Inchcape Kenya - New Holland Website Privacy Notice

LAST UPDATED: 05TH AUGUST 2025

 

1. Introduction

Inchcape Kenya Limited is an automotive distribution, retail, and services company based in Nairobi Kenya. The Company is an affiliate of Inchcape Plc which is headquartered in London, United Kingdom and which has operations in more than 40 countries across Asia, Australia, Europe, Africa and South America. 

 

Inchcape Kenya operates as the official distributor for Jaguar Land Rover and BMW, BMW Motorrad, Changan, and New Holland. Our registered office Inchcape Kenya Limited, Lusaka Road, Industrial Area, LR209/7362 P.O Box 2231-00606, Nairobi, Kenya. 

To perform our functions, we collect personal data from customers, and website users and members of the public (referred to as “you” or “your” in this Privacy Notice). Also when you use our services and interact with us and our Brands, websites, brands, mobile applications, social media pages, branded pages on third-party platforms (for example Facebook or Instagram), applications accessed or used through third-party platforms, our recruitment or job application channels or other sites that display this Privacy Notice (collectively, our “Sites”) we may process your Personal Data. Whilst doing so, be assured we take your rights to privacy very seriously.  

Respecting your privacy is at the core of how we interact with you, so you can enjoy your interaction with Inchcape Kenya Limited, our Brands and our Sites whilst knowing your Personal Data is always processed lawfully and in accordance with the principles of transparency, respect, trust and fairness.  

  

2. Purpose of this Notice

This Privacy Notice applies to Inchcape Kenya and its sites users that is our customers/clients and members of the public who interact with our sites.  For avoidance of doubt, if you are an Inchcape Kenya employee/ you should refer to Company’s Employee Privacy Policy which is available in the Company’s Intranet. 

 

We are a data “Controller” for the purposes of the (EU) General Data Protection Regulation 2016/679 (the "GDPR") and the Data Protection Act 2019 and the Data Protection (General) Regulations,2021 (collectively referred to as the "Data Protection Laws"). 

 

Inchcape Kenya is the Controller of the Personal Data which we collect on the https://inchcape.co.ke/ and https://inchcapetanzania.co.tz/  websites, the  Original Equipment Manufacturers are the controllers of Personal Data which we collect on https://www.jaguar-kenya.com/ ,https://www.landroverkenya.com/ and https://www.bmw.co.ke/ websites while Inchcape Plc and Inchcape Kenya are jointly the controllers of the Personal Data which we collect on https://www.changan.co.ke/, https://www.changan.co.ug/  and https://www.changan.co.tz/  websites 

 
In this Privacy Notice you will find an overview of what Personal Data we collect in connection with our brands and the use of our Sites, how we collect and process your Personal Data, the purposes for which we process it, how long we keep your personal data, when, why and with who we will share your personal data, what your rights are, the legal basis we have for using your personal data, how we may contact you and how you can contact us.  

 

3. What Personal Data we collect and what we use it for

Personal data is any information that can identify an individual directly or indirectly. For the purpose of this policy this definition includes data collected when you interact with us online through our Sites or via our authorized parties such as our online support helpline where you can raise questions, queries and concerns directly to us. Therefore, we may collect your Personal Data from a variety of sources. We endeavor to only collect Personal Data that is necessary for the purpose(s) for which it is collected and to retain such data for no longer than necessary for such purpose(s). Subject to applicable law and practice, the categories of Personal Data that are typically collected and processed are: - 

 

a) Personal Data you provide to us directly.
We collect Personal Data you provide us with when you sign up for a marketing newsletter, complete a survey, enter a competition or interact with us through our Sites. In so doing, you may provide Personal Data, for example: 


No. Categories of Personal Data Description 

1.

Personal Information

 Your Name, ID/ Passport number, PIN Number, Passport photo, telephone, number, email address, postal address 

2.

 

Vehicle Registration Details 

Your Vehicle registration number, logbooks, chassis number (VIN); NTSA details where you request us to register a vehicle on your behalf 

3.

Purchase and Service data 

 This includes the date and type of purchase or service provided. 

4.

Communication Information 

 Your feedback or suggestions about our brands/services where you decide to provide us with such information. 

5.

User Generated Content 

 Your comments, photos, videos, personal stories, or other similar media or any content that you create and then share with us on third party social networks or by uploading it to one of our Sites. Where permitted, we collect and publish user-generated content in connection with a variety of activities, including contests and other promotions, website community features, consumer engagement, and third-party social networking. 

 

b) Personal Data we collect automatically 

Some automatically collected information may not directly identify you by name, however it may do so indirectly (for example your internet protocol (IP) address may point uniquely to you). For this reason, some automatically collected information is Personal Data under Data Protection Laws.  This information is automatically collected using cookies, pixel, web beacons and similar data collection technology (collectively known as “Data Collection Technology”) when your web browser accesses our Sites or advertisements and other content served by or on behalf of us on other websites. 

 

To find out more about what Data Collection Technology we use, kindly check our Cookie Notice. We may automatically collect certain information from your computers and mobile devices or via other means where required. For example: - 

 

No. Categories of Personal Data Description 

1.

Location Information 

 IP address, device ID, broad location data and time zone.  

2.

 

Device Information 

Information about your computer or mobile device, such as device type and identification number, browser type, internet service provider, mobile network and operating system. 

3.

Traffic and Usage Information 

 How many times you have visited our brand websites, your page response times, your download errors, the length of your visits to certain pages, your page interaction information, and methods you use to browse away from the page. We may also collect technical information to help us identify your device for fraud prevention and diagnostic purposes. 

 

We also collect, use and share aggregated data such as statistical or demographic data which is not Personal Data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' usage data to calculate the percentage of users accessing a specific Site in order to analyze general trends in how users are interacting with our Site to help improve the Site and our product offerings. 

  

c)  Personal Data we collect from other sources 

We may collect Personal Data from other sources including: - 

 

  1. our trusted partners’ third-party platforms where we operate Sites (for example, when you use the "like" functionality on Facebook or the +1 functionality on Google+); 

 

  1. advertising partners (for example we receive information about you and other visitors' interactions with our advertising to measure whether our advertising is relevant and successful) 

 

  1. from social media (such as X or Instagram)

 

4. Lawful basis for processing your Personal Data  

Data Protection Laws require us to have a legal basis for collecting and using your Personal Data. We rely on one or more of the following legal basis: - 

 

Provision of the Law  Basis 


Legitimate interests (GDPR Article 6(1)(f) and Article 30(1)(b(vii)) of the Kenya Data Protection Act of 2019) 

 We may use your Personal Data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your Personal Data for our legitimate interests. We do not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). Our legitimate interests could exist for example, when you sign up to receive information about one of our Brands and we use the Personal Data collected to better understand your needs. You can object to processing that we carry out on the grounds of legitimate interests.  See the section headed "Your Rights" to find out how. 

Compliance with a legal Obligation (GDPR Article 6(1)(c) and Article 30(1)(b(vii)) of the Kenya Data Protection Act of 2019) 

 We may use your Personal Data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation to you when we rely on this legal basis. For example, a court order or a subpoena may require us to process Personal Data for a particular purpose. 

Consent (GDPR Article 6(1)(a) and Article 30(1)(a) of the Kenya Data Protection Act of 2019)) 

 We rely on consent only where we have obtained your active agreement to use your Personal Data for a specified purpose, for example if you subscribe to an email newsletter. Where we rely on consent, we do so to the extent that it is permissible in law. Where you give us consent, you have the right to withdraw the consent at any time. 

 

 

5. How we use your Personal Data 

  • To authenticate the identity of individuals interacting with us online or contacting us by telephone or electronic means. This processing is necessary to meet our and your legitimate interests in complying with our legal responsibilities as a business (e.g. in relation to health and safety and the prevention of crime).  

 

  • For internal training and quality assurance purposes. The processing is necessary to meet our and your legitimate interests in providing a reliable and responsible service to you. 

 

  • To handle the necessary contact information regarding our customers and suppliers. This processing is necessary for our legitimate interests to keep our records updated and manage our relationship with customers and suppliers 

 

  • To provide personalized communications and targeted advertising as well as product recommendations. This processing is necessary for our legitimate interests (to carry out direct marketing, develop our brands and/or services and grow our business and having obtained your prior consent to receive direct marketing communications. 

 

  • To process and respond to your inquiries, suggestions or registration requests, via our Sites, e-mail, social media or our customer care services. This processing is necessary to meet our and your legitimate interests in dealing with complaints and consumer issues, our legal obligations as a and in relation to certain registration requests, we will request your consent.  

  • To develop and improve our services, our communication methods and the functionality of our Sites and online channels. This processing is necessary for our legitimate interests to study how consumers use our brands and/or services, to develop them, to grow our business and to inform our marketing strategy. 

  • For the purposes of competitions or promotions that you have entered. This processing is necessary to meet our and your legitimate interests in handling your participation in competitions and events and the performance of our “contract” with you when you enter the competition and/or the event (e.g., the terms and conditions) and having obtained your prior consent to receive direct marketing communications. 

 

When we collect and use your Personal Data for any other purposes, we will inform you before or at the time of collection. We also create profiles by analyzing the information about your online surfing, searching behavior and your interactions with our brand communications by building segments (creating groups that have certain common characteristics) and by placing your Personal Data in one or more segments. For more information on this, see "Profiling" below. 

 

6. Profiling 

As a Company with an online presence, we use your Personal Data to build profiles. We create profiles by analyzing information about your online surfing, searching behavior and your interactions with our brand communications by building segments (creating groups that have certain common characteristics) and by placing your Personal Data in one or more segments. These segments are used by us to personalize the website and our communications to you (such as showing relevant content to you when you visit our sites or in a newsletter to you) and to display relevant offers and advertisements from our Brands on our Sites, and via third-party websites. The segments can also be used for third-party campaigns on our Sites or third-party websites.   

 

We profile your Personal Data using cookies where you have provided consent for us to do so; for example, accepting the setting of cookies on your browser online. For more information, see our Cookie Notice which is available on all our sites. 

 

If you have asked to receive emails or SMS communications from us, we track whether you open, read or click on the content to see what you are interested in so that we can give you more content that we think you are more likely to enjoy. You can block cookies at any time by activating the setting on your browser that allows you to refuse some or all cookies. However, if you do block cookies there may be parts of our website that you will be unable to access or that will not function properly. 

 

7. Subscribing and Unsubscribing To Our 1direct Marketing Messages 

For any promotional emails from us, during the registration process on our Sites when your Personal Data is collected, you will be asked to indicate your preferences for receiving direct promotional communications and we will request your explicit consent to send them. You can ask us to stop sending you promotional communications at any time by following the opt-out links within any marketing communication sent to you via email or SMS. If you opt out of receiving promotional communications, you will still receive service-related communications that are essential for administrative or customer service purposes. 

 

Further, if you do unsubscribe, please note that we will still keep your email and phone number in a separate secure list so that we can make sure that you do not receive our marketing communications again in the future. 

 

8. Who Do We Share Your Personal Data with? 

We do not sell or trade your Personal Data to third parties. However, where appropriate for us to conduct our business or fulfil our commitments to you., we may share your personal data in various ways and for various reasons with: – 

  • appropriate personnel within the company 

  • third-party service providers who perform functions on our behalf including IT systems providers and our marketing consultants 

where we share your data, we ensure that there are appropriate data processing or data sharing agreements (or similar protections) in place that guarantees the security and privacy of your shared Personal Data.  

 

9. International Data Transfers 

Your Personal data may be transferred and processed to 

  • our website service providers 

  • our cloud-based system service providers 

  • other third parties who perform functions on our behalf including IT systems providers and our marketing consultants who may utilize servers located outside Kenya. 

 

We will only transfer your personal data outside Kenya where such transfer is compliant with the Data Protection Laws to safeguard your privacy rights and to provide you with remedies in the unlikely event of a security breach.   

To ensure that your personal data receives adequate levels of protection, we shall put in place appropriate procedures with our third-party service providers whom we share your personal data with to ensure that your personal information is treated by those third parties in a way that is consistent with, and which respects the data protection laws. 

 

10. How Do We Safeguard Your Personal Data? 

We take the security of your Personal Data very seriously. Inchcape Kenya has taken appropriate technical, administrative, and procedural security measures, consistent with local and international information practices and regulations, to protect the personal data from misuse, unauthorized access or disclosure, loss, alteration, or destruction. These measures include: 

  • Technology safeguards, such as use of anti-virus and firewall, passwords, and monitoring of our systems to ensure compliance with our security policies.  

  • Other measures include implementing appropriate access controls, investing in the latest information security capabilities to protect the IT environments we leverage, and ensuring we encrypt, pseudonymize or anonymize Personal Data wherever possible.  

  • Organizational safeguards, through training and awareness programs on security and privacy, to ensure employees understand the importance and means by which they must protect personal data, as well as through data protection and security policies and Notice standards that govern how Inchcape Kenya treats personal data. 

  • Access to your Personal Data is only permitted among our employees, partners and agents on a need-to-know basis and subject to strict contractual obligations regarding both confidentiality and data privacy when processed by Data Processors.  

If you suspect any misuse or loss of or unauthorized access to your personal data, please let us know immediately by sending us an email on enquirieske@inchcape.co.ke  

 

11. For How long do we keep your Personal Data?  

We only retain your Personal Data for as long as we need it for the purpose for which it was collected or as otherwise required by Data Protection Laws. Your Personal Data will be securely destroyed after the expiry of the applicable retention period. To determine the appropriate retention period for your Personal Data, we consider the amount and nature of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. Furthermore, we may retain your Personal Data for a longer period than indicated below in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. Please refer to the specific retention period for each category of Personal Data: 

 

Data Category  Retention Period 


Personal Information 
  • Personal Data relating to users who have signed up for and consented to receive information on our Brands, i) until such consent is withdrawn or ii) in the event such user has not interacted with us for a period of two years then such Personal Data is deleted after this two-year period has elapsed.  
  • Personal Data relating to complaints and consumer issues is stored for no longer than seven (7)years. 

 

User Generated Content and Communication data 
  • Personal Data relating to consumer queries and responses is stored for no longer than two years. 

Location Information, Device Information and Traffic and Usage Information 

 Refer to our cookies notice 

 

12. What Rights Do You Have Over Your Data? 

The Data Protection Act, 2019 accords you with several rights over your data. You can exercise these rights at any point. We have provided an overview of these rights below together with what this entails for you.  You can exercise your rights by sending an to our Data Protection Officer (DPO) on newholland@inchcape.co.ke   or submitting a request through the “Contact Us” form on our websites.  

 

You have the following rights in relation to your Personal Data:  

 

  • Right Information, Rectification and Access: You have the right to access, correct or update your Personal Data at any time. For rectification, this enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. If you request access, where feasible and permitted by Data Protection Laws, we will provide a copy of the Personal Data we are processing. The Personal Data shall be provided in electronic form.  

 

  • Right to Deletion: You have the right to request deletion of your Personal Data. However, this right may not apply if we are permitted to retain your Personal Data in accordance with Data Protection Laws for the purposes of i) exercising the right of freedom of expression and information ii) compliance with a legal obligation which requires processing by a law to which we are subject iii) the performance of a task carried out in the public interest and iv) the establishment, exercise or defense of our legal rights.  

 

  • Right to Portability: The right to data portability. The Personal Data you have provided us with is portable. This means it can be moved, copied or transmitted electronically under certain circumstances. You also have the right, where technically possible, to have personal data transmitted directly from us to another data controller or data processor. However, if the lawful basis that we rely upon for the processing of your Personal Data is to pursue our legitimate interests or if your Personal Data has been anonymized or pseudonymize then the right to data portability does not apply.  

 

  • Right to Restriction & Objection: Under certain circumstances, you have the right to restrict or object to certain types of processing, including processing for direct marketing (i.e., receiving marketing emails from us or being contacted about potential opportunities, events and promotions). If you have given your consent to anything we do with your Personal Data you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your Personal Data with your consent up to that point is unlawful). You can withdraw your consent to the processing of your Personal Data at any time by contacting us with the details provided below.  

 

  • Right to automated decision making: You have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning or that significantly affects you. Inchcape Kenya may from time to time make decisions based on the automated processing of your personal data. In such instances, you will be informed, in writing, whenever a decision based on automated processing is taken. In addition, you can request us to reconsider any decisions made based on automated processing or to take a new decision that is not based solely on automated processing.

  • Right to Complain: You have the right to lodge a complaint directly with any local Supervisory Authority about how we process your Personal Data.  

 

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.  

 

Please be aware that there are exceptions and exemptions that apply to some of these rights, which we will apply in accordance with the Data Protection Laws.  

 

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.  

 

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances. 

 

13. What Are Your Responsibilities 

You are responsible for the information you make available to Inchcape Kenya, and you must ensure it is accurate, honest, truthful, and not misleading in any way. You must ensure that the information does not contain material that is obscene, defamatory, or infringing on any rights of any third party. 

Further, if you provide any information concerning any other person, for example if you provide your spouse’s details in connection with the purchase of a vehicle, you are responsible for providing any notices and obtaining any consents necessary for Inchcape Kenya to collect and use that information. 

 

14. Notice Updates 

We will update this Privacy Notice when necessary to reflect feedback, changes in our products or changes in Data Protection Laws. When we post changes to this Privacy Notice, we will revise the "last updated" date.   

 

If the changes are significant, we will provide a more prominent notice (including, potentially email notification of Privacy Notice changes).  

 

15. Complaints 

It is important that you ensure you have read this Privacy Notice. If you do not think that we have processed your Personal Data in accordance with this Privacy Notice, you should let us know as soon as possible. If you have any questions or complaints about the processing of personal data, you can contact our Data Protection Officer on the following email address newholland@inchcape.co.ke  

 

  

The DPO 

Inchcape Kenya Limited, 

Lusaka Road, Industrial Area, 

LR209/7362 

P.O Box 2231-00606, 

Nairobi , Kenya.