HomePrivacy Policy

Privacy Policy

Last updated August 2026

We respect your privacy and handle your personal data in line with the Kenya Data Protection Act, 2019 (and the equivalent laws of the other countries we serve). This policy applies to the Kenbright website (`kenbright.africa`), the Kenbright App, and the Kenbright Individual Provident Fund online application (together, our "services"). It explains what we collect, why, how we protect it, and the choices and rights you have.

Who we are

The Kenbright website, the Kenbright App and the Kenbright Individual Provident Fund online application are operated by Kenbright Insurance Brokers Limited ("Kenbright", "we", "us", "our"), a licensed insurance brokerage regulated by the Insurance Regulatory Authority (IRA) of Kenya (licence no. IRA/06/347/2026). We are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller and data processor (registration no. 466-737A-BA99).

Kenbright Insurance Brokers Limited is part of Kenbright Holdings Limited (KHL), a leading East African insurance and financial services group with over 30 years' experience, headquartered in Nairobi with offices in Uganda and Tanzania. Across our website and app we offer, and provide information about, a range of services — insurance (motor, health/medical, travel and other retail and corporate cover), pensions, employee benefits, investments, reinsurance, and actuarial and advisory services. Some of these are provided together with other companies in the Kenbright group under their applicable regulators. When you buy insurance through us, the cover itself is provided by an underwriter regulated by the IRA; we arrange and service it as your broker.

We are also the administrator, as recorded by the Retirement Benefits Authority (RBA), of the Kenbright Individual Provident Fund ("the Fund") — an RBA-approved individual retirement savings scheme, approved to receive NSSF Tier 2 contributions under Scheme Reference Certificate no. RBA/RSC/0443. Where we handle data for the Fund we do so under the Fund's Trust Deed and Rules, the Retirement Benefits Act and this policy; see Kenbright Individual Provident Fund below.

Contact us about anything in this policy at [email protected] or in writing at ACK Garden House, 1st Ngong Avenue, Upperhill, Nairobi. For the Fund, contact the pension team at [email protected] or 26th Floor Prism Towers, 3rd Ngong Avenue, Upperhill, P.O. Box 28281 – 00200 Nairobi.

What we collect

We only collect what we need to respond to your enquiries, give you a quote, issue and service a policy, process a claim or payment, assess and administer pension scheme membership, consider job applications, and meet our legal obligations.

  • Identity & contact details — your name and title, date or year of birth, gender, national ID / passport / KRA PIN where required, phone number, email and physical or postal address (including town/city).
  • Enquiry & contact details — when you use a contact form, request a call-back or "talk to an expert", or subscribe to updates on our website: your name, contact details and the message or interest you share.
  • Recruitment data — if you apply for a role with us: your CV, qualifications, and the details in your application.
  • Cover-specific details — depending on the service you use, for example: vehicle registration, make, model, year and value (motor); family composition and dates of birth (health); travel dates and destinations (travel).
  • Pension scheme application & membership details — if you apply to join the Kenbright Individual Provident Fund: your employment information, contribution preferences and chosen fund manager, and source-of-funds information required for anti-money-laundering compliance. After enrolment we also collect your KRA PIN, a copy of your ID or passport, and the beneficiary details you nominate — names, dates of birth, relationships, ID numbers, allocations and contact information.
  • Beneficiary and dependant details — where a product or scheme requires them, the details of the people you name (you confirm you have their permission to share these).
  • Payment information — processed securely through regulated payment providers (for example M-PESA and card processors). We do not store full card numbers.
  • Documents you upload — for example ID copies, logbooks, claim photos, invoices and medical or repair documents, used to bind cover or assess a claim.
  • Account & security data — your login credentials, and (if you enable it) a biometric unlock preference. Biometric data itself stays on your device and is never sent to us.
  • Device & usage data — device type and operating system, app version, crash and diagnostic logs, and how you use the app, used to keep it working and to improve it (analytics only fire with your consent — see Cookies & tracking below).
  • Location — only if you grant permission, and only to help with location-based features such as finding a nearby garage or roadside assistance. You can turn this off at any time in your device settings.

How we use your data

We use your data to:

  • respond to your enquiries, requests and call-back forms;
  • provide quotes and let you compare cover;
  • issue, renew and service your policies, and hold your Certificates of Insurance / cover documents;
  • assess and process your application to join the Kenbright Individual Provident Fund and, once it is approved, administer your membership, contributions, benefits and beneficiary nominations in accordance with the Fund's Trust Deed and Rules;
  • process payments, refunds and commissions;
  • receive, assess and pay claims;
  • if you use Kenbright App as an agent, attribute the business you write and calculate your commission;
  • send you service messages (quotes, confirmations, renewal and payment reminders, claim updates) and — only if you opt in — marketing;
  • consider and process job applications;
  • meet our legal, regulatory and anti-money-laundering / "know your customer" obligations;
  • detect and prevent fraud, and keep the app and your account secure;
  • and, where you have consented, understand and improve how Kenbright App works.

Depending on the activity, we rely on: performance of a contract with you (to quote, bind and service cover, and to process and administer your Fund membership); compliance with a legal obligation (insurance, retirement benefits, tax, AML/KYC and record-keeping law); our legitimate interests (securing the app, preventing fraud, improving our services); and your consent (marketing, optional analytics, location, and any special-category data such as health information). Where we rely on consent, you can withdraw it at any time.

Who we share it with

We share your data only as needed to deliver the service, and we require everyone who receives it to protect it:

  • Underwriters / insurers — to quote, bind and service your policy and settle claims.
  • Scheme parties — for the Kenbright Individual Provident Fund: the Fund itself, its trustees, your chosen fund manager, the custodian and the scheme auditor, so that your membership, contributions and benefits can be administered.
  • Other Kenbright channels and services — where you use more than one product, your profile is shared across the platform that powers Kenbright App and our channel storefronts (such as `vehicle.co.ke` and `afya.co.ke`) so you do not have to re-enter it.
  • Payment providers and banks — to take payments and pay out claims and commissions.
  • Service providers — cloud hosting, SMS/email delivery, analytics and customer-support tools that act on our instructions under contract.
  • Regulators and authorities — the IRA, ODPC, RBA, tax authorities, courts or law enforcement where the law requires it. This includes disclosures we are legally compelled to make under Kenyan law or an applicable foreign law — without limitation the United States' Foreign Account Tax Compliance Act (FATCA) or any similar law in a relevant jurisdiction, any anti-money-laundering legislation, and any data protection legislation.
  • Professional advisers — auditors, lawyers and actuaries, under confidentiality.

We never sell your personal data.

International transfers

Some of our service providers may process data outside your country. Where they do, we make sure an adequate level of protection applies, as required by the Data Protection Act, 2019 (for example through appropriate safeguards or your explicit consent).

How long we keep it

We keep your data for as long as you have an account and, after that, for as long as the law requires us to (insurance, retirement benefits, tax and AML records generally must be kept for at least seven years after a policy, membership or relationship ends). Records of the Kenbright Individual Provident Fund are kept for the periods set by the Fund's Trust Deed and Rules and the Retirement Benefits Act. An application you start but never submit is deleted when the draft expires — 30 days after the last save. When we no longer need data, we securely delete or anonymise it. See Account & data deletion below.

How we protect it

We use encryption in transit, access controls, and secure, regulated infrastructure. Payments run through PCI-DSS-compliant providers. Pension application data is held in access-controlled cloud infrastructure, and the identity documents you upload are held in private storage reachable only by authorised members of our pension administration team. No system is perfectly secure, but we work hard to protect your data and will notify you and the ODPC of any breach that the law requires us to report.

Kenbright Individual Provident Fund

This section covers the Kenbright Individual Provident Fund online application and the membership that follows from it. Everything above applies; this section adds the detail specific to the Fund.

What the application data is used for. The information you submit through the online application — your personal and contact details, employment information, contribution preferences, chosen fund manager, source of funds, beneficiary nominations and your ID or passport copy — is used solely to assess your application and to administer your membership of the Fund, in accordance with the Fund's Trust Deed and Rules and applicable law, including the Data Protection Act, 2019. We use it to contact you about your application and your membership, and to meet our KYC/AML and tax obligations.

Where it is kept. Application data is stored in access-controlled cloud infrastructure and encrypted in transit. Your uploaded identity document is held in private, access-controlled cloud storage and is accessible only to authorised members of the Kenbright pension administration team.

Confidentiality. We treat all your personal information as private and confidential — including after you are no longer a customer. Nothing about your accounts, nor your name and address, is disclosed to anyone except:

  • to the Kenbright Individual Provident Fund and any other member of the permitted parties in any jurisdiction; and
  • where we are legally compelled to disclose information under Kenyan law or any foreign law applicable from time to time — including, without limitation, the United States' Foreign Account Tax Compliance Act (FATCA) or any similar law in any relevant jurisdiction, any anti-money-laundering legislation, and any data protection legislation.

We do not sell your data.

Your draft application. Your application is saved against a private resume link. Anyone holding that link can view and edit the draft, so keep it to yourself. If you decide not to proceed, you can simply let the draft expire — drafts are deleted 30 days after the last save — or email us to have it removed sooner.

Contact. Data queries about the Fund: [email protected], or Kenbright Insurance Brokers Limited, 26th Floor Prism Towers, 3rd Ngong Avenue, Upperhill, P.O. Box 28281 – 00200 Nairobi.

Cookies & tracking

The Kenbright website (`kenbright.africa`) and the Kenbright App use cookies and similar technologies. On the web these are small text files stored on your device; in the app the equivalents are software development kits (SDKs), device identifiers and local storage. We use four categories:

  • Strictly necessary (always on) — required for the app and site to work: signing you in, keeping your session secure, remembering your country, fraud prevention. These cannot be switched off.
  • Preference — remember your settings, such as language, country and display choices.
  • Analytics (consent-based) — help us understand how people use Kenbright App so we can improve it, including crash and performance diagnostics. Used only with your consent. This may include tools such as Google Analytics / Firebase.
  • Marketing (consent-based) — used only if you opt in, to measure and (where relevant) personalise our communications.

The first time you use the app or visit the website we ask whether you accept optional (analytics and marketing) cookies; strictly necessary cookies run either way. You can change your choice at any time — in the app under More → Settings → Privacy, on the website through the cookie banner or "Cookie settings" link, and through your device's own tracking and ads controls. Withdrawing consent does not affect processing that already took place.

Push notifications (for example renewal reminders, payment confirmations and claim updates) rely on a device token rather than a cookie. You can turn them on or off in your device settings or under More → Settings.

Your rights

Under the Data Protection Act, 2019 you have the right to:

  • access the personal data we hold about you;
  • correct data that is inaccurate or out of date;
  • delete your data (subject to records we must keep by law) — see Account & data deletion below;
  • object to or restrict how we process your data;
  • withdraw consent at any time (for marketing, analytics, location or special-category data);
  • data portability — receive your data in a portable format; and
  • lodge a complaint with the ODPC (`www.odpc.go.ke`) if you are unhappy with how we handle your data.

You can also withdraw an application you have not submitted to the Kenbright Individual Provident Fund by simply letting your draft expire — drafts are deleted 30 days after the last save.

To exercise any of these, email [email protected], or [email protected] for the Fund. We will respond within the timeframe the law requires.

Account & data deletion

You can delete your Kenbright App account and the personal data associated with it at any time.

In the app (fastest): open Kenbright App, go to More → Settings → Account, tap Delete account, and confirm. You will receive an email confirming the request.

By email: send a request from the email address on your account to [email protected] with the subject "Delete my account". We may ask a question or two to verify your identity first, so that no one but you can delete your account.

Once verified, we delete or irreversibly anonymise the data linked to your account — your profile and contact details, saved quotes, preferences and app settings, uploaded documents we are not required to keep, and device identifiers and analytics tied to you.

What we must keep, and why. Because Kenbright is a licensed insurance broker and a registered pension scheme administrator, some records cannot be deleted on request: insurance, financial and transaction records (policies bound, premiums, claims) and pension scheme records (membership, contributions, benefits and beneficiary nominations) must be retained for the period set by insurance, retirement benefits, tax and anti-money-laundering law — generally at least seven years after the policy, membership or relationship ends — along with anything we need to establish, exercise or defend legal claims or to satisfy a regulator (IRA, ODPC, RBA, tax authority). These are access-restricted, used only for those purposes, and deleted once the required period ends.

Important: deleting your account does not cancel a live insurance policy, and does not end your membership of the Kenbright Individual Provident Fund. To cancel or transfer a policy, contact us first so we can handle it properly with the insurer (see the cancellation and refund terms in our Terms of Service). Fund membership ends only as provided in the Fund's Trust Deed and Rules — contact [email protected].

Website enquiries (no account). If you contacted us through the website — a contact form, call-back request or job application — and never created an app account, email [email protected] to access, correct or delete the enquiry or application data we hold about you.

Children

Our services are not intended for people under 18. We do not knowingly create accounts for children. Where a product covers a child (for example a dependant on a health or motor policy), we collect that child's details from the responsible adult, who confirms they may share them.

Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "last updated" date and, for significant changes, notify you in the app or by email.

Contact us

Questions, requests or complaints about your data — or anything else in this policy — reach us here. We respond within the timeframe the law requires.

Privacy and general enquiries — [email protected]

Kenbright Individual Provident Fund (pensions) — [email protected] · +254 709 783 000

Registered office — Kenbright Insurance Brokers Limited, ACK Garden House, 1st Ngong Avenue, Upperhill, Nairobi

Pension team office — 26th Floor Prism Towers, 3rd Ngong Avenue, Upperhill, P.O. Box 28281 – 00200 Nairobi

Talk to An Expert