Privacy Policy

For School Account Users

Effective Date: January 11th, 2025
Last Updated: March 17th, 2025

Table of Contents

1. Introduction & Overview

This Privacy Policy outlines how Safiri by Citrus ("the Platform") collects, processes, stores, and protects personal and other data from School account users. The purpose of this Policy is to ensure transparency in our data practices and to reaffirm our commitment to protecting the privacy of our users. This Policy complies with Kenyan data protection laws, including the Data Protection Act (2025), and any other applicable regulations. It applies exclusively to School account users, who utilize the Platform to streamline school transport management by efficiently managing student, parent, and driver profiles; configuring routes and schedules; and monitoring real-time transport activities, along with tools for fee management, communication, and safety tracking.

2. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

Personal Data
Any information relating to an identified or identifiable natural person, such as names, contact details, and identification numbers.
Processing
Any operation performed on personal data, whether automated or manual, including collection, storage, retrieval, use, alteration, disclosure, or deletion.
Data Subject
Any individual whose personal data is processed by the Platform.
Data Controller
Citrus Labs Limited, which determines the purposes and means of processing personal data.
Data Processor
Any third party engaged by Citrus Labs Limited to process personal data on its behalf.
Sensitive Data
Personal data that requires special protection under Kenyan law, such as biometric data or other information classified as sensitive.
Cookies
Small data files placed on a user's device to enhance user experience and track usage patterns.

3. Data Collection

Safiri by Citrus collects the following types of data from School account users:

Personal Information

Including but not limited to the school's name, administrator's full name, contact details (email address, phone number), and any identification or accreditation information provided during registration.

Usage Data

Information on how users interact with the Platform, such as login timestamps, session durations, activity logs, and feature usage.

Device Information

Data regarding the device(s) used to access the Platform, including IP address, device type, operating system, and browser information.

Cookies and Tracking Data

Information collected through cookies and similar technologies to enhance user experience and to analyze usage trends.

Sensitive Data

If applicable, any sensitive information provided will be processed with additional safeguards in accordance with Kenyan law.

Data is collected directly from users during registration and through automated collection tools integrated within the Platform.

5. Purpose & Use of Data

Data collected from School account users is used for:

Service Delivery

Enabling effective management of school transport operations, including administration of student, parent, and driver profiles; configuration of routes, schedules, and fee structures; and real-time monitoring of transport activities.

Customer Support

Providing technical support, troubleshooting, and assistance with Platform-related issues.

System Improvement

Analyzing usage data and feedback to continually enhance the Platform's functionality and user experience.

Security

Ensuring the security of the Platform by monitoring for unauthorized access, preventing fraud, and responding to incidents.

Marketing & Communication

Sending updates, notifications about new features, and promotional materials (only if users have consented to such communications).

Compliance

Meeting legal, regulatory, and contractual obligations.

6. Data Storage & Security Measures

Data Storage

Personal data is stored on secure, cloud-based servers managed by reputable third-party service providers that adhere to industry-standard security practices. Data retention periods are defined based on the purpose for which the data was collected and legal requirements.

Security Measures

The Platform implements robust security measures including:

  • Encryption

    All data is encrypted during transmission and at rest.

  • Access Controls

    Strict access controls and multi-factor authentication ensure that only authorized users can access personal data.

  • Regular Audits

    Periodic security audits and vulnerability assessments are conducted to detect and address potential risks.

  • Data Backup & Recovery

    Comprehensive backup procedures and disaster recovery plans are in place to prevent data loss.

7. Data Sharing & Third-Party Disclosures

8. User Rights

School account users have the following rights regarding their personal data:

Right to Access

The right to request access to the personal data held by Citrus Labs Limited.

Right to Rectification

The right to request correction of inaccurate or incomplete personal data.

Right to Erasure

The right to request deletion of personal data, subject to legal and contractual obligations.

Right to Restrict Processing

The right to request limitations on the processing of personal data under certain circumstances.

Right to Data Portability

The right to receive personal data in a structured, commonly used, and machine-readable format.

Right to Object

The right to object to the processing of personal data for reasons related to legitimate interests or direct marketing.

Users can exercise these rights by contacting Citrus Labs Limited using the details provided in Section 13.

9. Cookies & Tracking Technologies

Usage of Cookies

The Platform may use cookies and similar tracking technologies to enhance user experience, analyze usage patterns, and improve service functionality.

Management Options

Users can manage or opt out of cookies via their browser settings; however, disabling cookies may affect certain features of the Platform.

10. Data Breach Notification

Detection & Response

The Platform employs monitoring systems to promptly detect data breaches. In the event of a breach, Citrus Labs Limited will investigate and take remedial actions immediately.

Notification Procedures

Affected users will be notified of any data breach involving their personal data within a reasonable timeframe, and relevant regulatory authorities will be informed in accordance with Kenyan law.

Response Plan

A comprehensive breach response plan is maintained to mitigate harm and prevent future incidents.

11. Policy Updates

Amendments

Citrus Labs Limited reserves the right to update this Privacy Policy as necessary. Material changes will be communicated to users via email or through prominent notices on the Platform.

User Acceptance

Continued use of the Platform after updates constitutes acceptance of the revised Privacy Policy.

12. Contact Information and Complaints

For any questions, clarifications, or complaints regarding this Privacy Policy, please contact:

Email

legal@citruslabs.co.ke

Mailing Address

P.O. Box 23983 - 00100

Phone

+254 112 400 000

If you believe your personal data has been mishandled or wish to escalate a complaint, you may also contact the relevant data protection authority in Kenya.

13. Governing Law & Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of Kenya.

Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in Nairobi, Kenya.

By using the Safiri by Citrus School account, you acknowledge that you have read, understood, and agree to the collection, processing, storage, and use of your personal data as described in this Privacy Policy.