain accurate and up-to-date records of processing activities as required by the General Regulations, 2021.

12. Your Rights as a Data Subject

Under Sections 26–34 of the DPA and the Data Protection (General) Regulations, 2021, you have the following rights. We are committed to fulfilling these rights within the statutory timeframes:

13. Automated Decision-Making and Profiling

Ma3flow uses machine learning algorithms for:

• •ETA predictions based on historical traffic patterns and real-time GPS data
• •Stage directory updates based on community reports
• •Traffic congestion analysis and AI bypass route suggestions
• •Driver behavior profiling for safety scoring
• •Demand prediction for route planning

Important: None of these automated processes produce decisions that have a legal effect on you or similarly significantly affect you. ETAs are estimates, not guarantees. Stage data is advisory. Driver safety scores are internal metrics.

You have the right to request human review of any automated output that you believe is inaccurate (Section 35 DPA). Contact dpo@ma3flow.com.

14. Children's Privacy

Ma3flow is not intended for users under 13 years of age. We do not knowingly collect personal data from children. In accordance with the ODPC's Guidance Note on Processing Children's Data, if we become aware that a child under 13 has provided us with personal information, we will take steps to delete it immediately. For users between 13 and 18, parental or guardian consent is required for registration.

15. Data Breach Notification

In the event of a personal data breach, we follow the procedures mandated by Section 43 of the DPA and the Data Protection (General) Regulations, 2021:

16. Data Protection Impact Assessment (DPIA)

In compliance with Section 31 of the DPA, we conduct Data Protection Impact Assessments before carrying out high-risk processing activities, including large-scale GPS tracking, ML-based profiling, and cross-border data transfers. Our DPIAs include a systematic description of the processing, an assessment of necessity and proportionality, an assessment of risks to data subjects, and the measures identified to address those risks.

17. How to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):

18. Changes to This Policy

We may update this Privacy Policy as Ma3flow evolves. In compliance with Section 25 of the DPA, we will update this notice in line with any changes to our processing activities. The “Last Updated” date at the top reflects the most recent revision. For material changes — such as new data sharing partners, changes to GPS data handling, or new automated processing — we will notify you through the app, via email (if provided), or by displaying a notice on the website at least 30 days before the changes take effect.