INCHCAPE KENYA WEBSITE PRIVACY NOTICE

LAST UPDATED: 18TH MARCH 2026

1. Introduction

Inchcape Kenya Limited is an automotive distribution, retail, and services company based in Nairobi Kenya. The Company is an affiliate of Inchcape Plc which is headquartered in London, United Kingdom and which has operations in more than 40 countries across Asia, Australia, Europe, Africa and South America. 

Inchcape Kenya operates as the official distributor for Jaguar Land Rover and BMW, BMW Motorrad, Changan, and New Holland. Our registered office Inchcape Kenya Limited, Lusaka Road, Industrial Area, LR209/7362 P.O Box 2231-00606, Nairobi, Kenya. 

To perform our functions, we collect personal data from customers, and website users and members of the public (referred to as “you” or “your” in this Privacy Notice). Also when you use our services and interact with us and our Brands, websites, brands, mobile applications, social media pages, branded pages on third-party platforms (for example Facebook or Instagram), applications accessed or used through third-party platforms, our recruitment or job application channels or other sites that display this Privacy Notice (collectively, our “Sites”) we may process your Personal Data. Whilst doing so, be assured we take your rights to privacy very seriously.  

Respecting your privacy is at the core of how we interact with you, so you can enjoy your interaction with Inchcape Kenya Limited, our Brands and our Sites whilst knowing your Personal Data is always processed lawfully and in accordance with the principles of transparency, respect, trust and fairness.  

2. Purpose of this Notice

This Privacy Notice applies to Inchcape Kenya and its sites users that is our customers/clients and members of the public who interact with our sites.  For avoidance of doubt, if you are an Inchcape Kenya employee/ you should refer to Company’s Employee Privacy Policy which is available in the Company’s Intranet. 

We are a data “Controller” for the purposes of the (EU) General Data Protection Regulation 2016/679 (the "GDPR") and the Data Protection Act 2019 and the Data Protection (General) Regulations,2021 (collectively referred to as the "Data Protection Laws"). 

Inchcape Kenya is the Controller of the Personal Data which we collect on the https://inchcape.co.ke/ and https://inchcapetanzania.co.tz/  websites, the  Original Equipment Manufacturers are the controllers of Personal Data which we collect on https://www.jaguar-kenya.com/ ,https://www.landroverkenya.com/ and https://www.bmw.co.ke/ websites while Inchcape Plc and Inchcape Kenya are jointly the controllers of the Personal Data which we collect on https://www.changan.co.ke/, https://www.changan.co.ug/  and https://www.changan.co.tz/  websites 

 In this Privacy Notice you will find an overview of what Personal Data we collect in connection with our brands and the use of our Sites, how we collect and process your Personal Data, the purposes for which we process it, how long we keep your personal data, when, why and with who we will share your personal data, what your rights are, the legal basis we have for using your personal data, how we may contact you and how you can contact us.  

3. What Personal Data we collect and what we use it for

Personal data is any information that can identify an individual directly or indirectly. For the purpose of this policy this definition includes data collected when you interact with us online through our Sites or via our authorized parties such as our online support helpline where you can raise questions, queries and concerns directly to us. Therefore, we may collect your Personal Data from a variety of sources. We endeavor to only collect Personal Data that is necessary for the purpose(s) for which it is collected and to retain such data for no longer than necessary for such purpose(s). Subject to applicable law and practice, the categories of Personal Data that are typically collected and processed are: -

a. Personal Data you provide to us directly.

Some automatically collected information may not directly identify you by name, however it may do so indirectly (for example your internet protocol (IP) address may point uniquely to you). For this reason, some automatically collected information is Personal Data under Data Protection Laws.  This information is automatically collected using cookies, pixel, web beacons and similar data collection technology (collectively known as “Data Collection Technology”) when your web browser accesses our Sites or advertisements and other content served by or on behalf of us on other websites. 

To find out more about what Data Collection Technology we use, kindly check our Cookie Notice. We may automatically collect certain information from your computers and mobile devices or via other means where required. For example: - 

We also collect, use and share aggregated data such as statistical or demographic data which is not Personal Data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' usage data to calculate the percentage of users accessing a specific Site in order to analyze general trends in how users are interacting with our Site to help improve the Site and our product offerings. 

c.  Personal Data we collect from other sources 

We may collect Personal Data from other sources including: - 

 
i. our trusted partners’ third-party platforms where we operate Sites (for example, when you use the "like" functionality on Facebook or the +1 functionality on Google+);

ii. advertising partners (for example we receive information about you and other visitors' interactions with our advertising to measure whether our advertising is relevant and successful)

ii. from social media (such as X or Instagram)

4. Lawful basis for processing your Personal Data  

Data Protection Laws require us to have a legal basis for collecting and using your Personal Data. We rely on one or more of the following legal basis: - 

5. How we use your Personal Data 

• To authenticate the identity of individuals interacting with us online or contacting us by telephone or electronic means. This processing is necessary to meet our and your legitimate interests in complying with our legal responsibilities as a business (e.g. in relation to health and safety and the prevention of crime).  

• For internal training and quality assurance purposes. The processing is necessary to meet our and your legitimate interests in providing a reliable and responsible service to you. 

• To handle the necessary contact information regarding our customers and suppliers. This processing is necessary for our legitimate interests to keep our records updated and manage our relationship with customers and suppliers 

• To provide personalized communications and targeted advertising as well as product recommendations. This processing is necessary for our legitimate interests (to carry out direct marketing, develop our brands and/or services and grow our business and having obtained your prior consent to receive direct marketing communications. 

• To process and respond to your inquiries, suggestions or registration requests, via our Sites, e-mail, social media or our customer care services. This processing is necessary to meet our and your legitimate interests in dealing with complaints and consumer issues, our legal obligations as a and in relation to certain registration requests, we will request your consent.  

• To develop and improve our services, our communication methods and the functionality of our Sites and online channels. This processing is necessary for our legitimate interests to study how consumers use our brands and/or services, to develop them, to grow our business and to inform our marketing strategy. 

• For the purposes of competitions or promotions that you have entered. This processing is necessary to meet our and your legitimate interests in handling your participation in competitions and events and the performance of our “contract” with you when you enter the competition and/or the event (e.g., the terms and conditions) and having obtained your prior consent to receive direct marketing communications. 

When we collect and use your Personal Data for any other purposes, we will inform you before or at the time of collection. We also create profiles by analyzing the information about your online surfing, searching behavior and your interactions with our brand communications by building segments (creating groups that have certain common characteristics) and by placing your Personal Data in one or more segments. For more information on this, see "Profiling" below. 

6. Profiling 

As a Company with an online presence, we use your Personal Data to build profiles. We create profiles by analyzing information about your online surfing, searching behavior and your interactions with our brand communications by building segments (creating groups that have certain common characteristics) and by placing your Personal Data in one or more segments. These segments are used by us to personalize the website and our communications to you (such as showing relevant content to you when you visit our sites or in a newsletter to you) and to display relevant offers and advertisements from our Brands on our Sites, and via third-party websites. The segments can also be used for third-party campaigns on our Sites or third-party websites.   

We profile your Personal Data using cookies where you have provided consent for us to do so; for example, accepting the setting of cookies on your browser online. For more information, see our Cookie Notice which is available on all our sites. 

If you have asked to receive emails or SMS communications from us, we track whether you open, read or click on the content to see what you are interested in so that we can give you more content that we think you are more likely to enjoy. You can block cookies at any time by activating the setting on your browser that allows you to refuse some or all cookies. However, if you do block cookies there may be parts of our website that you will be unable to access or that will not function properly. 

7. Subscribing and Unsubscribing To Our 1direct Marketing Messages

For any promotional emails from us, during the registration process on our Sites when your Personal Data is collected, you will be asked to indicate your preferences for receiving direct promotional communications and we will request your explicit consent to send them. You can ask us to stop sending you promotional communications at any time by following the opt-out links within any marketing communication sent to you via email or SMS. If you opt out of receiving promotional communications, you will still receive service-related communications that are essential for administrative or customer service purposes. 

Further, if you do unsubscribe, please note that we will still keep your email and phone number in a separate secure list so that we can make sure that you do not receive our marketing communications again in the future. 

8. Who Do We Share Your Personal Data with? 

We do not sell or trade your Personal Data to third parties. However, where appropriate for us to conduct our business or fulfil our commitments to you., we may share your personal data in various ways and for various reasons with: – 

• appropriate personnel within the company 

• third-party service providers who perform functions on our behalf including IT systems providers and our marketing consultants 

where we share your data, we ensure that there are appropriate data processing or data sharing agreements (or similar protections) in place that guarantees the security and privacy of your shared Personal Data.  

9. International Data Transfers 

Your Personal data may be transferred and processed to 

• our website service providers 

• our cloud-based system service providers 

• other third parties who perform functions on our behalf including IT systems providers and our marketing consultants who may utilize servers located outside Kenya. 

We will only transfer your personal data outside Kenya where such transfer is compliant with the Data Protection Laws to safeguard your privacy rights and to provide you with remedies in the unlikely event of a security breach.   

To ensure that your personal data receives adequate levels of protection, we shall put in place appropriate procedures with our third-party service providers whom we share your personal data with to ensure that your personal information is treated by those third parties in a way that is consistent with, and which respects the data protection laws. 

10. How Do We Safeguard Your Personal Data? 

We take the security of your Personal Data very seriously. Inchcape Kenya has taken appropriate technical, administrative, and procedural security measures, consistent with local and international information practices and regulations, to protect the personal data from misuse, unauthorized access or disclosure, loss, alteration, or destruction. These measures include: 

• Technology safeguards, such as use of anti-virus and firewall, passwords, and monitoring of our systems to ensure compliance with our security policies.  

• Other measures include implementing appropriate access controls, investing in the latest information security capabilities to protect the IT environments we leverage, and ensuring we encrypt, pseudonymize or anonymize Personal Data wherever possible.  

• Organizational safeguards, through training and awareness programs on security and privacy, to ensure employees understand the importance and means by which they must protect personal data, as well as through data protection and security policies and Notice standards that govern how Inchcape Kenya treats personal data. 

• Access to your Personal Data is only permitted among our employees, partners and agents on a need-to-know basis and subject to strict contractual obligations regarding both confidentiality and data privacy when processed by Data Processors.  

If you suspect any misuse or loss of or unauthorized access to your personal data, please let us know immediately by sending us an email on enquirieske@inchcape.co.ke  

11. For How long do we keep your Personal Data?  

We only retain your Personal Data for as long as we need it for the purpose for which it was collected or as otherwise required by Data Protection Laws. Your Personal Data will be securely destroyed after the expiry of the applicable retention period. To determine the appropriate retention period for your Personal Data, we consider the amount and nature of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. Furthermore, we may retain your Personal Data for a longer period than indicated below in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. Please refer to the specific retention period for each category of Personal Data: 

12. What Rights Do You Have Over Your Data? 

The Data Protection Act, 2019 accords you with several rights over your data. You can exercise these rights at any point. We have provided an overview of these rights below together with what this entails for you.  You can exercise your rights by sending an to our Data Protection Officer (DPO) on changan@inchcape.co.ke   or submitting a request through the “Contact Us” form on our websites.  

You have the following rights in relation to your Personal Data:  

• Right Information, Rectification and Access: You have the right to access, correct or update your Personal Data at any time. For rectification, this enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. If you request access, where feasible and permitted by Data Protection Laws, we will provide a copy of the Personal Data we are processing. The Personal Data shall be provided in electronic form.  

• Right to Deletion: You have the right to request deletion of your Personal Data. However, this right may not apply if we are permitted to retain your Personal Data in accordance with Data Protection Laws for the purposes of i) exercising the right of freedom of expression and information ii) compliance with a legal obligation which requires processing by a law to which we are subject iii) the performance of a task carried out in the public interest and iv) the establishment, exercise or defense of our legal rights.  

• Right to Portability: The right to data portability. The Personal Data you have provided us with is portable. This means it can be moved, copied or transmitted electronically under certain circumstances. You also have the right, where technically possible, to have personal data transmitted directly from us to another data controller or data processor. However, if the lawful basis that we rely upon for the processing of your Personal Data is to pursue our legitimate interests or if your Personal Data has been anonymized or pseudonymize then the right to data portability does not apply.  

• Right to Restriction & Objection: Under certain circumstances, you have the right to restrict or object to certain types of processing, including processing for direct marketing (i.e., receiving marketing emails from us or being contacted about potential opportunities, events and promotions). If you have given your consent to anything we do with your Personal Data you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your Personal Data with your consent up to that point is unlawful). You can withdraw your consent to the processing of your Personal Data at any time by contacting us with the details provided below.
• Right to automated decision making: You have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning or that significantly affects you. Inchcape Kenya may from time to time make decisions based on the automated processing of your personal data. In such instances, you will be informed, in writing, whenever a decision based on automated processing is taken. In addition, you can request us to reconsider any decisions made based on automated processing or to take a new decision that is not based solely on automated processing.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Please be aware that there are exceptions and exemptions that apply to some of these rights, which we will apply in accordance with the Data Protection Laws.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

13. What Are Your Responsibilities 

You are responsible for the information you make available to Inchcape Kenya, and you must ensure it is accurate, honest, truthful, and not misleading in any way. You must ensure that the information does not contain material that is obscene, defamatory, or infringing on any rights of any third party. 

Further, if you provide any information concerning any other person, for example if you provide your spouse’s details in connection with the purchase of a vehicle, you are responsible for providing any notices and obtaining any consents necessary for Inchcape Kenya to collect and use that information. 

14. Notice Updates 

We will update this Privacy Notice when necessary to reflect feedback, changes in our products or changes in Data Protection Laws. When we post changes to this Privacy Notice, we will revise the "last updated" date.   

If the changes are significant, we will provide a more prominent notice (including, potentially email notification of Privacy Notice changes).  

15. Complaints 

It is important that you ensure you have read this Privacy Notice. If you do not think that we have processed your Personal Data in accordance with this Privacy Notice, you should let us know as soon as possible. If you have any questions or complaints about the processing of personal data, you can contact our Data Protection Officer on the following email address changan@inchcape.co.ke  

You can also write a letter addressed to:

The DPO
Inchcape Kenya Limited,
Lusaka Road, Industrial Area,
LR209/7362
P.O Box 2231-00606,
Nairobi , Kenya.