Privacy Policy

1. Introduction

This motor insurance portal is built and operated by MIC Global Risks Limited on behalf of LOLC Bank for use by LOLC's authorised staff and agents to generate motor insurance quotations, compare quotations across underwriters, report claims, and request insurance stickers on behalf of customers. This Privacy Policy explains what personal data we collect through the Portal, why we collect it, how it is protected, and the rights available to individuals whose data we process.

We process personal data in accordance with the Kenya Data Protection Act, 2019 and its subsidiary regulations.

2. Information We Collect

Depending on how the Portal is used, we collect:

• User account data — name, email address, mobile number, and role, for staff/agents who log in to the Portal.
• Customer & vehicle data — the insured's name, contact details, vehicle registration, make, model, year, chassis number, engine number, colour, and estimated value, submitted to generate a quotation, log a claim, or request a sticker.
• KYC documents — identity documents (e.g. national ID, passport), KRA PIN certificates, vehicle logbooks, certificates of incorporation, and any other supporting documents uploaded to request a sticker on a customer's behalf.
• Claim details — incident date, description, claim type, police abstract reference (where applicable), and any documents submitted in support of a claim.
• Technical data — IP address, device/browser information, and activity logs, collected automatically for security and audit purposes.

3. How We Use This Information

We use the information collected to: generate and compare insurance quotations; transmit sticker requests and supporting KYC documents to the relevant underwriter for their review and approval; transmit claim details to the relevant underwriter for assessment; maintain an audit trail of quotations, sticker requests, and claims for accountability and dispute-resolution purposes; and secure and administer the Portal itself (e.g. detecting fraud, misuse, or security incidents).

4. Legal Basis for Processing

We process personal data on the basis of: performance of a contract (providing quotation, claims, and sticker-issuance services on LOLC's instruction); legal obligation (e.g. KYC and anti-fraud requirements applicable to insurance intermediation); and legitimate interest (maintaining the security, integrity, and audit trail of the Portal). Where required, consent is obtained from the customer by the LOLC staff member or agent submitting their information on their behalf.

5. Who We Share Data With

Personal data and KYC documents submitted on the Portal are shared only with:

• The participating insurance underwriter relevant to a specific quotation, sticker request, or claim — this is necessary for them to price, approve, and issue the requested cover, sticker, or claim decision.
• LOLC, as the Portal is operated on their behalf and for their staff's use.
• Service providers who support the underlying infrastructure of the Portal (e.g. secure hosting and email delivery), strictly to the extent necessary to operate the service, and under obligations of confidentiality.

We do not sell personal data, and we do not share it with any third party for marketing purposes.

6. How We Protect KYC Documents

KYC documents are sensitive personal data and are handled with particular care:

• Documents are transmitted via email to the underwriter, over encrypted (HTTPS/TLS) connections.
• We do not store KYC document files in our database; the database only records limited metadata (such as the document type and verification status) needed to track a request.

7. Data Retention

We retain quotation, claim, and sticker-request records for as long as reasonably necessary to fulfil the purposes described in this Policy, to meet regulatory and record-keeping obligations applicable to insurance intermediation, and to resolve any disputes. KYC documents are not retained on the system.

8. Security Measures

We apply technical and organisational measures appropriate to the sensitivity of the data we handle, including encrypted data transmission, malware scanning of uploaded files, restricted and audited access to stored documents, and role-based access controls limiting Portal features to authorised users. No system can guarantee absolute security, but we continually review and improve these measures.

9. Security Incident Notification

If we become aware of a security incident data breach affecting data processed through the Portal, we will: investigate the matter as a priority using the Portal's audit and activity logs; notify LOLC's designated contact in writing without undue delay, and in any event within 72 hours of becoming aware of it, describing the nature of the incident and the data or systems affected; and support LOLC in meeting any notification obligations it may have to the Office of the Data Protection Commissioner, Kenya, or to affected data subjects, under the Kenya Data Protection Act, 2019.

10. Cookies

The Portal uses strictly necessary cookies/session storage to keep you signed in and to remember your in-progress quotation while you complete a form. We do not use these cookies for advertising or cross-site tracking.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The "Last updated" date above indicates when this Policy was last revised.

12. Contact Us

For questions about this Privacy Policy, or to exercise your data protection rights, please contact MIC Global Risks Limited, 6th Floor, 9 West, Ring Road Parklands, Nairobi, Kenya, or via www.micglobalrisks.com.