Working draft · Version draft-2026-10-24 · Not effective
Who handles personal data
The legal identity and contact details of Vuta's data controller are awaiting confirmation. This notice covers buyers, vendor and shipper staff, and people who contact support. It must be revised after a real data inventory and provider list are complete.
Data and purposes
The planned service may use account identifiers and contact details for sign-in and messages; names, addresses and order details for purchase and delivery; payment references for reconciliation; permit and business evidence for partner review; case messages and photos for complaints; and device, security and activity records for reliability and fraud prevention. Vuta should collect only what each purpose needs. The actual lawful basis for each purpose must be recorded before launch; marketing consent must be separate from service messages where required.
Sharing and international processing
Only the details needed for an assigned task should reach a vendor, shipper, payment provider, verification provider or support operator. Hosting and operations may involve processing outside Kenya, including the staging database in Ireland. Before live processing, Vuta must document actual recipients, locations and a lawful transfer basis with appropriate safeguards where required. Verification documents should remain private and available only to authorized reviewers and chosen providers.
Retention and security
Vuta intends to restrict access, log sensitive actions and protect private records. No retention period or deletion schedule is approved yet. A final notice must state how long each data category is kept or the criteria used, including records that must be retained for legal, accounting, fraud or dispute reasons. It must also describe incident contact and notification arrangements accurately.
Your choices and rights
People may ask to be informed about use of their data, access it, object to processing, correct inaccurate information and request deletion where applicable. Other rights and limits depend on the final processing context and law. Vuta must provide a working contact and identity-check process before the notice becomes effective. A request should not be silently treated as complete by a preview screen. People can also raise a data protection complaint with Kenya's Office of the Data Protection Commissioner.
Contact and updates
The privacy contact, controller registration status, rights-request procedure, recipient list, retention schedule and effective date are pending. Approved versions should remain available when the notice changes.