Privacy notice

Under the Kenya Data Protection Act, 2019. The data controller is Union Oil and Gas Limited, Hughes Building, Kenyatta Avenue, Nairobi.

What we collect

Company details (name, BRS number, KRA PIN, EPRA licence), the contact details of your users (name, email, phone), order and payment records, and the truck and driver details (plate, driver name, national ID number, phone) needed to release fuel at the depot.

Why

To verify that you may lawfully buy petroleum products (EPRA licence conditions), to process and deliver your orders, to meet tax and regulatory record-keeping duties, and to prevent fraud. We do not sell your data or use it for advertising.

Who we share it with

The depot operator (truck and driver details, for release), our payment providers (Safaricom M-Pesa, our bank), and authorities where the law requires it (KRA, EPRA). Our hosting providers process data on our behalf under contract.

How long

Order, invoice and payment records are kept for at least 5 years, as KRA requires. Driver ID details are kept only as long as we need them for loading records.

Your rights

You may ask to access, correct or delete your personal data, or object to its use, by emailing info@unionoilandgas.co.ke. You may also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Security

Passwords are stored as one-way hashes. Sessions use signed, HTTP-only cookies, and access to your records is limited by role and logged.