Working draft · Version draft-2026-10-24 · Not effective
Requesting information or a change
The final service must offer a real contact route for people to ask what personal data Vuta holds, request access, correct inaccurate records, object where applicable and request deletion where applicable. Vuta must verify the requester before disclosing or changing private records and explain any lawful limitation on a request. The contact channel and response workflow are not yet operating in the preview.
Retention schedule
Before launch, Vuta must approve a schedule covering account data, order and payment records, private permits, listing media, conversations, support cases, audit records and backups. The schedule should state a period or clear criterion, the reason for keeping each category, deletion or anonymization method and any legal hold. No blanket period is promised in this draft.
Data sharing and transfers
The privacy notice must identify actual recipients and processing locations. Cross-border transfers require an assessed legal basis and suitable safeguards where required. Vendor and shipper access should be limited to assigned work and revoked when that work or role ends.
Complaints
The final process must identify Vuta's data protection contact. People may also contact Kenya's Office of the Data Protection Commissioner about a data protection concern. Preview Help text and forms do not submit a data-rights request.