Ingress Privacy Policy

Last Updated: August 26, 2026

1

Introduction and Our Role

Ingress Platform provides a cloud-based SaaS platform for motor vehicle insurance intermediaries in Kenya. Under the Kenya Data Protection Act, 2019, we act strictly as a Data Processor for insurance data uploaded by insurance intermediaries. This policy explains how we handle your personal information when you use our platform to obtain motor vehicle insurance certificate.

2

Personal Information We Process

When you use our platform, we process identification information such as full name, National ID number and KRA PIN; vehicle details such as registration number, make, model, and year of manufacture; policy details such as policy number, coverage period, and premium; and contact information such as phone number for the purpose of issuing motor vehicle insurance certificates. We do not process health records, biometrics, or sensitive personal data.

3

How We Use Your Information

We process your data exclusively to issue motor vehicle insurance certificates via the DMVIC and insurer underwriting systems, and comply with applicable regulatory obligations under the Insurance Act. We do not use your data for marketing or any unrelated purpose.

4

Data Sharing and Disclosure

We share your data only with insurers for underwriting, the Association of Kenya Insurers (AKI) for DMVIC certificate integration (necessary for providing the service), NTSA for vehicle details queries, KRA for policyholder verification queries, and payment service providers such as Safaricom for payment verification. All recipients are bound by their own obligations under the Kenya Data Protection Act, 2019, and ODPC regulations. We do not share your data with regulatory authorities unless required or compelled by law. We do not sell or share your data for marketing.

5

International Data Transfers and Our Data Protection Status

Our platform is hosted on cloud infrastructure that may involve data transfer outside Kenya. Any such transfer is conducted in strict compliance with the Kenya Data Protection Act, 2019, and implements appropriate safeguards such as ODPC-approved Standard Contractual Clauses. The Ingress platform is owned and operated by CynotKenya, which is duly licensed as a Data Processor by the Office of the Data Protection Commissioner (ODPC).

6

Data Retention and Deletion

We retain your data for as long as necessary to provide our services and in accordance with ODPC regulatory requirements. Upon expiry of the applicable retention period, we securely delete or anonymize your data automatically. Agencies may request earlier deletion if needed, and we will honor such instructions. Please direct any access, correction, or deletion requests to your insurance agency — they are the Data Controller responsible for your data, and we will assist them in fulfilling your requests.

7

Information Security

We protect your data with encryption in transit and at rest, strict role-based access controls on a need-to-know basis, and continuous security monitoring with audit logging of all data access.

8

Updates to This Policy

We may update this policy periodically. Material changes will be communicated via a notification on our platform.

9

Contact Us

For questions about how we process your data, contact our Data Protection Officer at: Email: oduori@cynotkenya.com, Phone: +254798606324.

Data Protection Consent

By accessing or using the Ingress platform, you acknowledge and agree to the data practices and processing roles outlined in this Privacy Policy.

Questions? Contact us at oduori@cynotkenya.com