Privacy

Privacy Policy

Effective date: 23 October 2026 · Last updated: 24 October 2026

1. Who we are

MKO KENYA LTD (“MKO”, “we”, “us” or “our”), trading as MKO Kenya Energies, is a company registered in Kenya that supplies TotalEnergies lubricants, Bajaj Boxer motorcycles, and motor-vehicle and motorcycle spare parts, and has branches in Kisii, Busia, Kisumu and Malaba. At its Kisii branch only, MKO also sells filled TotalEnergies LPG (cooking gas) cylinders: 6 kg and 13 kg for households and 50 kg for institutions and larger users. MKO swaps empty TotalEnergies-brand cylinders for filled TotalEnergies-brand cylinders; it does not refill gas and does not swap cylinders of other brands.

This Privacy Policy explains how we collect and use personal data through our website at www.mkokenya.com and the phone, WhatsApp and email contacts shown on it (together, the “Service”). It is written to meet the Data Protection Act, 2019 of Kenya (the “Act”) and the regulations made under it.

For purposes of this Privacy Policy, MKO acts as a data controller in respect of personal data for which it determines the purposes and means of processing.

2. The personal data we collect

“Personal data” means any information that identifies you or could identify you. We collect only what we need for the purposes in section 4.

This website has no forms, accounts or sign-in, and it does not ask you for personal information.

Information you give us

• Contact details — your name, phone number or email address, when you call, WhatsApp or email us.
• Messages — what you send us through email, WhatsApp or phone.

Information collected automatically when you use the Service

• Device and connection details — your IP address, browser, device type, operating system, language and approximate location (town or country).
• Usage details, only if you allow analytics — the pages you view, how far you scroll, links to other websites you click, and your device type, browser and approximate location (town or country), collected by Google Analytics.

This website uses Google Analytics only if you allow it in the “Privacy choices” panel; otherwise it sets no cookies. See our Cookie Notice. Device and connection details are processed by our hosting provider to deliver each page and keep the website secure (see sections 6 and 7, and “Website hosting and connection error reports” below). Apart from remembering your privacy choice, the website stores nothing in your browser's storage; our host's connection error reporting instructions are described below.

Website hosting and connection error reports

Our website is hosted by Cloudflare. As part of its hosting service, Cloudflare adds instructions to each page of the website (called Network Error Logging) that ask browsers which support them to send Cloudflare a short report if a connection to the website fails. The instructions ask for no reports about connections that succeed, and tell the browser to remember them for up to seven days.

According to Cloudflare, such a report can include the address of the page being requested, the page you came from, the type of error (for example, a failed address look-up), how long the attempt took, the request method and the network protocol used. Cloudflare uses the IP address from which the report is sent to work out your network provider, country and metro area, and states that it holds the IP address only while the report is received and does not store it, and that reports are not shared with third parties. The reports go to Cloudflare to help find connection problems on the internet.

Sensitive personal data

Kenyan law treats some personal data as sensitive and gives it extra protection. It covers your race, health, ethnic or social origin, conscience, belief, genetic data, biometric data (such as fingerprints or facial images used to identify you), property details, marital status, family details (including the names of your children, parents or spouse), and sex or sexual orientation. We do not ask for sensitive personal data. Please do not send it to us.

If you do not give us information we need

Some information is needed to provide the Service, for example a phone number or email address so we can reply to you. If you do not give it, we may not be able to provide that part of the Service. We will tell you when information is optional.

3. How we keep you informed before we collect data

Before we collect your personal data, or as soon as practical, we tell you what we are collecting, why, who we share it with, and your rights. This policy is the main way we do that.

4. Why we use your personal data, and our legal basis

The Act allows us to use personal data only when we have a lawful reason. For each purpose below we rely on one main reason, which we decide before we start.

• Providing the Service — showing you the website, and answering your questions when you call, WhatsApp or email us. Legal basis: performance of a contract with you, or steps you asked for before one (s.30(1)(b)(i)).
• Keeping the Service secure — preventing fraud and misuse of the website. Legal basis: our legitimate interests (s.30(1)(b)(vii)).
• Fixing problems — error logs and server diagnostics. Legal basis: our legitimate interests (s.30(1)(b)(vii)).
• Analytics — understanding which pages are used, through optional analytics cookies. Legal basis: your consent (s.30(1)(a)).
• Meeting legal duties — responding to lawful requests from authorities. Legal basis: compliance with a legal obligation (s.30(1)(b)(ii)).
• Protecting rights — establishing or defending legal claims. Legal basis: our legitimate interests (s.30(1)(b)(vii)).

We use your personal data only for the purpose we collected it for, or a compatible one. If we want to use it for a new purpose that is not compatible, we will ask for your consent first.

5. Automated decisions

We do not make decisions about you based solely on automated processing (including profiling) that have legal or similarly significant effects on you.

6. Who we share your personal data with

We do not sell your personal data. We share it only as described here:

• Service providers who process it on our behalf, such as website hosting and email: Cloudflare (website hosting and security); Google (Google Analytics), if you allow analytics; our email service provider (email); and WhatsApp (Meta), for messages you send us on WhatsApp, which we receive through WhatsApp Business. They act only on our written instructions under a written contract that requires them to keep the data confidential and secure.
• Professional advisers, such as lawyers, auditors and accountants, who are bound by confidentiality.
• Authorities, such as the Kenya Revenue Authority, the courts or the police, when the law requires it or we must protect our or others' rights.
• A buyer or investor, if all or part of our business is sold, merged or financed. They must protect your data as this policy describes.
• Others you ask us to share with, or with your consent.

7. Transfers outside Kenya

We may engage service providers who process or store personal data outside Kenya. Where this occurs, any transfer of personal data outside Kenya shall be undertaken in accordance with the Data Protection Act, 2019 and the applicable regulations, including the requirements relating to the protection of personal data transferred outside Kenya.

For example, our website runs on Cloudflare's global network, so your data may be processed in other countries. Google Analytics data may be processed in other countries, including the United States. Messages you send us by email or WhatsApp may also be processed outside Kenya by those services.

In particular, we transfer personal data outside Kenya only where the Act allows, mainly:

• where appropriate safeguards are in place, such as a binding contract with the recipient that protects your data to a standard essentially equivalent to Kenyan law. We keep records of each such transfer and provide them to the ODPC on request; or
• where the transfer is necessary, for example to perform a contract with you or one made in your interest; or
• where you have explicitly consented, after we have told you the possible risks.

Some countries do not protect personal data as strongly as Kenya does, which is a risk of any transfer. We transfer sensitive personal data outside Kenya only with your consent and confirmed safeguards. We also require recipients not to transfer your data onward without our permission.

8. How long we keep your personal data

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires. When we no longer need it, we delete it or make it anonymous.

Apart from remembering your privacy choice, the website itself stores nothing about visitors.

• Messages and contact details you send us by phone, WhatsApp or email — normally deleted within seven days if the enquiry does not lead to a continuing engagement. If you are a continuing client, they are kept while the engagement continues, so that we can answer you and keep a record.
• Website analytics (only if you allow it) — 2 months in Google Analytics, to improve the Service.
• Technical request records processed by our hosting provider (Cloudflare) — held by Cloudflare under its own terms, to deliver the website, keep it secure and fix problems.
• Connection error reports sent by browsers to Cloudflare (section 2) — Cloudflare states that it does not store the IP address; the rest of each report is held by Cloudflare under its own terms, to find connection problems.

9. How we protect your personal data

We use technical and organisational measures to protect your personal data, including encryption in transit (HTTPS), a security policy that stops the website loading content from other companies' servers (except Google Analytics, only after you allow it), and a website that stores no visitor data of its own. No system is completely secure, but we work to keep risks low and review our measures regularly.

10. If there is a data breach

If a breach of your personal data creates a real risk of harm to you, we will notify the ODPC within seventy-two hours of becoming aware of it, and tell you in writing as soon as reasonably practical, unless the law allows us to delay (for example during a criminal investigation) or our safeguards, such as encryption, mean you are not at risk. We will explain what happened, what we are doing about it, what you can do to protect yourself, and who to contact.

11. Your rights

Under the Act, you have the right to:

• Be informed — know how your personal data is used. This policy does that.
• Access — get a copy of your personal data and details of how we use it, who receives it and how long we keep it. We respond within 7 days, free.
• Correction — ask us to correct data that is wrong, out of date, incomplete or misleading. Within 14 days, free (if we refuse, we tell you why within 7 days).
• Deletion — ask us to delete data we no longer need, that you withdrew consent for, that you objected to, or that was processed unlawfully. Within 14 days, free.
• Object — ask us to stop using your data for a purpose. You can always object to marketing, and we will stop. Within 14 days, free.
• Restrict — ask us to pause using your data, for example while we check its accuracy. Within 14 days, free.
• Data portability — receive your data in a structured, commonly used, machine-readable format, or have it sent to another organisation. Within 30 days; we may charge a reasonable fee no higher than our cost.
• Not be subject to automated decisions — ask for a person to review a decision made solely by automated means that significantly affects you (see section 5).
• Withdraw consent — at any time, with immediate effect for future processing. For analytics, use the “Privacy choices” link at the bottom of every page.
• Deal with us anonymously — ask to use the Service without being identified, where that is practical. We will consider each request.

To use any of these rights, contact us at admin@mkokenya.com or write to us at P.O. BOX 1658, 40200 Kisii. You may also use the ODPC's forms (Forms DPG 1 to DPG 5). We may ask you to confirm your identity before we act. Someone you have authorised, or a parent or guardian for a child, can make a request for you.

If we cannot fully agree to a request, we will tell you why in writing and remind you of your right to complain to the ODPC.

12. Children

The Service is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Complaints

If you are unhappy with how we handle your personal data, please contact us first at admin@mkokenya.com so we can try to put it right. We aim to give an initial response within three working days; resolving a complaint may take longer.

You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), orally or in writing. The ODPC is required to investigate and conclude a complaint within ninety days. Its current contact details are published on its website, www.odpc.go.ke.

If you suffer damage because we broke the Act, you may be entitled to compensation.

14. Links to other sites

The Service may link to websites and services run by others. We are not responsible for how they handle personal data, so please read their privacy policies.

On this website, those links are: phone numbers, which open your phone's calling app and are handled by your mobile network; the WhatsApp link, which opens WhatsApp (Meta); the email link, which opens your email app; the directions links for Kisii, Kisumu and Busia, which open Google Maps; and, on the LPG page, links to the TotalEnergies Kenya website (totalenergies.ke) for its LPG safety guidance, information about LPG and frequently asked questions, which open that website (run by TotalEnergies). The website does not tell those services which page you were on.

15. Changes to this policy

We may update this policy. If we make an important change, we will tell you on the Service before it takes effect, and update the date at the top. Where a change needs your consent, we will ask for it.

16. How to contact us

• Company: MKO KENYA LTD, trading as MKO Kenya Energies
• Email: admin@mkokenya.com
• Phone: Kisii +254 798 119 156 · Busia +254 706 492 112 · Kisumu and Malaba +254 727 302 543
• WhatsApp: +254 798 119 156
• Post: P.O. BOX 1658, 40200 Kisii

See also our Terms of Use and Cookie Notice.