Privacy Policy

BidLot (“BidLot”, “we”, “us”, or “our”) operates the online vehicle-auction marketplace at bidlot.africa and its associated mobile applications (together, the “Platform”). The Platform connects sellers (including individuals, dealers, fleets, banks, and insurers) with buyers across Kenya.

The data controller responsible for your personal data is [Registered legal entity name], a company registered in Kenya, of [registered physical address], registered with the Office of the Data Protection Commissioner (“ODPC”) under registration number [ODPC registration number].

We process personal data in accordance with the Kenya Data Protection Act, 2019 and its accompanying regulations.

Depending on how you use the Platform, we may collect:

• Account & contact data: name, email address, phone number, password (stored only in hashed form), and your role (buyer, seller, or both).
• Identity & verification data (KYC/KYB): government ID details, a selfie/liveness image, business registration number, KRA PIN, and related documents, which we verify through our identity-verification provider. This may include data treated as sensitive under the Data Protection Act.
• Seller & listing data: vehicle details you submit (including VIN, registration number, photos, condition, documents such as logbooks), your bank or M-Pesa payout details, and your declared sale terms.
• Transaction & bidding data: deposits, bids, proxy/maximum bids, purchases, promotions, invoices, and counter-offers.
• Payment data: M-Pesa phone numbers and transaction references used to take deposits and payments and to make payouts. We do not store full card details.
• Location data: a collection or yard location you provide, and approximate GPS coordinates if you choose to auto-detect a location.
• Technical & usage data: IP address, device and browser information, pages and lots viewed, search queries, and similar analytics collected via cookies and similar technologies.
• Communications: messages, support requests, and feedback you send us.

We use your personal data to:

• create and administer your account and verify your identity (KYC/KYB);
• operate the auctions — list vehicles, run bidding, hold deposits, process payments and payouts, and settle sales;
• prevent fraud, shill bidding, money laundering, and other prohibited activity, and to meet our legal and regulatory obligations;
• provide customer support and respond to your enquiries;
• send you service messages (e.g. bid, deposit, KYC, and payment notifications) and, where permitted, marketing about the Platform;
• improve, secure, and develop the Platform, including analytics and decoding VINs to pre-fill vehicle details; and
• enforce our terms and resolve disputes.

Our lawful bases for processing include: performance of a contract with you, compliance with a legal obligation, your consent (which you may withdraw), and our legitimate interests in running a safe, fraud-resistant marketplace.

We do not sell your personal data. We share it only as needed to run the Platform, with:

• Other users, to a limited extent: a seller’s display name and verification status, and a vehicle’s listing details, are shown to buyers. Bidder identities are shown only in anonymised form during live bidding.
• Service providers (processors) who act on our instructions, including: our identity-verification partner (KYC/KYB), Safaricom M-Pesa and other payment processors, VIN-decoding providers, cloud hosting and infrastructure providers, and email/SMS delivery and analytics providers.
• Authorities and advisers where required by law, court order, or regulator, or to establish, exercise, or defend legal claims, or to protect the rights, safety, and property of BidLot, our users, or the public.
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

Some of our service providers process data on servers located outside Kenya. Where we transfer personal data outside Kenya, we do so in accordance with the Data Protection Act — for example, on the basis of appropriate safeguards, your consent, or because the transfer is necessary to perform our contract with you. You may contact us for details of the safeguards in place.

We keep personal data only for as long as necessary for the purposes above, including to satisfy legal, tax, accounting, anti-money- laundering, and dispute-resolution requirements. Transaction, KYC, and payment records are typically retained for the periods required by Kenyan law after your last activity, after which they are deleted or anonymised.

We use technical and organisational measures to protect your data, including encryption in transit, hashing of passwords and sensitive fields, access controls, and monitoring. No system is perfectly secure, but we work to safeguard your information and will notify you and the ODPC of a personal-data breach where the law requires.

Under the Kenya Data Protection Act, 2019 you have the right to:

• be informed of how your data is used;
• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data where the law allows;
• object to, or request restriction of, certain processing;
• withdraw consent at any time, without affecting prior processing;
• data portability where applicable; and
• lodge a complaint with the Office of the Data Protection Commissioner.

To exercise any of these rights, contact us using the details below. To delete your data and close your account, you can use our data-deletion request page. We may need to verify your identity before acting on a request, and we will respond within the timeframes set by law. Note that some data (for example, KYC and transaction records) must be retained even if you ask us to delete it.

We use automated tools as part of identity verification and fraud-prevention (for example, liveness and document checks, and buying-power and bid-eligibility checks). These help keep the marketplace safe. You can contact us if you believe an automated decision has affected you unfairly, and a member of our team will review it.

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Platform, and understand how it is used. You can control cookies through your browser settings; disabling some cookies may affect how the Platform works.

The Platform is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you. Your continued use of the Platform after an update means you accept the revised policy.

For any privacy question or to exercise your rights, contact our Data Protection Officer:

• Email: [privacy@bidlot.africa]
• Phone: [DPO phone number]
• Address: [registered physical address]

You also have the right to complain to the Office of the Data Protection Commissioner (Kenya) at www.odpc.go.ke.