Privacy Policy

This Privacy Policy explains how Kenya Revenue Authority - Customs and Border Control (the “Operator”, “we”, “us”) collects and processes personal data when you use the KRA ACD platform (the “Platform”) to apply for and manage cargo tracking and customs declaration documents (CTN / ECTN / ACD).

• Identity and contact data: name, email address, mobile phone number, country.
• Account data: organisation name, invoice address, tax/VAT information, account settings.
• Verification data: phone verification (OTP) status and related records.
• Application and shipment data: the information you enter into applications.
• Uploaded documents and their contents (see “Uploaded Documents” below).
• Payment-related data: transaction references, amounts and balance records. We do not store full card details — card payments are handled by our payment providers.
• Technical data: IP address, browser and device information, and security/audit logs.
• Support communications you send to us.

• Creating, verifying and managing user accounts, including phone number verification.
• Processing CTN/ECTN/ACD applications and reviewing submitted customs and shipping documentation.
• Communicating with you about your applications and account.
• Processing payments and maintaining your platform balance.
• Preventing fraud, abuse and unauthorised access, and securing the Platform.
• Providing customer support.
• Meeting legal, regulatory, accounting and audit obligations.
• Maintaining and improving the Platform’s security and reliability.

Documents you upload — such as Bills of Lading, commercial invoices, freight invoices and packing lists — may contain company information, contact details, shipper and consignee information, commercial information and personal data belonging to third parties. We process this data for the purpose of providing the requested CTN/ECTN/ACD service, including review of the documents and submission of application data to the competent authorities.

By uploading a document you confirm that you are legally permitted to submit it and to share the data it contains for this purpose.

Uploaded documents and application data may be analysed by automated systems, including third-party artificial-intelligence services, to classify documents, extract data, and check applications for consistency, completeness and signs of fraud. The results support — but do not replace — review by our personnel: decisions on applications and registrations are made with human involvement.

We share personal data with service providers that are required to operate the Platform, acting on our behalf and under appropriate obligations. These include:

• payment providers (such as Stripe) for card payments and receipts;
• SMS providers for phone verification codes;
• email delivery providers for transactional email;
• cloud hosting, storage and database providers;
• document analysis (AI) service providers;
• monitoring, logging and security services;
• customer support ticketing providers.

Application data and documents are also transmitted to the customs, port or government authorities involved in issuing the requested certificate, as required to provide the service.

Your personal data may be processed or stored outside your country, including on infrastructure and by service providers located in other jurisdictions. Where required by applicable law, we use appropriate safeguards for such transfers.

We retain personal data — including account data, application and shipment records, uploaded documents, payment and accounting records, and security logs — only for as long as necessary for the purposes described in this policy, including providing the service and meeting legal, regulatory, accounting and security requirements. Retention of application records may also be subject to the requirements of the competent customs authorities.

Depending on the laws applicable to you, you may have rights regarding your personal data, such as the right to access, correct or delete it, to restrict or object to its processing, and to data portability. To exercise these rights, contact us using the details in the Contact section below. We may need to verify your identity before acting on a request, and some data may be exempt from these rights where we are required to retain it.

The Platform uses only strictly necessary cookies — for authentication, session management and security (including bot-protection on sign-in and registration forms). We do not use analytics, advertising or tracking cookies.

We use reasonable technical and organisational safeguards to protect personal data, including encrypted connections, access controls and security logging. No system can be guaranteed to be completely secure, but we work to protect your data against unauthorised access, loss and misuse.

We may update this Privacy Policy from time to time. The effective date at the top of this page shows when the current version came into force. Material changes may be communicated through the Platform.

For privacy requests and questions about this policy, contact the Operator at info@acd.kra.go.ke, or by post to Mombasa, Kenya.