Privacy Policy

1. Introduction

BimaSasa ("we," "our," or "us") is a quote comparison platform designed for licensed insurance agents in Kenya. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform to generate insurance quotes, manage clients, and grow your agency business.

By using BimaSasa, you consent to the data practices described in this policy. We are committed to complying with the Kenya Data Protection Act, 2019 and Insurance Regulatory Authority (IRA) guidelines.

2. Information We Collect

2.1 Agent Account Information

• Full name and contact details (email, phone number)
• IRA license number and registration details
• Agency or brokerage name and registration
• Payment information for subscription services
• Workspace and team member information

2.2 Client Data You Enter

When you use BimaSasa to generate quotes for your clients, you may enter:

• Client names and contact information
• National ID numbers and KRA PIN numbers
• Date of birth and age information
• Health information for medical insurance quotes (pre-existing conditions, family medical history)
• Vehicle details for motor insurance (registration, make, model, value)
• Property details for property insurance
• Employment and income information where relevant

2.3 Quote and Transaction Data

• Insurance quotes generated and compared
• Selected underwriters and premium amounts
• Commission calculations and earnings
• Documents generated (quote PDFs, comparison sheets)
• Policy tracking and renewal information

2.4 Lead Capture Data

If you use our lead capture features, we collect information submitted by potential clients through your capture links, including names, contact details, and insurance requirements.

2.5 Technical Information

• Device and browser information
• IP address and approximate location
• Usage patterns and feature interactions
• AI chat conversation history for quote generation

3. How We Use Your Information

We use the information we collect to:

• Provide Quote Comparison Services: Generate and compare insurance quotes from 40+ Kenyan underwriters using our AI-powered system
• Manage Your Agency: Enable client management, policy tracking, renewal reminders, and commission tracking
• Generate Documents: Create professional quote PDFs with your branding for sharing with clients
• Process Payments: Handle subscription payments via M-Pesa and other payment methods
• Improve Our Services: Analyze usage patterns to enhance features and user experience
• Communicate: Send service updates, renewal reminders, and support responses
• Ensure Compliance: Maintain records as required by IRA regulations

4. Information Sharing

We do not sell your personal information or your clients' data. We may share information in the following circumstances:

• With Your Consent: When you explicitly authorize sharing
• Service Providers: With trusted partners who help us operate our platform (hosting, payment processing, email services), bound by confidentiality agreements
• Legal Requirements: When required by law, court order, or regulatory authorities including the IRA
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Workspace Members: Information is shared within your workspace team as configured by workspace administrators

Important: We do not share your client data with insurance underwriters. Quote comparisons are generated using publicly available rate information and algorithms.

5. Data Security

We implement robust security measures to protect your information:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Secure authentication and access controls
• Regular security assessments and monitoring
• Limited access to personal data on a need-to-know basis
• Secure cloud infrastructure with reputable providers

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

6. Data Retention

We retain your information as follows:

• Account Data: For as long as your account is active, plus 7 years after account closure for regulatory compliance
• Client and Quote Data: Retained according to your workspace settings and IRA record-keeping requirements
• Transaction Records: Minimum 7 years as required by financial regulations
• Technical Logs: Up to 12 months for security and troubleshooting purposes

7. Your Rights Under Kenya Data Protection Act

As a data subject under the Kenya Data Protection Act, 2019, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your data, subject to legal retention requirements
• Restriction: Request limitation of processing in certain circumstances
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests

To exercise these rights, contact us at hello@bimasasa.co.ke. We will respond within 30 days as required by law.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Keep you signed in to your account
• Remember your preferences and settings
• Analyze platform usage and performance
• Improve our services based on usage patterns

You can control cookies through your browser settings, though disabling certain cookies may affect platform functionality.

9. Third-Party Services

Our platform integrates with third-party services including:

• M-Pesa: For payment processing (governed by Safaricom's privacy policy)
• Email Services: For transactional emails and notifications
• Analytics: For understanding platform usage

These services have their own privacy policies governing their use of your information.

10. Children's Privacy

BimaSasa is a professional platform for licensed insurance agents. We do not knowingly collect information from individuals under 18 years of age. If you become aware that a minor has provided us with personal information, please contact us immediately.

11. International Data Transfers

Your data may be processed on servers located outside Kenya. We ensure appropriate safeguards are in place for any international transfers in compliance with the Kenya Data Protection Act.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by email or through the platform. Your continued use of BimaSasa after changes constitutes acceptance of the updated policy.

13. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact us:

• Email: hello@bimasasa.co.ke
• Website: bimasasa.co.ke

For complaints about data processing, you may also contact the Office of the Data Protection Commissioner of Kenya.