Kestavar Ltd ("Kestavar", "we", "us" or "our") is a technology company incorporated in the United Kingdom. We design and build digital products across fintech, digitisation, software development and analytics.
This Privacy Notice explains how we handle personal data through:
the Kestavar corporate website, kestavar.com; and
Waively, our forthcoming digital service available at waively.co.uk.
Waively is currently in pre-launch development. It is not yet available as a live customer service and, as at the date of this Notice, Kestavar does not process customer personal data through Waively or process payments through Waively.
We will update this Notice before Waively launches, and where necessary thereafter, to reflect the processing that actually takes place.
The relevant data controller for personal data processed by Kestavar in connection with its own purposes is:
If you have questions about how we use your personal data, or wish to exercise your data protection rights, please contact us at:
Where a particular processing activity is carried out by Kestavar on behalf of a fleet operator, bank, insurer or other partner, the relevant organisation may instead be the controller of that processing. In those circumstances, Kestavar may act as a processor on that organisation's behalf.
Our role depends on the particular processing activity. We do not determine our status simply by the terminology used in a contract.
The Kestavar website is a corporate information website.
We do not currently use the website for advertising or behavioural tracking and do not use analytics or advertising scripts.
If you contact us by email, we may process information that you provide to us, such as:
the contents of your message; and
We use this information to respond to enquiries, communicate with you and manage our business relationships.
We do not use information submitted by email for unrelated purposes without a lawful basis to do so.
Waively is being developed to help private drivers and fleet operators manage and pay UK road-related charges, including charges such as the Congestion Charge, ULEZ charges, Dartford Crossing charges and airport drop-off charges.
A core feature of Waively is reconciliation: identifying the individual who was driving a vehicle at the time a particular charge arose, rather than relying solely on the registered keeper of the vehicle.
Depending on the final service configuration, Waively may process information relating to:
information supplied by fleet operators, financial institutions, insurers or other partners; and
We will only collect and use information that is reasonably necessary for the purposes for which it is processed.
Depending on how you access and use Waively, we may process personal data to:
comply with legal and regulatory obligations; and
We will not use vehicle, journey or location information for purposes that are incompatible with those described in this Notice unless we have a lawful basis to do so and provide any additional information required by law.
In some circumstances, we may receive personal data about you from another organisation rather than directly from you.
For example, this may occur where:
a telematics provider supplies relevant vehicle or journey information; or
Where we receive personal data from another source, we will provide the privacy information required by applicable data protection law, subject to any applicable legal exception.
Where Kestavar acts as a controller, we will process personal data only where there is a lawful basis for doing so under applicable data protection law.
Depending on the circumstances, this may include:
Performance of a contract: where processing is necessary to provide a service or take steps at your request before entering into a contract.
Legitimate interests: where processing is necessary for a legitimate interest pursued by Kestavar or a third party, provided that the individual's interests, rights and freedoms do not override that interest.
Legal obligation: where processing is necessary for compliance with a legal obligation applicable to us.
Consent: where we rely on consent, we will ask for it where required and explain how it may be withdrawn.
The applicable lawful basis will depend on the particular processing activity. We will not treat consent as a substitute for another appropriate lawful basis where consent is not required.
Where another organisation is the controller and Kestavar acts solely as its processor, the controller is responsible for determining the applicable lawful basis.
Where Waively is supplied to a fleet operator, the fleet operator may determine the purposes for which driver and vehicle information is processed.
In such circumstances, Kestavar may process personal data on the fleet operator's documented instructions.
The fleet operator may therefore remain responsible for determining matters such as:
how long information should be retained; and
Kestavar will not use fleet customer data for its own unrelated purposes merely because it has access to that data.
The precise allocation of controller and processor responsibilities will be documented contractually before the relevant service is launched.
Waively may be made available through third-party applications, including applications operated by banks, fintech businesses or insurers.
Where another organisation determines the purposes and means of processing, that organisation may be a controller and Kestavar may act as its processor.
In other circumstances, Kestavar and the relevant organisation may each act as separate controllers, or may jointly determine particular processing activities.
The applicable relationship will depend on the actual processing arrangements rather than simply on the existence of an integration or commercial partnership.
Some Waively functionality may require information about vehicles, journeys or locations.
We recognise that location and movement information can provide detailed information about an individual's activities and may therefore require particular care.
We will seek to apply data minimisation, purpose limitation, access controls, retention limits and appropriate technical and organisational safeguards to this information.
Before launching functionality involving systematic or extensive monitoring, location tracking, data matching or similar higher-risk processing, we will assess the processing and complete a Data Protection Impact Assessment ("DPIA") where required.
Waively is currently pre-launch and does not currently process payments.
If payment functionality is introduced, we will update this Notice to explain:
the applicable retention periods; and
Where payment functionality involves regulated payment services, it will be provided only on a legally compliant basis, including through appropriately authorised or registered providers where required.
Kestavar has operations and personnel in Nigeria.
Where personal data subject to UK data protection law is accessed from, transferred to, or otherwise made available to an organisation outside the UK, we will assess whether the activity constitutes a restricted international transfer and apply the safeguards required by applicable law.
Where required, this may include appropriate contractual safeguards, transfer assessments and supplementary technical or organisational measures.
We will not transfer UK personal data internationally merely because personnel are located overseas without first assessing the applicable transfer requirements.
Depending on the service and the circumstances, we may share personal data with:
regulators, courts, law-enforcement bodies or other authorities where required or permitted by law; and
Where a third party processes personal data on our behalf, we will put in place appropriate contractual arrangements and require appropriate security and confidentiality measures.
We will retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to satisfy legal, regulatory, accounting or reporting requirements.
Retention periods will depend on the nature of the information and the purpose for which it is processed.
We will establish specific retention periods or criteria for determining those periods before relevant Waively processing begins.
We use appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure.
Depending on the nature of the information and the risks involved, these measures may include access controls, authentication, encryption, logging, segregation of data, secure development practices, monitoring and incident-management procedures.
No method of transmission or storage can be guaranteed to be completely secure. We will nevertheless continually assess and improve our security measures in light of the risks associated with our processing.
Depending on the circumstances and applicable law, you may have rights including:
to request portability of certain personal data; and
You may exercise applicable rights by contacting us at:
If Kestavar is acting as a processor on behalf of another organisation, we may refer your request to that organisation or assist that organisation in responding to your request, as required by applicable law and our contractual arrangements.
If you have concerns about our use of your personal data, please contact us first so that we can investigate the matter.
You also have the right to complain to the UK's data protection regulator:
We may update this Privacy Notice from time to time to reflect changes in our services, processing activities, technology or legal obligations.
When we make material changes, we will take reasonable steps to bring them to your attention.
Last updated: 17 September 2026