Legal
Last updated: 14 September 2026
Rocky Driving School (“Rocky”, “we”, “us”) is a driver training provider operating across Kenya, NTSA certified and NITA accredited, training learners since 1994. For the purposes of the Data Protection Act, 2019, Rocky Driving School is the data controller of the personal data described in this policy.
Factory Street, Industrial Area, Nairobi
Email: info@rockyschool.co.ke
Telephone: 0702 55 22 22 · 0700 66 77 77 · 0748 01 98 11
Monday–Friday 8:00–18:00 · Saturday 8:00–16:00
How we collect, use, share and protect personal data when you visit rockydrivingschools.com, send us an enquiry, pay fees, enrol in and attend a course at any Rocky branch, or contact us by phone, email or WhatsApp.
When you enquire: your name, phone number, email address, preferred branch, the course you are interested in, and anything you choose to write in your message.
When you pay fees: the student’s name, the phone number used to pay, an email address for your receipt, the amount paid, and the M-PESA or other transaction code. We use these only to match your payment to your enrolment and issue an official receipt.
We do not collect or store your M-PESA PIN, your card number, or your full bank account number. No Rocky staff member will ever ask you for your M-PESA PIN. If anyone does, it is not us — please contact us immediately on 0702 55 22 22.
When you enrol and train with us: identification documents required for NTSA registration, your date of birth, a photograph, an emergency contact, attendance and lesson progress records, instructor assessments, and any certificates issued.
Automatically, when you use the website: your IP address, browser and device type, the pages you visit, and cookie data.
Rocky offers training for Persons with Disabilities. If you enrol in that programme, or tell us about a medical condition or accessibility need so that we can adapt your training or vehicle safely, we treat that information as sensitive personal data. We collect it only with your explicit consent and only what we genuinely need, share it only with your assigned instructor and where the law requires, and never use it for marketing. You may withdraw that consent at any time, though it may limit our ability to adapt your training.
To respond to your enquiry; to enrol you and deliver your course; to take and reconcile fee payments and issue receipts; to register you with NTSA and meet our training record obligations; to keep attendance and assessment records; to adapt training where you have asked us to; to send you our newsletter where you have subscribed; to investigate complaints or incidents; and to prevent fraud.
Our lawful bases under section 30 of the Act are, depending on the purpose: your consent, performance of our contract with you, compliance with a legal obligation, and our legitimate interests.
We do not sell your personal data. We share it only with the National Transport and Safety Authority and the National Industrial Training Authority where the law requires; with SasaPay (ViewTech Limited), our payment service provider, in order to receive and verify your fee payments; with Google, which provides the analytics we use to understand how this website is used; with WhatsApp (Meta Platforms, Inc.) where you have chosen to contact us there; with our website hosting and email providers; with our professional advisers where strictly necessary; and with law enforcement, courts or regulators where we are lawfully required to do so.
Some of the services above process data outside Kenya, in particular WhatsApp, Google Analytics, and our email and hosting providers. Where we transfer personal data outside Kenya we do so in accordance with sections 48 and 49 of the Data Protection Act, 2019.
We keep personal data only for as long as it is needed for the purposes set out above, and for any period we are required to retain it by Kenyan law — which includes student training records and financial records. When a retention period ends we securely delete or anonymise the data.
This website uses the essential cookies needed for it to function, and Google Analytics, which sets cookies to measure how the site is used. We also use Burst Statistics, which counts visits without setting any cookie at all and keeps that data on our own server. We do not run advertising trackers and we do not sell or share your browsing data for advertising. You can block or delete cookies in your browser settings, though blocking essential cookies may stop parts of the site working. If your browser sends a ‘Do Not Track’ signal, neither analytics tool records your visit. If we add advertising cookies in future, we will update this policy and ask for your consent where required.
We use HTTPS encryption across the site, restrict access to staff who need it for their role, keep our software updated, take regular backups, and review our security measures. No system is perfectly secure, and we cannot guarantee absolute security.
If a breach occurs that poses a real risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as required by section 43 of the Act, and will notify you directly where the law requires.
Under the Data Protection Act, 2019 you have the right to be informed about how your data is used; to access the data we hold about you; to have inaccurate or incomplete data corrected; to request deletion of data we no longer have a lawful reason to keep; to object to processing based on our legitimate interests, and to direct marketing at any time; to receive your data in a portable format; and to withdraw your consent where consent is our legal basis.
To exercise any of these, email info@rockyschool.co.ke or call 0702 55 22 22. We may ask you to verify your identity first — this protects you, because we will not hand your records to someone claiming to be you. Some records we are legally required to keep and cannot delete on request; where that applies we will tell you why.
Please contact us first at info@rockyschool.co.ke so we can try to put things right. You also have the right to complain to the Office of the Data Protection Commissioner, whose current contact details are published at www.odpc.go.ke.
Our courses are for learners who meet the minimum legal age set by NTSA for the licence class they are training for. We do not knowingly collect data from children except where a parent or guardian provides it in connection with a lawful enrolment.
We may update this policy from time to time. The date at the top always reflects the current version.
Pick a course and we will take you straight to enrolment. Fees can be paid by M-PESA.
Rather talk to someone? 0702 55 22 22 WhatsApp us