Insunation
Privacy notice
Version v4 — October 2026. We are the data controller: InsureMe.
What we hold, and why
Everything below is here because something on the site needed it. Nothing is collected to build a profile of you, nothing is sold, and we do not send marketing. No decision about you is made by a machine on its own — a person decides every application.
Name, email address, password, county.
To give you an account, sign you in, and confirm your address.
Basis: Performance of a contract
Business name, county, sub-county, town, address, phone, email, website, description, logo.
To publish the listing you asked us to publish, and to show it in the county you work in.
Basis: Performance of a contract
Name, role, phone number, email address, and an ID number where you give one.
To say who a customer should ask for, and to let us reach the people you nominate for enquiries.
Basis: Performance of a contract
National ID or passport, certificate of business registration or incorporation, and for a brokerage a CR-12 form.
To check that the licence you are claiming is yours. A licence number is printed in the IRA's own lists, so it cannot prove anything by itself.
Basis: Legitimate interests — preventing somebody claiming a licence that is not theirs
The licence number searched, what came of it, your IP address and your browser.
To stop the register being harvested, and to investigate a claim about a licence.
Basis: Legitimate interests — protecting the register and the people on it
Your name, phone number, email address, and the insurance type and class of cover you asked about.
To pass your enquiry to the agent or broker you chose, and for them to reply to you.
Basis: Your consent, given when you send the enquiry
Your name, email address, optional phone number, and the message you send us.
To respond to your question or feedback. We send the message to the contact inbox shown below and reply to the email address you provide.
Basis: Legitimate interests — responding to a request you made
A score out of five, up to three labels from a fixed list, the name you choose to show, and which enquiry it came from. There is nowhere to write anything, and no contact details are published.
To show other customers what people who used a listing thought of it, and to ask you for that rating once, afterwards, by email.
Basis: Your consent, given separately when you send the rating
Your name if you give it, phone number, amount, and the M-Pesa receipt.
To collect the donation and to be able to answer you if it goes wrong.
Basis: Performance of a contract
Which member of staff approved or refused an application, and when.
So that a decision about a licence is attributable to a named person.
Basis: Legitimate interests — accountability
Whether you have to give it to us
Almost nothing we ask you for is required by law. It is voluntary, and saying no costs you only the thing that needed it — never your access to the directory.
- No account, no listing and no enquiry: the public directory still works, and nothing on it asks anything of you.
- No licence number, or none of the details behind it: we cannot check it against the IRA lists, so we cannot publish a listing.
- No ID or business document: we cannot tell that the licence is yours, and the application stops there.
- No phone number or email address: customers cannot reach you, and we cannot tell you when one has enquired.
- No phone number when paying: we cannot take the payment, so nothing is charged.
- No phone number on the contact form: it is optional, and we can still reply to your email.
- No insurance type on an enquiry: the agent would not know what you want, so we do not send it.
- Declining the human check: the forms carrying one are closed to you, and the directory is not.
The one record a law does require is a note of what you consented to and when, because the Act puts the burden of proving consent on us rather than on you.
Two things worth knowing before you upload or ask
Who else sees it
We share personal data with the services that make the site work. We do not sell it, and we do not pass it to insurers. A contact form message is sent to [email protected], and our email provider carries the message and your email address there.
|
Who
|
What they get
|
Where
|
|---|---|---|
| Our email and SMS providers | The address or number an alert or contact message is sent to, and what it says. | Outside Kenya |
| The agent or broker you enquire with | Your name, phone number, email address and what you asked about. | Per their own notice |
Contact form messages are delivered by email rather than stored in the application database. We keep them in the contact inbox only as long as needed to respond; copies held by the email provider are subject to its retention practices.
Some of what we use sits outside Kenya, which means your data is transferred abroad — the table above says which. The Act allows that where there are adequate safeguards, and we rely on the contractual protections each provider offers. If you would rather your data was not transferred, note that the directory itself asks nothing of you: every transfer here comes from something you choose to do, whether that is filling in a form or answering a human check.
We describe these by what they do rather than by name, because a list of names is out of date the moment a provider changes. If you want to know which companies they are, ask us at [email protected] and we will tell you.
How long we keep it
We keep personal data only as long as it is needed, and these periods are enforced by a scheduled job rather than by good intentions.
|
What
|
Kept for
|
|---|---|
| Licence searches, with IP address and browser | 365 days |
| Donations and listing fees that were never completed | 90 days |
| Applications refused or left to lapse, and their documents | 180 days |
| Enquiries | 730 days |
| Ratings, after the enquiry behind them has gone | Kept, without your name |
| Your account and your listing | Until you close your account |
Closing your account deletes your account, your listings — including any published in the directory — the documents you uploaded and the files themselves. It cannot be undone.
What you can ask us to do
The Data Protection Act gives you these rights, and we will not charge you for using them:
- To be told what we do with your data — this page is that.
- To see what we hold about you.
- To have anything false or misleading corrected, including on a published listing.
- To have false or misleading data deleted, or to object to our processing it.
- To receive your data in a portable form.
- To withdraw consent you have given, at any time.
Write to [email protected] and tell us what you want. We may ask you to confirm who you are first, because we will not hand somebody's data to whoever asks for it. If you have given consent for an enquiry, withdrawing it stops anything further being done with that enquiry, but it does not undo what was already sent to the agent you chose.
Keeping it safe
Passwords are stored hashed and never in a readable form. The documents you upload are kept on private storage and are served only to signed-in members of staff through the panel, and who opened each one is recorded. The panel has its own accounts, separate from directory accounts, so being signed in here grants nothing there.
If something goes wrong
If personal data is ever accessed by somebody who should not have it, and there is a real risk of harm to you, we will tell the Office of the Data Protection Commissioner within seventy-two hours and tell you as well.
If you are unhappy with how we have handled your data, tell us first at [email protected] so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner, whose details are on odpc.go.ke.
Changes
When this notice changes in a way that matters, the version above changes with it, and the version somebody agreed to is the one recorded against their consent.