Privacy notice
What we collect through this website, why, who else sees it, and what you can ask us to do about it.
Last reviewed 28 September 2026
What this covers
This notice covers this website, nebsamdigital.com — the enquiry forms, the shop, and analytics.
It does not yet cover the tracking service itself: vehicle location data, in-vehicle and driver-facing video, or school bus attendance data. That processing is real, it is the larger part of what Nebsam does with personal data, and it is described in the contract and installation paperwork for each service rather than here. A separate service privacy notice is being prepared. Until it exists, ask Kelvin Oyugi directly — the contact details are at the bottom of this page — and you will get a straight answer.
Status of this document
This notice has not yet been through legal review. It was written by reading what the website actually does, line by line, so the descriptions of collection and storage below are accurate. What it does not do is assign a lawful basis to each purpose, or state retention periods — both are legal judgements rather than technical facts, and both are with the company’s adviser.
It is published rather than withheld because a site that collects personal data and offers no privacy information at all is the worse of the two, and because everything stated here is checkable.
Who we are
Nebsam Digital Solutions (K) Ltd is the data controller for the information described in this notice. Our registered address is Kiambu Road, Ridgeways — next to Impact Motors, Nairobi.
Nebsam registered with the Office of the Data Protection Commissioner as both a data controller and a data processor, with registrations effective from 27 May 2024 and valid to 27 May 2026. Renewal is in progress. We state the dates rather than claim a current registration, because a privacy notice is the last place to be imprecise about that.
What this website collects, exactly
Every field below is a field you type. The site does not collect anything about you in the background beyond what is described under analytics and security.
| Where | What it collects | What it is for |
|---|---|---|
| Contact form | Your name, phone number, optionally an email address, optionally a preferred branch, and your message | Replying to you |
| Quote request | Your name, phone number, optionally email, optionally your organisation, what you need, roughly how many vehicles, and your town | Preparing a quote and saying who would carry out the work |
| Installation booking | Your name, phone number, optionally email, what is being installed, optionally the vehicle, the town, and a preferred time | Arranging the appointment. It is a request, not a confirmed booking, until we confirm it |
| Suggestions | Your suggestion. Name, phone and email are optional, and if you tick “send anonymously” they are discarded before the record is written — not stored and hidden | Improving what we do |
| Placing an order | Your name, phone number, optionally your town, and what you ordered at the price shown | Fulfilling the order, and having a record of it if the WhatsApp conversation is lost |
Information collected for security
To stop a form being flooded automatically, we count how many submissions come from one network connection in an hour. Your network address is not stored in readable form — it is converted to a keyed fingerprint that exists only to make that count possible.
An anonymous suggestion stores no fingerprint at all. That is a deliberate trade: it means anonymous suggestions cannot be linked to each other or to a named enquiry from the same person, which is what the anonymous option promises.
Who else handles this information
We do not sell information about you, and we do not share it for advertising.
| Who | What they handle | Where |
|---|---|---|
| Supabase | The database and file storage behind this website — enquiries and orders | Hosted outside Kenya. [[NEEDS_VERIFICATION: confirm the Supabase project region and the transfer basis relied on under DPA 2019 Part VI]] |
| Cloudflare | The check that a form is submitted by a person rather than a script | Global network |
| Analytics — only if you accept them | Global network | |
| Meta (WhatsApp) | The chat itself, once you choose to message us. Anything you send in that conversation is governed by WhatsApp’s own terms as well as ours | Global network |
How long we keep it
The security counts described above are deleted automatically after 24 hours, because that is longer than any limit they enforce and there is no reason to keep them.
[[NEEDS_VERIFICATION: retention periods for enquiries, quotes, installation bookings and orders — each needs a stated period and a reason, confirmed with the company’s legal adviser]]
Until those periods are settled, we keep enquiry and order records for as long as needed to deal with the enquiry and to meet our record-keeping obligations, and no longer than that. If you want yours deleted sooner, ask — see below.
Your rights
Under the Data Protection Act 2019 you have the right to:
- be told what personal data we hold about you, and get a copy of it;
- have inaccurate data corrected;
- have data deleted, where we have no continuing reason to keep it;
- object to processing, and to ask us to restrict it while an objection is considered;
- withdraw consent where processing relies on it — declining analytics is one example;
- complain to the Office of the Data Protection Commissioner.
Ask Kelvin Oyugi using the details below. We will not charge you for a request and we will not ask why you are making it. If you are not satisfied with how we respond, you can complain to the Office of the Data Protection Commissioner directly — you do not need our permission or involvement to do that.
Contacting us about your data
Kelvin Oyugi
info@nebsamdigital.com
+254 759 000111
Kiambu Road, Ridgeways — next to Impact Motors, Nairobi
Cookies and analytics are covered separately in the cookie notice.