Privacy Policy

1. Who We Are & Scope

Bamboo Insurance Agency Ltd ("Bamboo", "we", "us", or "our") is an insurance intermediary licensed and regulated by the Insurance Regulatory Authority (IRA) of Kenya under the Insurance Act (Cap 487). We operate from Prudential Assurance Building, Wabera Street, Nairobi, Kenya.

This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you visit our website (bambooinsagency.com), request quotations, purchase policies, submit insurance claim forms, or upload supporting documentation.

2. Information We Collect

To provide accurate insurance quotes, issue binding covers, and advocate for your claims, we collect several categories of information:

• Contact & Identification Data: Full name, national identity number (ID) / passport number, KRA PIN, email address, mobile telephone numbers, and physical/postal address.
• Risk & Underwriting Information: Details of insured assets (e.g., motor vehicle logbooks, registration numbers, chassis numbers, property location, sum insured values, travel itineraries, and occupation).
• Claims Information & Supporting Files: Date of loss, policy number, description of incident, police abstract reports, surveyor reports, repair cost estimates, hospital discharge summaries, medical invoices, death certificates, and photographs of damage.
• Financial Data: M-Pesa transaction codes, bank payment references, and premium remittance records (we do not store credit card CVVs).
• Technical & Usage Data: IP address, browser type, operating system, and interaction timestamps when navigating our website.

3. Lawful Basis & Purpose of Processing

We process your personal data under the following legal bases recognized by Kenyan law:

1. Contractual Performance: To evaluate risk profiles, obtain competitive quotations from underwriters, bind insurance coverage, issue policy certificates, and administer your insurance contracts.
2. Claims Processing & Advocacy: To process claims notifications, verify loss circumstances, lodge claims documentation with underwriters, and expedite fair settlement payouts.
3. Legal & Regulatory Compliance: To comply with mandatory Know Your Customer (KYC), Anti-Money Laundering (AML/CFT) laws, and reporting obligations required by the IRA and the Financial Reporting Centre (FRC).
4. Legitimate Interests: To improve our service offerings, prevent fraudulent claims, and provide timely renewal reminders.

4. Document & File Upload Handling

When you submit files through our online claims or quote portal (such as PDFs, images, or documents):

• All file transmissions are encrypted in transit using Transport Layer Security (TLS/HTTPS).
• Files are stored on secure servers with restricted administrative access and strict permission controls.
• Files are accessed exclusively by authorized Bamboo claims officers and transmitted securely to the underwriting insurer assessing your claim.

5. Sharing with Underwriters & Third Parties

As an independent insurance agency, we act as an intermediary between you and licensed underwriters. We only disclose your information to:

• Insurance Underwriters: Licensed Kenyan and international insurance companies (e.g., Jubilee, APA, Britam, CIC, GA, Heritage, Old Mutual, Madison, etc.) to quote and underwrite your policies.
• Loss Assessors & Adjusters: Certified motor assessors, risk surveyors, and loss adjusters appointed to inspect damaged property or assess claims.
• Statutory Authorities: The Insurance Regulatory Authority (IRA), Kenya Revenue Authority (KRA), or law enforcement agencies when legally required by subpoena or court order.

We never sell, lease, or rent your personal information to third-party marketing companies.

6. Data Security & Retention

We implement technical and organizational security controls designed to protect personal data against unauthorized access, loss, or alteration. These measures include server firewalls, encrypted database connections, access logging, and regular vulnerability checks.

Retention Period: In line with Kenyan statutory guidelines for financial and insurance records, policy and claim documents are retained for the duration of the policy term plus seven (7) years following expiration or claim closure, after which they are securely archived or destroyed.

7. Your Data Subject Rights

Under the Kenya Data Protection Act 2019, you have specific rights regarding your personal information:

• Right to be Informed: To know what data we collect, why, and how it is processed.
• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request prompt correction of inaccurate, outdated, or incomplete data.
• Right to Erasure / Deletion: To request deletion of your personal data where there is no statutory or contractual obligation for us to retain it.
• Right to Object: To object to data processing for direct marketing purposes.

8. Cookies & Website Analytics

Our website utilizes essential cookies and lightweight analytics to ensure site functionality, remember form preferences, and analyze aggregate traffic patterns. You may adjust your browser settings to decline cookies, although some interactive features of our portal may function with limited efficiency.

9. Contact Our Data Protection Officer

If you have questions, requests, or concerns regarding this Privacy Policy or wish to exercise any of your data rights, please contact our compliance desk:

If you feel your request has not been satisfactorily resolved, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya (www.odpc.go.ke).