Privacy Policy

1 Introduction & Regulatory Scope

This Privacy Policy sets out how Daris Insurance Agency ("we", "us", "our") collects, holds, utilizes, processes, and protects any personal data and sensitive information that you provide to us when visiting our website, requesting insurance quotes, interacting with our customer representatives, purchasing insurance covers, or utilizing our Client Self-Service Portal.

By accessing our services or submitting details via our web forms, telephone inquiries, or branch offices (Gilgil, Nakuru, and Dundori), you acknowledge and agree to the data collection and processing practices described herein.

2 Information We Collect

In order to evaluate risk, process insurance quotes, arrange underwriter coverage, issue instant digital certificates, and administer your policy, we may collect the following categories of information:

• Individual Identifiers: Full legal name, National Identity Card Number (ID No.), Alien ID or Passport Number, date of birth, gender, and Kenya Revenue Authority (KRA) PIN.
• Contact Details: Primary phone number, WhatsApp contact, postal address, physical residential address, and email address.
• Insurable Asset & Risk Data:
  • Motor Vehicle Insurance: Vehicle registration number, logbook details, vehicle make, model, year of manufacture, carrying capacity, chassis number, engine rating, and valuation reports.
  • Medical Insurance: Relevant health declarations, beneficiary information, age brackets, and designated healthcare facilities.
  • Life & Education Covers: Sum assured details, policy term, nominated beneficiaries, and age certificates.
  • Property & Business: Property location, occupancy type, building structure, inventory valuation, and security measures.
• Client Self-Service Credentials: Policy ID numbers, encrypted authentication passwords, account activity, and certificate download histories.
• Technical & Analytical Data: IP address, device operating system, browser type, referring URL, and pages visited on our portal.

3 How We Use Your Data

We process your personal information strictly for legitimate commercial and insurance operational purposes, including:

• Quote Comparison & Brokering: Comparing premiums, terms, deductibles, and benefits across licensed Kenyan insurance underwriters to find the best match for your needs.
• Underwriting & Policy Issuance: Preparing policy proposal forms, submitting applications, and issuing digital motor insurance certificates (DMVIC) and policy documentation.
• Client Relationship & Servicing: Sending renewal alerts, policy schedule updates, premium payment confirmations, and handling customer support inquiries.
• Claims Assistance: Facilitating claim notifications, documentation reviews, assessor appointments, and following up on settlement disbursements with insurers.
• Regulatory & Statutory Compliance: Meeting statutory reporting requirements established by the Insurance Regulatory Authority (IRA), the Kenya Revenue Authority (KRA), and anti-money laundering (AML) directives.

4 Legal Grounds for Processing

Under Section 30 of the Kenya Data Protection Act 2019, our lawful bases for collecting and processing your personal data include:

• Contractual Performance: Necessary for the execution, administration, or performance of an insurance contract or to take pre-contractual steps at your request (such as providing an insurance quote).
• Statutory & Legal Obligations: Mandatory compliance with the Insurance Act (Cap 487), IRA directives, and tax regulations.
• Legitimate Interests: Improving our digital advisory platforms, preventing fraudulent insurance claims, and maintaining website security.
• Explicit Consent: Where you voluntarily choose to opt into informational notifications, promotional offers, or advisory newsletters.

5 Sharing with Underwriters & Third Parties

We never sell, rent, or trade your personal data to third-party marketing companies. In the routine course of our insurance agency operations, data is only shared with:

• Authorized Insurance Underwriters: Reputable licensed insurance companies in Kenya (e.g., Jubilee Insurance, APA Insurance, Britam, CIC Insurance Group, Madison Insurance, GA Insurance, Pioneer Insurance, and others) for policy binding and risk assessment.
• Regulatory Authorities: The Insurance Regulatory Authority (IRA) and statutory bodies as compelled by legal subpoena or Kenyan statute.
• Authorized Service Providers: Trusted technology partners, telecommunications SMS gateway providers (for renewal and OTP delivery), and IT infrastructure hosting compliant with stringent confidentiality and data protection covenants.

6 Information Security & Confidentiality

Daris Insurance Agency deploys modern technological, organizational, and physical safeguards designed to protect personal information against accidental loss, unauthorized access, destruction, or disclosure.

• All web traffic across our website and Client Self-Service Portal is transmitted over secure 256-bit SSL/TLS encryption.
• Portal passwords and sensitive credentials are encrypted using industry-standard hashing protocols.
• Access to client records is restricted strictly to authorized advisory personnel with verified role-based access permissions.

7 Data Retention

We retain personal data and policy documents only for as long as necessary to fulfill the purposes for which they were collected, or as mandated by Kenyan law. In accordance with the Insurance Act (Cap 487) and limitations periods for contractual claims in Kenya, policy records and claims documentation are retained for a minimum of seven (7) years following policy expiry or final settlement of claims.

8 Your Statutory Rights

Pursuant to the Kenya Data Protection Act, 2019, you enjoy specific legal rights regarding your personal information:

• Right to be Informed: To understand how your personal data is collected and processed.
• Right of Access: To request a copy of the personal information we hold about you.
• Right to Rectification: To request prompt correction of inaccurate, incomplete, or out-of-date personal data.
• Right to Erasure: To request the deletion of your data where no overriding legal or regulatory justification for its retention exists.
• Right to Object: To object to data processing based on legitimate interest or direct marketing.

9 Cookies & Portal Tracking

Our website utilizes essential session cookies to maintain login sessions for the Client Self-Service Portal, remember your interface preferences, and analyze general website performance. You have the ability to accept or decline cookies through your browser settings, though disabling essential session cookies may impact the functionality of portal authentication.

10 Contacting Our Data Team

If you have questions, feedback, or would like to exercise any of your statutory rights regarding this Privacy Policy, please contact our Data Protection and Compliance team: