This Privacy Policy describes how Dynamique Insurance Brokers Ltd. (“Dynamique,” “We,” “Us,” or “Our”), a licensed insurance intermediary regulated by the Insurance Regulatory Authority (IRA) of Kenya, collects, uses, processes, stores and protects personal data when you interact with our automated WhatsApp Bot (the “Service”).

We are committed to complying with the Kenya Data Protection Act, 2019 (DPA), the Data Protection (General) Regulations, 2021, and all applicable insurance regulations. By initiating a conversation with the WhatsApp Bot or by explicitly providing consent (Opt-in), you acknowledge that you have read and understood this Privacy Policy.

1. INTRODUCTION AND SCOPE

This Privacy Policy applies solely to data processed through the Dynamique WhatsApp Bot for the purposes of:

• Providing insurance quotations.
• Facilitating premium payments.
• Issuing KIFWA Bonds or Marine Cargo Insurance (MCI) covers and
• Supporting future insurance products.

By using the Bot, you consent to the collection and processing of your data for the purposes described in this Policy.

2. INFORMATION WE COLLECT

We only collect data that is necessary, adequate and relevant for providing insurance and payment services, in accordance with the Kenya Data Protection Act.

2.1. Personally Identifiable Information (PII)

Category: Contact and Identity

• WhatsApp Phone Number
  Purpose: Contractual necessity (identification, messaging, maintaining conversation flow, linking policies to the correct customer).
• Category: Payment Facilitation
  * M-PESA Payment Request IDs
  * Payment confirmation status
  Purpose: Contractual necessity (tracking premium payments, verifying completion before issuing cover).

2.2. Transactional and Service Data

Category: Insurance Identifier

• IDF Number (Marine Cargo Insurance)
  Purpose: Contractual necessity / legitimate interest (retrieving official MCI quotations, validating a shipment).
• IDF Number (Marine Cargo Insurance)
  Purpose: Contractual necessity / legitimate interest (retrieving official MCI quotations, validating a shipment).

Category: Bond Details

• Bond Cover Amount entered by the user
  Purpose: Contractual necessity (calculating required 0.5% premium).

Category: System Interaction

• Message IDs
• Timestamps
• Type of request
  Purpose: Legitimate interest (fraud prevention, system diagnostics, preventing repeat processing, maintaining service quality).

2.3. Session Data (Temporary)

Category: Bot Session State

• Current interaction step
• Temporary authentication tokens
• Raw API responses needed to complete the service

Purpose: Contractual necessity (ensuring continuity between steps). Retention: Deleted immediately after session ends.

3. HOW WE USE YOUR INFORMATION

We process your personal data strictly for the following purposes:

3.1. Service Fulfillment

• Generating quotations
• Processing payments
• Issuing KIFWA Bonds and MCI insurance certificates

3.2. Transactional Communication

• Sending payment prompts
• Sending quotation details
• Confirming policy issuance

3.3. Security, Audit and Fraud Prevention

• Detecting fraudulent submissions
• Ensuring validity of IDF numbers and payment records
• Protecting against unauthorized access or misuse

3.4. Service Improvement

• Monitoring system performance
• Enhancing user experience
• Troubleshooting and diagnostic logging

We do NOT use your data for marketing unless you provide separate, explicit consent.

4. DISCLOSURE AND SHARING OF INFORMATION

We do NOT sell, rent or trade your personal data. Data is shared strictly on a need-to-know basis with:

4.1. KIFWA / MCI API Provider

Purpose: Validating IDF numbers, retrieving quotations, registering payment intention.

4.2. M-PESA / Safaricom Payment Gateway

Purpose: Initiating premium payments and confirming payment completion.

4.3. Insurer or Underwriter (where required)

Purpose: Issuing certificates, validating customer information and fulfilling regulatory requirements.

4.4. Customer Support Team

Purpose: Human agent assistance when you request “AGENT” or “SUPPORT.”

4.5. Legal or Regulatory Authorities

Purpose: Compliance with statutory obligations, including:

• Orders from courts
• Requirements from IRA
• Statutory audits
• Requests from Kenyan law-enforcement agencies

All disclosures comply with the Data Protection Act and insurance regulatory requirements.

4.5.1. Response to Legal Requests from Public Authorities

Dynamique Insurance Brokers Ltd. is committed to protecting user privacy. Our policy requires a rigorous internal review of the legality and scope of all requests for user personal data received from public authorities, government agencies, or law enforcement in Kenya or internationally.

We have provisions in place to challenge any request that is deemed unlawful, overly broad, or vague. Furthermore, we adhere to the principle of data minimization, disclosing only the minimum information necessary to legally comply with a valid and specific request. All such requests, including our legal reasoning and final response, are documented internally for auditing purposes.

5. DATA STORAGE, SECURITY AND RETENTION

5.1. Security Measures

We implement appropriate technical and organizational safeguards including:

• Encrypted communication using TLS/HTTPS
• Strict access control to internal systems
• Credential and API key protection via environment variables
• Regular system audits and vulnerability monitoring
• Limited employee access based on role-based permissions
• Session isolation to prevent cross-user exposure

Despite our efforts, no system is 100% secure. You acknowledge that transmission over the internet carries inherent risks.

5.2. Data Retention

1. Temporary Data
   Session data is automatically deleted once the transaction ends or after a brief inactivity timeout.
2. Permanent Insurance and Transaction Records
   As required by Kenyan insurance regulations and financial laws, we retain permanent records for a minimum of seven (7) years, including:
   
   • Phone number
   • Payment history
   • Certificate references
   • Policy details

Retention ensures:

• Regulatory compliance
• Fraud investigations
• Customer inquiries
• Audit readiness

6. YOUR RIGHTS UNDER THE KENYA DATA PROTECTION ACT

Under the Kenya Data Protection Act (DPA), you have the following rights:

6.1. Right to Be Informed

You have the right to know how your data is collected and used (fulfilled by this Privacy Policy).

6.2. Right to Access

You may request a copy of the personal data we hold about you.

6.3. Right to Rectification

You may request correction of inaccurate or incomplete information.

6.4. Right to Deletion (“Right to Be Forgotten”)

We may delete your data upon request, except where retention is legally required (e.g., 7-year insurance regulatory retention).

6.5. Right to Withdraw Consent (Opt-out)

You may stop receiving messages at any time by replying “STOP” or “UNSUBSCRIBE”.

6.6. Right to Object to Processing

You may object to certain types of processing, unless legally required for regulatory compliance.

6.7. Right to Data Portability

You may request your data in a commonly used, machine-readable format.

All rights are subject to reasonable verification of identity to protect your privacy.

7. CHANGES TO THIS PRIVACY POLICY

We may update this Policy periodically to reflect changes in the law, technology or our operational practices. The “Effective Date” at the top will indicate the latest revision. Continued use of the Service after changes implies acceptance of the updated Policy.

8. CONTACT INFORMATION

For inquiries, complaints or data requests under the Kenya DPA, please contact:

Dynamique Insurance Brokers Ltd.
Phone: +254 111 053 440
Email: info@dynamiquebrokers.com
Physical Address: 4th Floor, Suite 414, Ngong Road, Nairobi, Kenya
Human Agent Support: Reply “AGENT” in WhatsApp

We will respond to all data-related requests within the timelines required under Kenyan law.