Legal
This Privacy Policy explains how Kora Fleet Technologies collects, uses, stores, and protects personal data in connection with the Kora Fleet Management System. We are committed to compliance with the Kenya Data Protection Act 2019 and applicable international privacy standards.
Effective 14 March 2026
Kora Fleet Technologies ("Kora", "we", "us", "our") operates a multi-tenant SaaS fleet management platform used by transport companies, fleet operators, and logistics businesses ("Customers") across Kenya and the East African region. In delivering our services, we process personal data relating to Customer employees, drivers, mechanics, and other personnel.
This Policy applies to all data processed through the Kora Fleet Management System, including the Workspace App, Field App (mobile PWA), Platform Console, and all associated APIs. It should be read together with our Terms of Service.
Customers who process personal data through Kora act as data controllers in respect of their personnel and operational data. Kora acts as a data processor on behalf of those Customers, and as a data controller in respect of platform-level administrative data.
2.1 Kora as Data Controller
Kora is the data controller for: account registration data for company administrators; billing and subscription records; platform usage analytics and audit logs; marketing communications and enquiry submissions; and platform-level personnel records for Kora's own staff.
2.2 Kora as Data Processor
For all Operational Data submitted by a Customer — including personnel profiles, trip records, fuel logs, maintenance records, payroll data, and driver activity — Kora acts as a data processor. The Customer is the data controller and determines the purposes and means of processing. Customers must ensure they have a lawful basis to submit their personnel's personal data to Kora and must provide adequate notices to their data subjects.
2.3 Data Processing Agreement
By accepting the Terms of Service, Customers enter into a Data Processing Agreement (DPA) with Kora, the terms of which are incorporated into this Policy. The DPA satisfies the written contract requirements of Section 43 of the Kenya Data Protection Act 2019. Customers requiring a standalone signed DPA should contact legal@korafleet.com.
3.1 Account & Registration Data
3.2 Personnel Data (submitted by Customers)
3.3 Operational Data (submitted by Customers)
3.4 Usage & Technical Data
3.5 Communications Data
Under the Kenya Data Protection Act 2019, we process personal data on the following legal bases:
Customers are responsible for identifying and documenting their own legal basis for processing their personnel's data on the Kora platform.
5.1 Service Delivery
We use personal data to create and maintain company accounts; authenticate and authorise users; process trip dispatch, fuel records, and maintenance workflows; generate invoices and financial reports; and send critical service notifications such as security alerts, billing reminders, and subscription status changes.
5.2 Fraud & Anomaly Detection
Kora's fuel anomaly detection engine analyses fuel fill records against vehicle specifications and historical patterns to flag potential siphoning, over-reporting, or mileage discrepancies. This processing is carried out on behalf of the Customer to protect the Customer's operational integrity. Flagged anomalies are surfaced to Customer administrators only and are not disclosed to third parties.
5.3 Billing & Payments
Subscription billing data is used to generate invoices, apply M-Pesa Paybill payments, and maintain billing history. Payroll disbursement data (M-Pesa phone numbers) is used solely to facilitate B2C transfers instructed by the Customer.
5.4 Security & Audit
We maintain audit logs of significant platform actions — account creation, data mutations, admin actions, and access events — to detect security incidents, investigate complaints, and comply with regulatory requirements. Kora staff access to Customer Operational Data is restricted to support, security incident response, and legal compliance scenarios, and is logged.
5.5 Platform Improvement
Anonymised, aggregated, and non-identifiable usage data may be used to improve platform features, optimise performance, and inform product development. No individual Customer's data is disclosed in such analytics.
Kora integrates with Safaricom's M-Pesa Daraja API for two payment flows: Paybill C2B (Customer subscription payments) and B2C (Customer-instructed driver/personnel payouts). The following applies specifically to M-Pesa data handling:
Drivers, mechanics, dispatchers, and other fleet personnel whose data is held on the Kora platform are data subjects. Their personal data is submitted and controlled by their employer (the Customer). Kora processes this data as a data processor under the Customer's instruction.
Personnel wishing to exercise data subject rights (access, correction, deletion, or portability) should contact their employer directly. Kora will support Customers in fulfilling valid data subject requests within 30 days of written notice.
Where a Customer's account is suspended or terminated and not renewed, personnel data is retained for 30 days for export. After that window, data is permanently deleted subject to any mandatory regulatory retention obligations.
Personnel data — including national ID numbers, phone numbers, and financial information — is stored with field-level access controls. Kora staff cannot read plaintext sensitive fields except through audited administrative tooling used solely for support and compliance purposes.
9.1 Operational Data
Customer Operational Data (trips, fuel logs, maintenance records, payroll records) is retained for the life of the Customer's active subscription. Upon account termination, data is retained for 30 days in a read-only state for export. After 30 days, data is permanently deleted from active storage. Certain financial transaction records may be retained for up to 7 years to satisfy Kenya Revenue Authority requirements.
9.2 Audit Logs
Audit logs and activity trails are retained for a minimum of 12 months and may be retained for up to 7 years where required by applicable law. Audit logs are not accessible to Customer users but are available to Kora's compliance team and may be produced in response to lawful regulatory requests.
9.3 Account Data
Company administrator credentials and account registration data are deleted 30 days after account termination. Billing records and subscription history are retained for 7 years for accounting and tax compliance.
9.4 Requesting Deletion
Customers may request immediate deletion of their Operational Data (outside the standard 30-day post-termination window) by writing to privacy@korafleet.com. Deletion requests will be actioned within 14 days, subject to any mandatory retention obligations. A deletion confirmation will be issued in writing upon completion.
Kora implements technical and organisational security measures proportionate to the sensitivity of the data processed:
Despite these measures, no internet-based service can guarantee absolute security. In the event of a personal data breach affecting Customers, Kora will notify affected Customers without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with Section 43(3) of the Kenya Data Protection Act 2019.
Individuals whose personal data is controlled by Kora (primarily company administrators) have the following rights under the Kenya Data Protection Act 2019:
To exercise any of these rights, contact privacy@korafleet.com. We will respond within 30 days. If you believe your rights have not been respected, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) Kenya at www.odpc.go.ke.
Personnel wishing to exercise rights in respect of data held by their employer on the Kora platform should contact their employer directly, as the employer is the data controller for that data.
Kora's infrastructure relies on cloud providers that may process data outside Kenya, including in the United States and European Union. Such transfers are subject to appropriate safeguards including Standard Contractual Clauses (SCCs) and data processing agreements with each provider as referenced in Section 6.1.
Kora takes reasonable steps to ensure that any international transfer of personal data provides a level of protection consistent with the requirements of the Kenya Data Protection Act 2019. Customers with specific data residency requirements should contact us to discuss available options before subscribing.
The Kora Service is designed for use by businesses and professional fleet operators. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor's data has been submitted to the platform, please contact privacy@korafleet.com and we will take prompt action to delete it.
We may update this Privacy Policy from time to time to reflect changes in our data practices, technology, or applicable law. Material changes will be communicated to company administrators by email at least 14 days before the effective date. The updated Policy will be published at korafleet.com/privacy with a revised effective date.
Continued use of the Service after the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not agree to the revised Policy, you must cease using the Service and contact us to arrange data deletion.
For all privacy-related enquiries, data subject rights requests, breach notifications, or DPA queries, contact our Data Protection Officer:
If you are a Customer with a support query unrelated to data protection, contact support@korafleet.com. If you are a member of the press or a regulatory authority, contact legal@korafleet.com.
For complaints that remain unresolved after contacting us, you may refer the matter to the Office of the Data Protection Commissioner (ODPC) Kenya.
