Privacy Policy
1. Introduction
K-COM COMPANY LIMITED ("K-COM", "we", "our", or "us") provides vehicle-tracking services to logistics, transport, and service teams across East Africa. These services help customers monitor vehicles, review routes and trips, reduce fuel waste, administer fleets, and respond to incidents.
K-COM may act as a data controller where it determines why and how personal data is processed, including for its own website, account administration, security, billing, and legal compliance. K-COM may also act as a data processor when it operates the tracking service on a customer's documented instructions. In that situation, the customer remains responsible for its own lawful basis, notices, and instructions to K-COM.
This Privacy Notice applies to https://k-com.co.tz, the tracking portal at https://k-com.solutions, the K-COM Tracking mobile application, and related support and administration activities. It should be read with any customer-specific privacy notice or service agreement that also applies.
2. Data Protection Principles
K-COM processes personal data in line with the Personal Data Protection Act, 2022 and applicable regulations. We seek to ensure that personal data is:
• processed lawfully, fairly, and transparently;
• collected for specified, explicit, and legitimate purposes;
• adequate, relevant, and limited to what is necessary;
• accurate and kept up to date where necessary;
• retained only for as long as required for the stated purposes, contractual duties, and legal obligations;
• processed in a way that enables individuals to exercise their rights;
• protected through appropriate technical and organizational measures; and
• transferred outside Tanzania only under applicable authorization and safeguards.
3. Information We Collect
Depending on how an individual interacts with K-COM and the tracking service, we may collect:
• Identity and contact data: names, email addresses, telephone numbers, usernames, and account identifiers.
• Vehicle and tracking-device data: vehicle registration details, device identifiers, and relationships between accounts, vehicles, devices, and groups.
• Location and operational data: live and historical GPS locations, routes, trips, status information, fuel-efficiency information, and incident-related records.
• Technical and security data: IP addresses, login and logout information, denied-login events, audit records, browser details, device information, and server logs.
• Cookie and preference data: essential login/session cookies and user preference cookies.
Based on the current service scope, K-COM does not intentionally collect national identity or passport information, payment information, photographs or documents, health data, biometric data, or other special-category information through the covered services. Users should not upload unnecessary sensitive information.
4. Why and How We Collect Personal Information
Personal data is collected:
• directly from customers and users during registration, account setup, support, and communications;
• when authorized fleet managers enter or maintain account, vehicle, device, and group information;
• automatically from GPS tracking devices and related service connections; and
• automatically through website, application, authentication, audit, and server logs.
We collect this information because it is needed to deliver and secure the tracking service, manage customer relationships, meet legal duties, and support legitimate operational needs.
5. Legal Basis for Processing
K-COM relies on one or more of the following legal grounds, depending on the processing activity:
• performance of a customer or service contract;
• the individual's consent where consent is required;
• compliance with legal, regulatory, court, or law-enforcement obligations; and
• K-COM's or a customer's legitimate interests, where those interests do not override the individual's rights and freedoms.
Where K-COM acts only as a processor, the relevant customer determines the legal basis and K-COM processes the data on that customer's documented instructions, except where the law requires otherwise.
6. How We Use the Collected Personal Data
K-COM may use personal data to:
• provide live vehicle tracking, route information, and trip history;
• support fleet administration and fuel-efficiency monitoring;
• support incident response and operational reporting;
• create and manage accounts and permissions;
• provide customer support and troubleshoot technical issues;
• protect the security, availability, and integrity of the service;
• prepare reports, administer billing, and manage customer contracts; and
• meet legal, regulatory, audit, and compliance obligations.
7. How We May Share Personal Data
K-COM limits sharing to what is lawful and necessary. Personal data may be made available to:
• the relevant customer and its authorized users, according to configured permissions;
• DigitalOcean, which provides the cloud infrastructure used to host K-COM's servers and stored data; and
• regulators, courts, law-enforcement authorities, or emergency services where disclosure is legally required or necessary to protect life, property, or legal rights.
K-COM does not sell personal data. Service providers are expected to process information only for authorized purposes and under appropriate confidentiality, security, and contractual controls.
8. Disclosure of Personal Data
Personal data may be disclosed where required by law, regulation, court order, or a lawful request from a competent authority; to investigate or respond to security incidents or unlawful activity; to enforce contractual rights; or to protect the rights, safety, life, or property of individuals, customers, K-COM, or the public. Disclosures are limited to information reasonably necessary for the relevant purpose.
9. Cross-Border Data Transfers
The KCOM Tracking system application server, MySQL database, audit logs, media, and backups are hosted in DigitalOcean's SFO3 region in San Francisco, United States. This involves a transfer and storage of personal data outside Tanzania.
K-COM has obtained a cross-border data-transfer permit from the Personal Data Protection Commission. Permit details are retained in K-COM's internal compliance records. K-COM applies the permit conditions together with contractual, access-control, encryption, and organizational safeguards intended to protect personal data throughout the transfer and storage lifecycle.
10. Children's Privacy
The company website and tracking services are not intended for persons under 18, and K-COM does not knowingly collect children's personal data through these services. If a parent, guardian, or other person believes that a child's data has been collected, they should contact the Data Protection Officer so that K-COM and the relevant customer can investigate and take appropriate action.
11. Where Personal Data May Be Held
The application server, MySQL database, audit logs, media, and backup copies are held in DigitalOcean's SFO3 region in San Francisco, United States. Authorized K-COM system administrators and support personnel may access information remotely where necessary to operate, secure, and support the service. Limited information may also be displayed or temporarily cached on a user's authorized mobile device or browser while the service is being used.
12. How Long We Keep Personal Data
Operational data remains available in live storage for one year. It is then moved to cold or archive storage and retained for the lifetime of the relevant customer contract. After the contract ends, non-backup archived data is retained for 90 days and then securely deleted, unless a longer period is required by law, a court order, a dispute, or another legitimate and documented obligation.
Audit-log information follows the same live and archive retention schedule. Under K-COM's current practice, encrypted backup copies are retained indefinitely and access is restricted to K-COM system administrators. This indefinite backup-retention practice is identified in K-COM's internal compliance review as requiring a defined, lawful retention and secure-deletion schedule.
13. Your Rights as a Data Subject
Subject to the Act, applicable regulations, and lawful exceptions, an individual may have the right to:
• be informed about the collection and use of personal data;
• request access to personal data and information about its processing;
• request correction of inaccurate or incomplete information;
• request erasure or destruction where the legal requirements are met;
• request restriction or suspension of harmful or unlawful processing;
• receive or transfer personal data where data portability applies;
• object to processing in applicable circumstances, including direct marketing;
• withdraw consent where processing is based on consent;
• receive appropriate protection in relation to automated decisions;
• make a complaint to K-COM or the Personal Data Protection Commission;
• seek compensation where permitted and damage is established; and
• exercise applicable transmission rights through an authorized heir or representative.
Where K-COM acts as a processor, it may refer the request to the relevant customer or assist that customer in responding. K-COM may verify identity and authority before releasing, correcting, or deleting information.
14. Security of the Collected Personal Data
K-COM uses technical and organizational measures intended to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction. Current measures include:
• role-based access using standard KCOM Tracking system administrator, manager, standard, read-only, and device-read-only permissions;
• monthly reviews of user accounts and access rights;
• encrypted connections to the websites and encryption of backups at rest and during transfer;
• a five-minute inactivity timeout configured;
• administrator audit logging for system activity;
• backup access restricted to K-COM system administrators; and
• tested automated standby and failover capability intended to restore service promptly.
No method of electronic transmission or storage is completely secure. Users must keep credentials confidential, use unique passwords, protect their devices, and notify K-COM promptly of suspected unauthorized access.
15. Automated Decision-Making and Profiling
K-COM does not use personal data to make solely automated decisions or create profiles that produce legal or similarly significant effects on individuals. Normal location tracking, service alerts, route history, and operational reports are not used by K-COM to impose automated penalties, deny services, or make employment decisions without human review.
16. Access to Your Personal Data
To request access or exercise another data-protection right, email [email protected]. Please describe the request and the relevant account, vehicle, customer, or service relationship. K-COM may request information necessary to verify identity and authority. K-COM aims to respond within seven days, although complex requests or requests controlled by a customer may require further coordination or an extension allowed by law.
17. Third-Party Links
The covered websites and tracking portal do not currently contain third-party links. If external links are introduced, the third party will be responsible for its own content and privacy practices, and users should review the third party's privacy notice before providing personal data.
18. Cookies and Tracking Technologies
K-COM uses essential login/session cookies and preference cookies. Essential cookies support authentication, security, and core service functions. Preference cookies remember selected settings. K-COM does not currently use analytics or advertising cookies on the covered services. Users may control cookies through browser settings, but disabling essential cookies may prevent login or other core features from working.
19. How to Complain
Privacy questions, requests, and complaints should be sent to our Data Protection Officer and Privacy Contact, at [email protected]. K-COM aims to respond within seven days.
If the matter is not resolved, an individual may lodge a complaint with the Personal Data Protection Commission through https://pdpc.go.tz or another channel published by the Commission.
20. Changes to This Privacy Notice
K-COM may update this Privacy Notice when its services, processing activities, legal obligations, or safeguards change. The current version will be posted on the company website or tracking portal with an updated effective date. Material changes may also be communicated through appropriate account or customer channels.
Organization: K-COM COMPANY LIMITED
Address: Industrial Road, Mikocheni, Dar es Salaam, Tanzania
Company website: https://k-com.co.tz
Tracking portal: https://k-com.solutions