Privacy policy

1. Who handles your information

Seven Fortune is operated by MijiniTech Limited. Contact our privacy and support team at sevenfortunem@gmail.com. Our configured business address is NextGen Mall, 2nd Floor, Suite 15 & 16, Mombasa Road, Nairobi, Kenya. On partner-branded sites, the named fleet company also handles data and rental services in its own capacity; contact details appear in the footer and booking confirmation.

This global core applies wherever you use Seven Fortune. Our privacy approach follows GDPR principles: lawful, fair and transparent use, limited purposes, minimal collection, accuracy, limited retention, security and accountability. Regional supplements below explain additional protections where the relevant law applies. This notice does not claim that GDPR governs every transaction or that all countries' compliance requirements have been satisfied. Rental availability depends on the suppliers and countries actually offered on the site.

This notice covers the Seven Fortune website, customer accounts, rental and import enquiries, fleet onboarding, payments, inspections and support. Seven Fortune determines how platform account and booking-support data is used. The identified fleet supplier is responsible for its rental operations and may act as a separate controller. Ask us for help identifying the responsible party.

2. Information we collect

Rental reviews are optional. We store your chosen public name, rating, review text, publication permission and a private link to the completed booking. Only an approved public name, rating, text and publication date appear on the vehicle page. Your booking reference, email and identity documents are not included in the public review.

We collect the details you provide: name, email, phone, country, profile photo, booking dates and times, pickup or delivery address, intended usage area, chosen vehicle and extras, messages and support correspondence. Where required to assess a rental, we collect driving-licence and identity details and documents, inspection photos and signatures. Fleet applications include business details, staff and contact information.

Payment services return transaction references, amounts, currencies and payment status. Enter card or payment credentials only with the payment provider; do not send them in messages. Authentication providers supply account identifiers and, when you use Google sign-in, the profile details you authorise. Hosting and security services may process IP addresses, browser information, request logs and error records.

3. Why we use data and the lawful basis

Your consent permits publication of your optional rental review. We use the completed booking to verify eligibility and legitimate interests to moderate relevance, spam, abuse and personal information, applying the same standards to positive and negative ratings. Editing hides the published review until moderation. Withdrawing through your reservation removes the name, rating and text from our review record and public display. A minimal booking-linked status and moderation audit may remain for fraud prevention and dispute handling under the retention principles below; cached copies held independently by search engines may take time to disappear.

Contract and steps you request before a contract: responding to enquiries, managing accounts, assessing necessary driver eligibility, arranging a rental, processing payments and refunds, inspections and service updates. Required contact and eligibility details may be necessary to provide the requested service; without them we may be unable to confirm the rental. Optional features are not required. Legal obligations: applicable accounting, tax, regulatory and lawful disclosure requirements. Legitimate interests: proportionate security, fraud prevention, record accuracy and resolving disputes, balanced against your rights.

Consent: optional third-party address suggestions and any separately offered promotional communications or non-essential tracking. You can decline optional features, type an address manually, and withdraw consent. Accepting rental terms is not consent to marketing. We do not use rental requests as permission to send promotions. Service messages about your booking may still be necessary.

4. Who receives information

We share necessary booking and eligibility information with the identified fleet supplier and, where needed, assigned drivers and service partners. Authorised staff use it to operate the service. Infrastructure providers include Google Firebase / Google Cloud for authentication, database, file storage and hosting; MailerSend for email; Meta WhatsApp services where WhatsApp messaging is used; and Paystack or PayPal when you choose those payment routes.

Google Maps / Places receives address search text and technical information only when you enable address suggestions. Suppliers and payment providers may have their own notices. We may disclose information when required by law or necessary for legal claims. We do not sell your personal information. Do not include another person's information unless you have authority to provide it.

5. International processing

Our operator is based in Kenya. Infrastructure, communications, fleet and payment providers may process information in Kenya or other countries. Transfers must meet applicable requirements, including Kenyan safeguards and, where GDPR applies, its international-transfer rules. Depending on the transfer, an adequacy decision or appropriate safeguards such as applicable standard contractual clauses and additional measures may be required. Accepting this notice or enabling a feature is not blanket consent to international transfers.

Contact our privacy team for the recipients, processing locations and safeguards relevant to your data, including how to obtain a copy of applicable safeguards. We do not claim that every destination has equivalent laws or that unreviewed provider arrangements are approved.

6. How long information is kept

We retain information only for its purpose and applicable legal requirements. Account details support your active account. Booking, payment and inspection records may be needed to perform the rental, reconcile payments, meet tax or accounting duties and handle legal claims. Enquiries are retained for responding and reasonable follow-up. Identity documents should be retained only as long as needed for eligibility verification or a documented legal or claims requirement.

When assessing deletion, we explain any records retained, the reason and the applicable retention period or criteria. Account closure does not automatically cancel a booking or extinguish payment obligations. Backups and provider records may require separate handling; we will explain relevant limitations. Browser booking drafts last for the tab session; identity-document numbers and files are not saved in those drafts.

7. Your rights wherever you use Seven Fortune

Use our privacy centre to request access and a copy, correction, deletion of eligible data or account closure, restriction, objection, consent withdrawal, portability or human review of an automated decision. You may email us without an account. The same request channel is available globally; statutory rights and exceptions depend on applicable law. Requests through our current service are free. Exercising a privacy right will not itself result in a penalty or discriminatory treatment.

We aim to respond without undue delay: access within 7 days; deletion, correction, restriction, objection, consent withdrawal and human-review requests within 14 days; portability within 30 days or one calendar month, whichever is sooner. A shorter applicable legal deadline takes priority. These are shared service targets; regional supplements explain statutory requirements. We do not automatically extend deadlines or restart them after identity checks.

Response targets are not permission to continue consent-based processing after valid withdrawal or direct marketing after a valid objection. We act promptly on those choices and any required restriction. For optional address suggestions, stop using the suggestions and reload the page to return to manual entry without loading the optional feature again.

We verify identity proportionately before disclosure or changes and explain lawful refusals or retention. Do not submit passwords, payment credentials or identity-document uploads in the form. An authorised representative may contact us with evidence of authority. Optional region information helps assess protections; nationality, selected region, browser language or IP address alone does not determine your rights.

8. European Union / EEA supplement

EU GDPR applies where its territorial conditions are met, including relevant processing connected with an EU/EEA establishment, or offering goods or services to people in the EU/EEA or monitoring their behaviour there. Website accessibility or citizenship alone does not establish these conditions. Where it applies, this supplement adds to the global core; mandatory GDPR protections prevail.

GDPR rights include access, rectification, erasure, restriction, portability and objection, subject to their conditions. Portability covers qualifying automated processing based on consent or contract. You may object to legitimate-interest processing on grounds relating to your situation; direct-marketing objections must be respected. Consent may be withdrawn without affecting the lawfulness of prior processing. For solely automated decisions with legal or similarly significant effects, you may request the applicable safeguards, including human intervention where required.

Requests require action without undue delay and normally within one calendar month of receipt. A limited extension of up to two further months for complexity or number of requests requires notice and reasons within the initial month; it does not override another applicable shorter deadline. Our shared targets remain earlier. Refusals must explain reasons and complaint and judicial remedies. You may complain to a competent EU/EEA supervisory authority, particularly in your habitual residence, workplace or the place of the alleged infringement, without contacting us first. Authority contacts are listed at www.edpb.europa.eu/about-edpb/about-edpb/members_en.

9. Kenya supplement

Kenya's Data Protection Act, 2019 and General Regulations, 2021 continue to apply where their scope is met, including relevant processing by our Kenyan operator. Global wording or a selected region does not remove those obligations. Kenyan periods include access within 7 days; erasure, rectification, restriction and objection within 14 days; portability within 30 days. Refusal notices for correction and portability require attention within 7 days. Consent withdrawal must be handled promptly under applicable rules.

You may complain directly to the Office of the Data Protection Commissioner at www.odpc.go.ke; contacting us first is optional. Kenyan lawful-processing, retention, security, transfer and registration requirements remain applicable alongside other relevant law.

10. Other regions and overlapping protections

The global core and privacy centre remain available wherever you use our service. Additional mandatory rights depend on the processing, our operations and your circumstances. Contact us to identify relevant requirements or regulators. Choosing Another region or declining to select one waives no right. We assess overlapping laws and honour applicable shorter deadlines. Entry into a new market requires local privacy and consumer review; this notice does not claim compliance with every country's law.

11. Security, children and automated decisions

We use authenticated server access for private records and restricted access to identity documents. No online service can guarantee absolute security. Report suspected exposure or misuse through our support contact promptly; we assess incidents and meet applicable notification requirements.

Account holders must be at least 18. Driver eligibility and any higher supplier age requirement must be confirmed before a rental. The service is not directed at children; contact us if a child has supplied personal information. Availability checks can automatically reserve dates, but are not a final decision on eligibility or a guarantee of service. We do not currently use solely automated processing for decisions with legal or similarly significant effects about you. Any change would require updated information and applicable safeguards. You can ask for human review of booking or verification issues.

12. Updates

The version date appears on this page. Material changes apply prospectively and will be communicated where required. We seek fresh consent when a new optional purpose requires it.