Version November 2024

At MIDAS Kenya, we are aware that in order to use your data, we need your trust. That's why we apply the strictest criteria to the confidentiality of personal data and only use your information for the purposes described below, respecting your fundamental right to the protection of your privacy and your Personal Data.

In accordance with current regulations on the protection of Personal Data, this Privacy Policy explains what personal information we collect about you, how and why we use it, to whom we disclose it and how we ensure the protection of your privacy.

Our Privacy Policy applies to personal information collected and used directly by the Midas Kenya network, consisting of Midas Kenya and its Franchisees.

WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?

MIDAS Kenya:

CROWN MOTORS GROUP

A LIMITED LIABILITY COMPANY INCORPORATED IN THE SAID REPUBLIC

AND A POST OFFICE BOX NUMBER 26353 00504 NAIROBI - KENYA

CROWN MOTORS GROUP coordinates the activities of the MIDAS network in Kenya. It is the Franchisor of the Midas network and as such signs a Franchise Agreement with its Franchisees, which are legally independent companies offering services and products to MIDAS customers. Midas Kenya and its network are therefore jointly responsible for processing the personal data concerning you that you yourself have provided during your visit or when requesting services at a center. The list of Midas KENYA centers is available for consultation.

MIDAS Kenya is the Licensee of the IT solution used in the network to collect Personal Data and is also jointly responsible for processing.

MESA, S.P.A., with registered office at Corso Savona, 85/1 - 10024 - Moncalieri (TO), Turin, Italy, as Master Franchisor and owner of the MIDAS License and IT System.

2. WHO WILL RECEIVE YOUR PERSONAL DATA?

The data collected is intended for the internal services of Midas Kenya and the Midas network and for Mesa S.p.A in order to provide you with a quality service.

Midas Kenya may share your Personal Data with service providers duly authorized by Midas Kenya and use subcontractors (any company that processes Personal Data in accordance with the instructions and on behalf of Midas Kenya) to process all or part of the Personal Data to the extent necessary for the performance of their services.

By way of example: to host a site, to provide services related to the operation of the site or to carry out satisfaction surveys on behalf of Midas Kenya and/or to send Midas Kenya commercial offers.

Providers and subcontractors are contractually bound to respect the confidentiality and security of the Personal Data they may receive and to use it exclusively for the purposes of the services entrusted to them by Midas Kenya.

In the event that Personal Data concerning you is transferred to subcontractors domiciled outside the European Union, a Personal Data transfer contract is signed by the subcontractor in order to maintain the same level of protection of your Personal Data as that provided by Midas Kenya in accordance with Kenyan legislation.

Except in the cases set out above, Midas Kenya also undertakes not to transfer your Personal Data to third parties without your consent.

Please note that the MIDAS Kenya web portal, the Point of Sale do not allow you to modify and/or save centrally your preferences concerning the use of your data by the Midas Centre directly. If you have any questions or wish to make changes, please contact Midas Kenya directly.

HOW IS YOUR PERSONAL DATA COLLECTED?

We collect your Personal Data on various occasions:

When you request a service directly from a Midas center in the Kenyan network or by telephone, when you are picked up at the center to create your entry in our customer file, to issue your invoice and to manage the follow-up of the service and the product warranty.
When you ask us for a quote for a service, either at the center or on the web.
When creating a loyalty card or applying for a financing program.
With your consent, when you browse our website and accept cookies.
When you request an appointment online, use the simulators on our website, and/or contact us directly, via the website or via our customer service department, to request information about our products and services.
When you participate in our direct marketing campaigns, for example by filling in a reply coupon or by taking part in a promotion on our website or in a competition, and you fill in a form with your personal data.
When you provide us with your vehicle details (including VIN number).
When other legal entities of Mobivia Groupe (to which MESA S.p.A belongs) or its subsidiaries or other business partners provide us with your personal data, with your consent.

Midas Kenya products and services, as well as promotional campaigns, are primarily intended for adults. In this respect, we only collect and process your Personal Data if you are at least 16 years old. Midas Kenya reserves the right to verify the age of persons who provide us with Personal Data. Any information concerning a child under the age of 16 will be deleted.

WHAT PERSONAL DATA IS COLLECTED ?

The personal data collected about you through the various Midas Kenya services made available and the communication/contact channels described in this Charter are as follows:

Contact details

Last name, first name, address, ID card or passport number, telephone number, e-mail address.

Your vehicle data

Information on your vehicle's current characteristics (license plate, VIN, mark, model, mileage, etc.).

Vehicle technical data

Information on your vehicle's current operation and performance, or its history

Information on services provided

Information on products, services, vehicle maintenance, your level of satisfaction, complaints or requests for technical assistance.

Use of the website and communications

Data about how you use our site; whether you open and/or forward our messages; information collected through cookies and other tracking technologies.

Using the Midas Connect application and services

The way you use your connected device and the services it offers, the geolocation of your vehicle when you activate it

Images

Midas Kenya shops are equipped with surveillance cameras that collect images of the center to ensure security and surveillance.

5. WHAT ARE THE PURPOSES OF PROCESSING?

a. Service provision

Your identity, your contact details and your vehicle's technical data are required to take charge of the customer, identify the parts compatible with your vehicle, make an appointment and carry out the service. Your data comes from the information you have provided and from the technical interventions of our employees and partners in the Midas Kenya network.

They are necessary for the correct management of the service carried out, its follow-up, invoicing, payment and the warranty attached to the service. Please note that communications sent on the progress of the work carried out on your vehicle are not made for commercial purposes and that, consequently, you will continue to receive them even if you ask not to receive commercial communications.

The processing of this data is based on the existence of a contractual relationship (diagnosis and/or invoice) and on the need to manage this relationship correctly.

b. Quality control and satisfaction surveys

Your opinion is very important to us. We may therefore send you an e-mail or SMS to ask for your opinion on the Midas service.

To improve our services and our customers' experiences, Midas Kenya may use the data collected for satisfaction surveys, market research, quality control of existing products and services and the development of new products and services.

This processing is based on Midas Kenya's legitimate interest in responding to our customers' requests and expectations, to improve our services and our customers' experiences.

c. Customer service, commercial relations, promotions and communications

In order to respond to your inquiries, service complaints, introduce new products and send you promotional offers on our products and services, Midas Kenya collects your data, vehicle maintenance information, website usage information and social network communications. We may use your personal information to tailor our services to your needs and preferences, but also to provide you with a personalized customer experience with content related to Midas Kenya products and services and your vehicle, and to determine the most interesting offers for you and contact you accordingly.

Customer service and complaint handling are based on the existing contractual relationship and its follow-up.

The processing of your Personal Data as part of the management of the commercial relationship, the sending of MIDAS promotions and advertising offers by electronic means (sms, e-mail) and/or by post is carried out on the basis of the legitimate interests of Midas Kenya if, in your capacity as Midas Kenya Customer, you have not wished to oppose the receipt of Midas Kenya service offers and promotions.

If you are not a Midas customer, your Personal Data will only be processed for commercial purposes if you have given your explicit consent.

d. Geo-marketing studies

Data collected by Midas such as your vehicle's technical data or data concerning products and services used for statistical purposes will be anonymized prior to use.

. Compliance with legal and regulatory obligations

All those responsible for processing personal data are subject to the laws of the countries in which they operate and are required to comply with them. Your transaction and payment data, your service history and information relating to the service (nature of the service, identity and contact details of the customer, means of payment, history, risk scoring relating to means of payment) may be used by Midas Kenya as part of the fight against payment fraud.

These legal obligations include the communication, in certain circumstances, of personal data to judicial, regulatory or supervisory bodies.

This data processing is based on Midas Kenya's legal obligation to cooperate with these bodies.

6. HOW WE PROTECT YOUR DATA ?

MIDAS Kenya takes protective measures to ensure the confidentiality and security of your Personal Data and to prevent such Data from being damaged, deleted or accessed by unauthorised third parties.

MIDAS Kenya and its subcontractors take all reasonable steps to maintain physical, electronic and process safeguards to ensure that your Data is protected in accordance with legal requirements.

The measures we use include, among others:

● Access to Personal Data is strictly limited to employees, agents and representatives authorised by virtue of their functions and who are bound by an obligation of confidentiality.

● Encryption of transferred data wherever possible.

● Installing security and protection systems on our IT tools ("firewalls").

● Installing alarm systems in our offices and centres.

● Frequent monitoring of access to IT systems to detect any intrusion or unauthorised use of data.

If you have accessed your account on our site or any other application or service under our control, you are responsible for maintaining the secrecy and confidentiality of your password.

7. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

MIDAS will keep your Personal Data in a secure environment for as long as is necessary for the purposes for which it was collected, or for the minimum retention period required by applicable law, in particular civil and commercial law.

If your data is used for different purposes, we will use the longer retention period.

Purposes related to the provision of services and the existence of a contractual relationship: your Personal Data will be kept for the duration of the contractual relationship (invoice), and for a period of 5 years following the last intervention, unless otherwise stipulated by law.
Purposes relating to commercial marketing, the sending of communications and commercial offers: your Personal Data will be kept for 5 years after the last contact by the customers concerned, unless you exercise your right to object before the end of this period.
For billing purposes, your personal data will be kept for a period of 10 years in accordance with our legal obligations.

8. COOKIES

We may store some information (using "cookies") on your computer when you visit our websites. This enables us to recognise you during subsequent visits. The type of information gathered is non-personal (such as: the Internet Protocol (IP) address of your computer, the date and time of your visit, which pages you browsed and whether the pages have been delivered successfully.

We may also use this data in aggregate form to develop customised services - tailored to your individual interests and needs. Should you choose to do so, it is possible (depending on the browser you are using), to be prompted before accepting any cookies, or to prevent your browser from accepting any cookies at all. Please note that if you choose to remove or reject cookies, this could affect the functionality of our website.

9. WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?

Subject to legal and contractual exceptions, you have rights under data protection laws in relation to your personal data. These are listed below:

Right to be informed that we are collecting personal data about you;
Right to access personal data that we hold about you and request for information about how we process it;
Right to request that we correct your personal data where it is inaccurate or incomplete;
Right to request that we erase your personal data noting that we may continue to retain your information if obligated by the law or entitled to do so;
Right to object and withdraw your consent to processing of your personal data. We may continue to process if we have a legitimate or legal reason to do so;
Right to request restricted processing of your personal data noting that we may be entitled or legally obligated to continue processing your data and refuse your request;
Right to request transfer of your personal data

If you wish to exercise any of the rights set out above, please contact us on jnunda@midaskenya.com.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within timelines set forth in the Data Protection Regulations 2021.

Occasionally it could take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

If you have any other questions concerning this Notice, please contact us as per the below:

CROWN MOTORS GROUP

A LIMITED LIABILITY COMPANY INCORPORATED IN THE SAID REPUBLIC

AND A POST OFFICE BOX NUMBER 26353 00504 NAIROBI - KENYA

Battery Installation – Book Your Appointment Today