Privacy notice

Thika Motor Dealers (K) Ltd (“TMD”, “we”) operates this website at tmd.co.ke. For the purposes of the Kenya Data Protection Act 2019 we are the data controller for the personal data described in this notice.

Registered office: Garissa Road, Thika Industrial Area, Thika, Kiambu County, Kenya. General enquiries: info@tmd.co.ke or our customer support line on 0800-720-797.

We collect only what a specific purpose requires.

• When you submit a form (quote, enquiry, booking, job application): your name, phone number, and — if you provide them — email address, company name, preferred branch, vehicle of interest, vehicle registration and mileage, and anything you write in the message field.
• Marketing attribution: if you arrived from an advertisement or a search result, the campaign identifiers in the link (such as utm_source and Google's gclid) and the page you landed on. This tells us which advertising works.
• Technical information automatically sent by your browser: pages viewed, approximate device type, and the website that referred you. Your IP address is truncated before it is stored — the last portion is removed so it cannot identify a specific connection — and the visitor identifier we generate is re-salted every day, so it cannot be used to follow you from one day to the next.
• With your consent only: Google Analytics and Google Ads cookies, which do use persistent identifiers. Nothing in this category is set until you accept.

We do not ask for, and you should not send us, sensitive personal data as defined in section 2 of the Act (such as health, biometric or political data).

• To answer your enquiry or arrange your appointment — necessary to take steps at your request before entering a contract (s.30(1)(b)(ii)).
• To provide sales, service, parts and warranty support — performance of our contract with you (s.30(1)(b)(i)).
• To keep the site secure and prevent form abuse — our legitimate interest in protecting the service, balanced against your rights (s.30(1)(b)(vii)).
• To send marketing, and to run analytics and advertising cookies — your consent (s.30(1)(a) and s.37). You may withdraw it at any time.
• To meet tax, warranty and statutory record-keeping duties — compliance with a legal obligation (s.30(1)(b)(iii)).

We do not sell personal data. We share it only with:

• Our customer relationship management provider, so that your enquiry reaches the right consultant and is not lost.
• Isuzu East Africa, where warranty registration, recall notification or a manufacturer service campaign requires it.
• Financing partners — banks, SACCOs and insurers — but only where you have asked us to arrange finance or insurance.
• Technology suppliers who host the website, send our email and provide analytics, acting as data processors under written instruction.
• Regulators, auditors or law enforcement, where we are legally required to.

Some of our processors — website hosting, email delivery and analytics — operate servers outside Kenya. Where personal data is transferred out of the country we rely on section 48 of the Act: the transfer is made subject to appropriate safeguards in our contract with the processor, or is necessary for the performance of a contract with you.

You may ask us for details of the safeguards applied to any particular transfer using the contact details in section 11.

• Enquiries that do not become sales: 24 months from last contact, then deleted.
• Customer and vehicle records: for the life of your relationship with us and 7 years afterwards, to meet tax and warranty obligations.
• Appointment records: 36 months, so service history remains available.
• Website interaction records: 14 months. These contain no direct identifiers.
• Job applications: 12 months, unless you ask us to keep your CV longer.

The site is served only over encrypted HTTPS connections. Form submissions are validated and rate-limited, and are written to our own database before being shared with any third party, so an enquiry cannot be lost in transit. Access to customer records is restricted to staff who need it for their role.

Where a personal data breach is likely to result in a real risk to your rights, we will notify the Office of the Data Protection Commissioner within 72 hours and inform you without undue delay, as section 43 requires.

Strictly necessary cookies keep the site secure and working; they cannot be switched off. Analytics and advertising cookies are set only after you accept them in the banner, and Google Consent Mode is set to deny everything until you do.

You can change your decision at any time by clearing this site's cookies in your browser, which will bring the banner back. Full detail is in our cookie policy.

Under Part V of the Act you have the right to:

• be informed of how we use your data — this notice;
• access a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted where we no longer have grounds to keep it;
• object to processing, including direct marketing, at any time;
• restrict processing while a dispute about accuracy or grounds is resolved;
• receive your data in a portable format; and
• withdraw consent at any time, without affecting processing already carried out.

We respond to requests within the statutory timeframe and do not charge for a first request.

We send marketing only to people who have opted in. Every marketing email carries an unsubscribe link, and you can reply STOP to any marketing SMS. You can also email info@tmd.co.ke and ask to be removed.

Opting out of marketing does not stop service messages about a booking or a vehicle you have bought from us — those are part of providing the service.

To exercise any right, or to raise a concern about how we handle personal data, contact our data protection contact:

• Email: info@tmd.co.ke
• Phone: 0800-720-797 (customer support line)
• Post: Data Protection Contact, Thika Motor Dealers (K) Ltd, Garissa Road, Thika Industrial Area, Thika, Kenya

If you are not satisfied with our response you may complain to the Office of the Data Protection Commissioner, Britam Tower, Hospital Road, Upper Hill, Nairobi — odpc.go.ke.

We review this notice at least annually and whenever our processing changes materially. The date at the top of this page shows when it was last revised. Material changes affecting how we use your data will be brought to your attention rather than published quietly.