Privacy Policy

AdvaIoT is a business unit of Advatech Group Ltd, incorporated in Kenya (Registration No. PVT-XXXXXXXX) with our principal place of business at Soin Arcade, Westlands, Nairobi, Kenya. We are a data controller as defined under the Data Protection Act, 2019 (Kenya).

This Privacy Policy applies to personal data collected through our website (advaiot.com), our IoT monitoring platform, our mobile applications, and in the course of providing our services to clients across Africa.

We collect personal data in the following categories:

• <strong>Identity data:</strong> Full name, job title, company name, and national ID or passport number (for formal service contracts).
• <strong>Contact data:</strong> Email address, phone number, and physical address.
• <strong>Technical data:</strong> IP address, browser type and version, device identifiers, and log data generated when you use our website or platform.
• <strong>IoT and operational data:</strong> GPS coordinates, sensor readings, vehicle telemetry, fuel consumption data, temperature logs, and other operational data generated by IoT devices installed on assets belonging to or managed by our clients. This data relates to vehicles, equipment, premises, and infrastructure — not to private individuals in general.
• <strong>Transaction and billing data:</strong> Invoicing details, M-Pesa transaction references, bank transfer records, and account balances.
• <strong>Communication data:</strong> Emails, WhatsApp messages, and records of phone calls or meetings held for the purpose of delivering our services or responding to enquiries.
• <strong>CCTV and camera footage:</strong> Where our systems include camera hardware installed on client premises, footage is collected. See Section 5 for how this is handled.

We collect data through the following means:

• Contact and enquiry forms on our website.
• Direct correspondence via email, phone, or WhatsApp.
• IoT devices (GPS trackers, sensors, cameras, and data loggers) installed on client assets and premises as part of service delivery.
• Our web-based and mobile platform when you log in and use AdvaIoT dashboards.
• Third-party services including Google Analytics and Vercel Analytics, which collect anonymised website traffic data.
• Publicly available information for due diligence on prospective business clients.

Under the Data Protection Act, 2019 (Kenya), we process personal data on the following legal bases:

• <strong>Contract performance:</strong> Processing necessary to deliver the IoT services you have contracted with us.
• <strong>Legitimate interests:</strong> Processing necessary for our business interests, including fraud prevention, platform security, and improving our services — balanced against your rights.
• <strong>Legal obligation:</strong> Processing required to comply with Kenya Revenue Authority (KRA) requirements, court orders, or regulatory obligations.
• <strong>Consent:</strong> Where we process data outside the above bases (such as marketing communications), we will seek your explicit consent and provide a clear opt-out mechanism.

We use personal data for the following purposes:

• To provide, maintain, and improve our IoT monitoring and management services.
• To set up and manage your account on the AdvaIoT platform.
• To process payments and manage billing and invoicing.
• To send service-related communications including alerts, reports, maintenance notifications, and scheduled downtime notices.
• To respond to your support requests, complaints, or enquiries.
• To comply with legal and regulatory requirements applicable to our business in Kenya.
• To analyse platform usage and improve our product features.
• To send marketing communications about new products or features (where you have consented or where we have a legitimate interest as an existing customer).

A significant portion of data processed through our platform relates to physical assets — vehicles, equipment, premises, and infrastructure — rather than private individuals. However, where IoT devices (such as GPS trackers or cameras) incidentally capture or record personal data about individuals (such as drivers, employees, or individuals on camera), we apply the following principles:

• Our clients are the data controllers for operational data collected through devices installed on their assets. AdvaIoT acts as a data processor for this data.
• Clients are responsible for informing individuals whose data is collected (such as employees, drivers, or visitors) in accordance with applicable law.
• Camera footage from on-vehicle or on-premises cameras is stored encrypted. Access is restricted to authorised client users and AdvaIoT support staff.
• We do not use client operational data for any purpose other than service delivery, support, and platform improvement, and we do not sell this data to third parties.

We share personal data only in the following circumstances:

• <strong>Within Advatech Group:</strong> Shared services including IT infrastructure, legal, and finance may have access to data necessary to support our operations.
• <strong>Service providers and sub-processors:</strong> We use third-party services including cloud hosting (Vercel), mapping providers (Google Maps Platform), and communication tools. These providers are bound by data processing agreements and may not use your data for their own purposes.
• <strong>Regulatory and law enforcement authorities:</strong> Where required by law, including under a court order, or where we are compelled by the Kenya National Police Service, the Office of the Director of Public Prosecutions, or other competent authority.
• <strong>Professional advisers:</strong> Our lawyers, auditors, and accountants who are bound by confidentiality obligations.
• <strong>Business transfers:</strong> In the event of a merger, acquisition, or sale of our business, data may be transferred to the acquirer subject to the same privacy protections.

We do not sell, rent, or trade your personal data to third parties for marketing or commercial purposes.

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, and reporting requirements under Kenyan law.

• <strong>Client account data:</strong> Retained for the duration of the service contract and for 7 years thereafter, in accordance with KRA requirements for business records.
• <strong>IoT operational data (GPS tracks, sensor readings, telemetry):</strong> Retained for the period specified in your service agreement, typically 12–24 months of rolling history on the platform.
• <strong>Camera and CCTV footage:</strong> Retained for 30 days by default unless a client specifically configures a longer or shorter period within their account settings.
• <strong>Website enquiry and contact data:</strong> Retained for 3 years from last contact.
• <strong>Marketing consent records:</strong> Retained until consent is withdrawn, plus 3 years.

After the applicable retention period, data is securely deleted or anonymised.

Under the Data Protection Act, 2019 (Kenya), you have the following rights in relation to your personal data:

• <strong>Right of access:</strong> You may request a copy of the personal data we hold about you.
• <strong>Right to rectification:</strong> You may request that we correct inaccurate or incomplete data.
• <strong>Right to erasure:</strong> You may request deletion of your data in certain circumstances, including where we no longer need it for the purpose it was collected.
• <strong>Right to object:</strong> You may object to processing based on legitimate interests or for direct marketing purposes.
• <strong>Right to restrict processing:</strong> You may request that we restrict processing of your data in certain circumstances.
• <strong>Right to data portability:</strong> You may request a copy of your data in a structured, machine-readable format.
• <strong>Right to withdraw consent:</strong> Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@advaiot.com. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of sensitive data at rest.
• Role-based access control on our platform, restricting access to data to authorised personnel only.
• Regular security reviews and vulnerability assessments.
• Staff training on data protection and information security.

No internet-based system is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner in accordance with the timelines required by the Data Protection Act, 2019.

Our website uses cookies and similar tracking technologies to improve your experience. We use:

• <strong>Strictly necessary cookies:</strong> Required for the website to function correctly. These cannot be disabled.
• <strong>Analytics cookies:</strong> Used to understand how visitors interact with our website, using Google Analytics and Vercel Analytics. These are set only with your consent where required by law.
• <strong>Functionality cookies:</strong> Used to remember your preferences, such as language settings.

You can manage cookie preferences through your browser settings at any time. Disabling certain cookies may affect website functionality.

Our platform is hosted on infrastructure operated by Vercel Inc. (United States) and may involve processing of data on servers located outside Kenya. We ensure that any international transfer of personal data is made subject to appropriate safeguards, including standard contractual clauses or equivalent protections, in accordance with the Data Protection Act, 2019 (Kenya).

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Where changes are material, we will notify clients directly by email and update the 'Last Updated' date at the top of this document.

Continued use of our services after the effective date of a revised Privacy Policy constitutes acceptance of the updated terms.

If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:

• <strong>Data Controller:</strong> Advatech Group Ltd (trading as AdvaIoT)
• <strong>Address:</strong> Soin Arcade, Westlands, Nairobi, Kenya
• <strong>Email:</strong> info@advaiot.com
• <strong>Phone:</strong> +254 769 580 000
• <strong>Data Protection Commissioner (Kenya):</strong> www.odpc.go.ke