PRIME This Privacy Policy explains how Prime Motor Riders Institute Ltd ("Prime Motor", "we", "us", "our") collects, uses, stores, and protects your personal information when you visit our website, enrol in our courses, or use any of our services. It is drafted in compliance with the Kenya Data Protection Act, 2019 (No. 24 of 2019) and its associated regulations.
Who We Are
Prime Motor Riders Institute Ltd is a NTSA-accredited driving school and insurance brokerage located at Tani Park, Opp Katani Lounge, Off Mombasa Road, Syokimau – Katani Road, Nairobi, Kenya. We are the data controller responsible for your personal information.
We offer driving education (Classes B1, B2, B3, C1, C, and A2 Motorcycle), defensive driving, refresher courses, road safety public education, professional driver recruitment, and IRA-regulated insurance brokerage services.
For all data-related enquiries, contact us at: support@primedrivingschool.co.ke.
Data We Collect
We collect only the information necessary to provide and improve our services. The categories of personal data we process include:
| Category | Examples | Source |
|---|---|---|
| Identity data | First name, last name | Enrolment form, contact form, student portal |
| Contact data | Email address, phone number | Enrolment form, contact form |
| Course data | Course type, preferred start date, course mode | Enrolment form |
| Communication data | Messages and queries you send us | Contact form, email, WhatsApp |
| Review data | Name, star rating, course review text | Testimonial submission form |
| Technical data | IP address, browser type, device type, pages visited | Automatically collected via server logs |
| Payment data | M-Pesa reference numbers, payment receipts | Provided directly by you; processed by M-Pesa / KCB Bank |
| Student portal data | Login credentials, progress records (if applicable) | Student portal registration |
| Newsletter data | Email address, optional name | Footer newsletter signup form |
We do not intentionally collect special category data such as racial origin, political opinions, health data, biometric data, or criminal records.
How We Collect Your Data
We collect information through the following methods:
- Enrolment form — when you submit a course enrolment request on our website.
- Contact form — when you send us a message or enquiry.
- Testimonial form — when you voluntarily submit a review of our services.
- Student portal — when you log in to access your student records.
- Newsletter signup form — when you voluntarily subscribe to our newsletter via the form in the website footer. Subscription is entirely optional and you may unsubscribe at any time.
- WhatsApp and phone calls — when you contact us directly.
- In-person — when you visit our offices to enrol or make payments.
- Automatically — technical data such as IP addresses is collected automatically by our web server when you visit our website.
How We Use Your Data
We process your personal data on the following legal bases and for the following purposes:
4.1 — Contract Performance
To process your enrolment, schedule your lessons, confirm your registration, and manage your course progress. Without this data, we cannot provide you with our services.
4.2 — Legitimate Interests
- Responding to your enquiries and contact form submissions.
- Administering our website and student portal securely.
- Preventing fraudulent enrolments and rate-limit abuse.
- Improving our website content and user experience.
4.3 — Consent
- Publishing your testimonial/review on our website (only after your explicit submission and our approval).
- Newsletter and email marketing — we send course updates, driving tips, news, and promotional content only to subscribers who have explicitly signed up via our newsletter form. Each email contains a clearly visible one-click unsubscribe link. You may also unsubscribe at any time by contacting us directly. Once unsubscribed, your email address is marked inactive and we will send no further marketing communications.
4.4 — Legal Obligation
- Maintaining records as required by NTSA, IRA, and other Kenyan regulatory authorities.
- Complying with lawful requests from law enforcement or courts.
We will never use your data for purposes incompatible with those stated above without obtaining your consent first.
Sharing Your Data
We do not sell, rent, or trade your personal information. We may share data only in the limited circumstances described below:
5.1 — Service Providers
We work with trusted third-party processors who support our operations. These include:
- Safaricom (M-Pesa Paybill) — to process payments on our behalf.
- KCB Bank Kenya — for bank-transfer payment processing.
- Web hosting provider — our website and database are hosted on a secure server.
All processors are bound by data processing agreements and may only use your data as directed by us.
5.2 — Insurance Brokerage
When you enquire about or take up an insurance product through our brokerage arm, we will share relevant data with the selected insurer(s) as necessary to provide that service. This sharing is governed by the insurer's own privacy policy. All insurers we work with are regulated by the Insurance Regulatory Authority (IRA) of Kenya.
5.3 — NTSA and Regulatory Bodies
As an NTSA-accredited institution, we may be required to share student enrolment and test-readiness records with the National Transport and Safety Authority.
5.4 — Legal Requirements
We may disclose your information if required to do so by law, court order, or to protect the rights, property, or safety of Prime Motor, our staff, students, or the public.
Your personal data is stored and processed within Kenya. We do not transfer data outside Kenya unless required by law or with your explicit consent.
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by Kenyan law.
| Data Type | Retention Period | Reason |
|---|---|---|
| Enrolment records | 7 years after course completion | NTSA compliance and audit requirements |
| Payment records | 7 years | Financial and tax obligations |
| Contact form messages | 2 years | Reference for follow-up and dispute resolution |
| Testimonials (published) | Until you request removal | Consent-based display on website |
| Student portal accounts | 3 years after last login | Account continuity |
| Newsletter subscriber records | Until unsubscribed + 1 year | Consent-based email marketing; retained briefly after unsubscribe for audit trail |
| Server logs / IP addresses | 90 days | Security and abuse prevention |
When data is no longer required, it is securely deleted or anonymised.
Your Rights
Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:
- Right of access — You may request a copy of the personal data we hold about you.
- Right to rectification — You may request correction of inaccurate or incomplete data.
- Right to erasure — You may request deletion of your data where there is no legitimate reason for us to continue processing it.
- Right to object — You may object to processing based on our legitimate interests, including direct marketing.
- Right to restriction — You may request that we restrict processing of your data in certain circumstances.
- Right to data portability — You may request that we provide your data in a structured, machine-readable format.
- Right to withdraw consent — Where processing is based on consent (e.g., testimonials or newsletter marketing), you may withdraw it at any time without affecting prior processing. To unsubscribe from our newsletter, click the unsubscribe link in any email we send, or contact us directly.
- Right to unsubscribe — Newsletter subscribers may opt out at any time using the unsubscribe link included in every marketing email, or by emailing support@primedrivingschool.co.ke with the subject "Unsubscribe".
To exercise any of these rights, contact us at support@primedrivingschool.co.ke or call 0722 223 325. We will respond within 30 days of receipt of your request.
If you are unsatisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.
Cookies
Our website uses a small number of cookies to ensure it functions correctly and to improve your experience. We do not use advertising or tracking cookies.
| Cookie Name | Type | Purpose | Duration |
|---|---|---|---|
pm_admin_sess |
Session | Admin panel authentication | 2 hours / session end |
pm_student_sess |
Session | Student portal authentication | 2 hours / session end |
| PHP Session Cookie | Session | CSRF protection and form state | Session end |
You can configure your browser to refuse cookies or alert you when cookies are being sent. However, disabling cookies may affect certain features of our website (such as the student portal login).
We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts.
Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. These include:
- Bcrypt password hashing for all admin and student accounts.
- CSRF tokens on all forms to prevent cross-site request forgery.
- Prepared SQL statements to prevent SQL injection.
- Rate limiting on public form submissions to prevent spam and abuse.
- Access controls restricting the admin panel to authorised personnel only.
While we use best practices to protect your data, no method of internet transmission is completely secure. We cannot guarantee absolute security. In the event of a data breach that is likely to result in high risk to your rights, we will notify you and the ODPC as required by law.
Children's Privacy
Our driving and motorcycle courses require a minimum age of 18 years. Our insurance and road safety education programmes may serve all ages in a community context, but our website is not directed at children under 18.
We do not knowingly collect personal data from individuals under the age of 18 through our website. If you believe a child has submitted personal data to us, please contact us immediately so we can delete it.
Policy Changes
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page.
We encourage you to review this policy periodically. Your continued use of our website and services after any changes constitutes your acceptance of the revised policy.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please reach out to us through any of the channels below:
Off Mombasa Road, Syokimau – Katani Road, Nairobi