Privacy policy

Effective date: 28 October 2026 Last updated: 28 October 2026

1. Introduction

Obd2Center Limited ("Obd2Center", "we", "us", "our") operates the OBD2 Center File Tuning Platform at https://app.obd2-center.net. This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit our website, register an account, submit ECU or TCU files, purchase file tuning services or contact us. We are committed to handling personal information responsibly and in accordance with applicable data-protection laws, including Kenya's Data Protection Act, 2019, where applicable. Where applicable law requires consent for a particular processing activity, we will obtain that consent separately.

2. Information we collect

The information we collect depends on how you use the Platform.

2.1 Account information

We may collect: — Name or business name. — Email address. — Telephone number, where provided. — Username and account identifiers. — Authentication information, stored using appropriate security measures. — Account preferences and settings.

2.2 Vehicle and technical information

When you submit a file tuning request, we may collect: — Vehicle manufacturer, model and year. — Engine type and configuration. — ECU or TCU manufacturer and part number. — Hardware and software identifiers. — Calibration identifiers. — Original BIN files and other supported file formats. — Requested tuning modifications. — Technical analysis results. — Modified files and file-processing history. — Order references and troubleshooting information. ECU and TCU files may contain proprietary or technical information. They are not necessarily personal data by themselves, but may constitute personal data if they contain or can be linked to an identifiable individual. Please avoid uploading personal information that is not necessary for your request.

2.3 Payment and transaction information

Our service involves collecting: — Order numbers and transaction references. — The price of each file service. — Payment amounts and currencies. — Payment status. — Account balance, balance top-ups, deductions and any bonus credit granted or reversed. — Billing information needed for invoicing. — Refund and payment-dispute records. — Limited information supplied by the payment provider to verify transactions. Payments are processed by PayPal. PayPal collects card and payment account details directly and handles them under its own terms and privacy policy. We do not receive or store complete payment card details. What we keep is the information needed to match a payment to your order and balance, such as the transaction reference, amount, status, fees and the payer's name and email address as reported to us by the payment provider.

2.4 Technical and usage information

When you use the Platform, we or our service providers may collect: — IP address. — Browser type and version. — Device and operating-system information. — Login dates and times. — Pages and features accessed. — Error logs and diagnostic information. — Security events. — Cookie identifiers and similar technologies, where used. We use this information for security, troubleshooting, service improvement and other purposes described in this policy.

2.5 Communications

We may retain messages sent through email, contact forms, support tickets or other customer-service channels. These records help us respond to enquiries, resolve technical problems, investigate disputes and maintain appropriate business records.

3. How we use your information

We may use personal information for the following purposes. Providing file services: creating accounts, processing file tuning orders, analysing submitted files, delivering modified files and managing downloads. Processing payments: confirming payments, maintaining your account balance and its history, maintaining transaction records, issuing invoices and handling refunds. Customer support: responding to enquiries, diagnosing file issues and resolving complaints. Security and fraud prevention: detecting unauthorised access, investigating suspicious transactions and protecting accounts, files and systems. Operating the Platform: maintaining infrastructure, diagnosing errors, improving reliability and developing service features. Legal compliance: maintaining required records, responding to lawful requests and meeting legal obligations. Service communications: sending order confirmations, payment notifications, file delivery notices, security alerts and important policy updates. Marketing: sending promotional communications where permitted by law and obtaining consent where required. We will not use personal information for unrelated purposes incompatible with the original collection purpose unless permitted by applicable law.

4. Legal basis for processing

Where applicable law requires a legal basis for processing, we rely on the basis appropriate to the activity. This may include: — Contract: processing necessary to provide a file tuning service you request. — Legal obligation: processing required by applicable laws or regulations. — Legitimate interests: processing reasonably necessary for security, fraud prevention, service improvement and business administration, provided your rights and interests are appropriately considered. — Consent: processing activities for which consent is required, including certain marketing and optional tracking activities. Where processing is based on consent, you may withdraw your consent subject to applicable law. Withdrawal does not invalidate processing that was lawful before withdrawal.

5. Handling uploaded ECU and TCU files

Uploaded ECU and TCU files are central to our service. We use submitted files to fulfil the relevant order, including technical inspection, modification, quality checks, delivery and customer support. We may retain file-related information to maintain order history, investigate technical problems, prevent fraud and comply with legal obligations. Our handling principles include: — Limiting access to authorised personnel and service providers who need access for legitimate operational purposes. — Using appropriate security measures when transmitting and storing files. — Not selling customer-uploaded files. — Not publishing submitted files publicly without an appropriate legal basis or authorisation. — Not using identifiable customer files for unrelated purposes merely because they were uploaded to the Platform. Where appropriate and technically feasible, we may use anonymised or aggregated technical information to improve our services. If external technicians or service providers process files on our behalf, access is limited to what is reasonably necessary and subject to appropriate contractual and security safeguards.

6. Sharing personal information

We do not sell personal information to third parties. We may share information where necessary and lawful with the following.

6.1 Service providers

These may include website hosting providers, cloud-storage providers, payment processors, file-processing services, email providers, customer-support systems and security services. They process personal information only for authorised purposes under appropriate contractual and legal safeguards.

6.2 Professional advisers

We may share relevant information with lawyers, accountants, auditors, insurers or other professional advisers where reasonably necessary.

6.3 Legal and regulatory authorities

We may disclose information where required by law, a valid court order or another lawful request, or where reasonably necessary to protect legal rights, prevent fraud or address serious security incidents.

6.4 Business transfers

If our business undergoes a merger, restructuring, acquisition or sale of relevant assets, information may be transferred as part of that transaction, subject to applicable privacy obligations. We will not disclose personal information to unrelated third parties for their independent marketing without an appropriate legal basis.

7. International data transfers

The Platform uses service providers and infrastructure located outside Kenya. As a result, personal information, including uploaded files, may be processed or stored in other countries. Where personal information is transferred internationally, we implement the safeguards and legal requirements applicable to the transfer, including requirements under Kenyan data-protection law or other applicable legislation. You may ask us which countries are involved and what safeguards apply, using the contact details in this policy, and we will tell you.

8. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, unless a longer period is required or permitted by law. Different categories of information may have different retention periods. For example: — Account information: retained while your account is active and for a reasonable period afterwards where needed for legal, security or dispute-resolution purposes. — Order, balance and payment records: retained for accounting, tax, fraud-prevention and legal-compliance purposes. — Original and modified files: retained for the period necessary to complete the service, provide agreed support, maintain relevant order history or meet legitimate operational and legal requirements. — Support communications: retained as needed to resolve requests and maintain appropriate records. — Security logs: retained for a reasonable period consistent with security and investigation requirements. We may delete or anonymise information when it is no longer required. You should maintain your own secure backups of important files. Unless expressly agreed otherwise, the Platform is not intended to provide permanent file storage. Where deletion is requested, we will assess the request under applicable law and explain any lawful reason why some information must be retained.

9. Data security

We take reasonable technical and organisational measures designed to protect personal information and customer files against unauthorised access, loss, alteration, disclosure and destruction. Depending on the system and risks involved, these measures may include access controls, authentication, secure transmission, storage protections, monitoring, backups, security updates and incident-management procedures. No online service can guarantee absolute security. You are responsible for protecting your account credentials and notifying us if you suspect unauthorised access. If a personal-data breach occurs, we will assess and respond to it in accordance with applicable legal requirements.

10. Cookies and similar technologies

The Platform uses cookies, local storage, session identifiers or similar technologies. These technologies may be used to: — Keep users signed in. — Maintain account sessions and preferences. — Support security and fraud prevention. — Understand how the Platform is used. — Measure performance and diagnose errors. — Support optional analytics or marketing features, where implemented. Essential technologies are necessary for the Platform to function, including signing in and keeping your session. Where required by law, we will obtain consent before using non-essential cookies or similar tracking technologies. You can manage cookies through your browser settings and, where available, our cookie preferences tool. Disabling essential cookies will prevent sign-in and other features from working.

11. Your data-protection rights

Subject to applicable law and any lawful exceptions, you may have the right to: — Be informed about how your personal information is used. — Request access to personal information we hold about you. — Request correction of inaccurate or misleading information. — Request deletion of personal information where legally permitted. — Object to certain processing activities. — Request restriction of processing where applicable. — Withdraw consent where processing is based on consent. — Request information about relevant international transfers. — Lodge a complaint with the relevant data-protection authority. Under Kenya's Data Protection Act, 2019, data subjects have rights including the right to be informed, to access personal data, to object to processing and to request correction or deletion of false or misleading information, subject to applicable legal requirements. To exercise a right, contact us using the details below. We may need to verify your identity before fulfilling a request. We will respond within the period required by applicable law. Some requests may be limited where information must be retained for legal compliance, security or the establishment or defence of legal claims.

12. Children's privacy

The Platform is intended for people legally capable of entering into the relevant service agreement. We do not knowingly collect personal information from children in circumstances where doing so would violate applicable law. If you believe a child has provided personal information inappropriately, contact us so we can assess the situation and take appropriate action.

13. Third-party websites and services

The Platform may contain links to third-party websites, payment services, diagnostic tools or other external services. We do not control the privacy practices of independent third parties. When using an external service, review its privacy policy and terms to understand how it handles your information. This policy governs our own processing activities and does not automatically govern third-party services.

14. Automated processing and file analysis

The Platform uses software and automated processes to inspect files, identify technical characteristics, validate inputs and assist with service delivery. These processes support the technical services you request. We will address legally applicable requirements relating to automated decision-making and individual rights. Automated analysis alone does not guarantee file compatibility, vehicle safety, regulatory compliance or a particular performance outcome.

15. Marketing communications

We may send service-related communications necessary to operate your account or fulfil an order. Promotional messages will be sent only where permitted by applicable law and with consent where required. You may opt out of promotional emails using the unsubscribe mechanism provided or by contacting us. Opting out of marketing will not prevent essential account, transaction, security or legal notices.

16. Changes to this Privacy Policy

We may update this policy when our services, technical systems, data practices or legal obligations change. The revised policy will be published on the Platform with an updated revision date. Where required by law, we will provide notice or obtain consent before implementing a material change. We encourage you to review this policy periodically.

17. Contact information

For privacy questions, access requests, correction requests, deletion requests or complaints, contact: Legal business name: Obd2Center Limited Trading name: OBD2 Center Website: https://app.obd2-center.net General support: support@obd2-center.net Alternative contact: james@obd2-center.net Registered business address: Upper Hill, Nairobi, Kenya Telephone and WhatsApp: +254 722 743 310 Privacy contact: support@obd2-center.net When submitting a privacy request, describe the request clearly and provide enough information for us to identify the relevant account. Do not send passwords or unnecessary sensitive information. You may also contact the relevant data-protection authority if you believe your rights have been violated. For Kenya, information about data-subject rights and complaints is available from the Office of the Data Protection Commissioner at https://www.odpc.go.ke/.