1. Information We Collect

a. Personal Information

• Name, email address, and phone number
• Company details and job title
• Login credentials (username and encrypted password)

b. Device & Technical Information

• Device identifiers (IMEI, device model, operating system version)
• IP address and network data (mobile data, Wi-Fi)
• Bluetooth device interactions

c. Location Data

• Real-time GPS location for field sales tracking and activity logging

Location data is collected only while the mobile application is active and the tracking feature is enabled by your organisation.

d. Usage Data

• App usage behaviour, logs, and diagnostics

2. How We Use Your Information

• Provide, maintain, and improve the Service
• Track sales activities and optimise performance
• Enhance user experience and system functionality
• Ensure security, prevent fraud, and protect against misuse
• Comply with legal and regulatory obligations
• Respond to your enquiries and support requests

3. Lawful Basis for Processing

Under the Kenya DPA, we process personal data on one or more of the following lawful bases:

• Performance of a contract or steps prior to entering into a contract
• Compliance with a legal obligation
• Legitimate interests pursued by Ethos Sales Drive or a third party
• Protection of vital interests of the data subject
• Consent of the data subject (where required)

4. Data Sharing

We do not sell your personal data. We may share data with:

• Authorised business users within your organisation
• Service providers and infrastructure partners who assist us in operating the Service
• Legal authorities when required by law or to protect our rights

Where we share data with third-party service providers, we ensure appropriate data processing agreements are in place.

5. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law. When data is no longer needed, we securely delete or anonymise it in accordance with our data retention policy.

6. Security

We implement appropriate technical and organisational security measures to protect your data, including encryption in transit and at rest, role-based access control, monitoring systems, audit logging, and staff confidentiality obligations. These measures are designed to ensure a level of security appropriate to the risk.

7. Cross-Border Data Transfers

Where personal data is transferred outside Kenya, we ensure that the transfer is carried out in accordance with Section 48 of the Kenya Data Protection Act, 2019, which requires one of the following:

• Proof that the receiving country has adequate data protection laws
• Appropriate safeguards, such as standard contractual clauses or binding corporate rules
• The explicit consent of the data subject
• Necessity for the performance of a contract or other legal grounds

For transfers of EEA personal data outside the EEA, we rely on the European Commission's adequacy decisions or Standard Contractual Clauses, together with supplementary technical and organisational measures where required.

8. Your Rights

Subject to applicable law, you have the following rights:

• Right to be informed about how personal data is used
• Right of access to personal data we hold
• Right to rectification of inaccurate or incomplete data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing, including direct marketing
• Right not to be subject to automated decision-making, including profiling
• Right to withdraw consent at any time, where processing is based on consent
• Right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya

To exercise any of these rights, please contact us using the details in Section 11.

9. Data Breach Notification

In the event of a personal data breach, we will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware of the breach, where required by the Kenya Data Protection Act, 2019. We will also notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Where EEA personal data is affected, we will also comply with the breach notification obligations under the GDPR.

10. Our Role as Data Processor

To the extent we process personal data on behalf of your organisation (e.g., your customers' contact information, your employees' location data), we act as a Data Processor under the Kenya Data Protection Act, 2019. In this role, we process personal data only on your documented instructions and implement appropriate security measures. Your organisation remains the Data Controller and is responsible for ensuring it has a lawful basis for the processing, including obtaining any necessary consent from employees for GPS tracking.

11. Contact Us

For any questions, requests, or complaints regarding this Privacy Policy or the processing of your personal data, please contact:

Email: info@ethostechhub.com

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya if you believe your data protection rights have been infringed.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised effective date. We encourage you to review this page periodically.