Privacy Policy
Vazaki is committed to protecting the privacy of our users. This privacy policy explains how we collect, use, and share personal information.
A. Privacy Notice
1. About this Notice
This Privacy Notice provides information on how Vazaki collects and processes your personal data when you visit our website or mobile applications. It sets out what we do with your personal data and how we keep it secure and explains the rights that you have in relation to your personal data.
2. Who we are
Vazaki is a Kenyan e-commerce platform. Our platform consists of our marketplace, which connects sellers with consumers, our logistics service, which enables the delivery of packages from sellers to consumers, and our payment service, which facilitates transactions among participants active on our platform in selected markets. This website and/or mobile app is operated by a the Vazaki company. Any personal data provided or collected by Vazaki is controlled by the subsidiary that the website and/or mobile app relates to.
3. The data we collect about you?
Personal data means any information that can be used to identify directly or indirectly a specific individual. We collect your personal data in order to provide tailored products and services and in order to analyse and continually improve our products and services. We may collect, use, store and transfer different kinds of personal data for marketing and personal data optimization purposes. Vazaki also uses Google Digital Marketing to propose targeted offers for certain products and services to our customers.
You provide us with your personal data when you register your personal details on our website and mobile platforms and transact with the same.
The personal data we collect includes:
A. Information you provide to us: We receive and store the information you provide to us including your identity data, contact data, biometric data, geographic location data, delivery address and financial data. These types of personal data may include:
• contact details (such as your name, postal addresses, phone numbers and email addresses),
• demographic information (such as your date of birth, age or age range and gender),
• geographic location (such as your county, town and estate number)
• online registration information (such as your password and other authentication information),
• payment information (such as your credit card information and billing address),
• information provided as part of online questionnaires (such as responses to any customer satisfaction surveys or market research),
• competition entries/submissions, and
• in certain cases, your marketing preferences.
B. Information we automatically collect/generate or obtain from third parties: collect and store certain types of information regarding your use of the Vazaki marketplace including information about your searches, views, downloads and purchases. In addition, we may receive information about you from third parties including our carriers; payment service providers; merchants/brands; and advertising service providers.
These types of personal data may relate to your device (such as your PC, tablet or other mobile device), your use of our websites and apps (as well as certain third party websites with whom we have partnered), and/or your personal preferences, interests, or geographic location. Examples of these types of information include:
• name and age (or predicted age range),
• information about your device, operating system, browser and IP address,
• unique identifiers associated with your device,
• details of web pages that you have visited,
• which products you have looked at online (including information about products you have searched for or viewed, purchased or added to an online shopping basket),
• how long you spend on certain areas of a website or app together with the date and time of your visit/usage,
• personal data contained within user-generated content (such as blogs and social media postings),
• social media user name or ID, and
• social media profile photo and other social media profile information (such as number of followers).
We strive to provide you with choices regarding the Personal Data that you provide to us. Where required by law, if you wish to have your Personal Data used by Vazaki to provide you with a personalized experience/targeted advertising & content, you can indicate so through sending an email to vazaki@Vazaki.com or by answering the question(s) presented by Vazaki representatives. If you decide that you no longer wish to benefit from this personalization, you can opt-out or adjust your preferences at any time by closing your account or by sending an email to vazaki@Vazaki.com
You can close your account by clicking on this link and following the instructions. Once your account is closed, all products and services that you access through your account will no longer be available.
4. Cookies and other Identifiers
A cookie is a small file of letters and numbers that we put on your computer, mobile phone or tablet if you agree. Cookies allow us to distinguish you from other users of our website and mobile applications, which helps us to provide you with an enhanced browsing experience. For more information about cookies and how we use them, please read our Cookie Notice:
5. How We Use Your Personal Data:
We use your personal data to operate, provide, develop and improve the products and services that we offer, including the following:
A. Registering you as a new customer.
B. Processing and delivering your orders.
C. Managing your relationship with us.
D. Enabling you to participate in promotions, competitions and surveys.
E. Improving our website, applications, products and services.
F. Recommending/advertising products or services which may be of interest to you.
G. Enabling you to access certain products and services offered by our partners and vendors.
H. Complying with our legal obligations, including verifying your identity where necessary.
I. Detecting fraud.
6. Legal basis for the processing of Personal Data:
We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the purposes for which we have collected and used your personal data. In almost every case the legal basis will be one of the following:
A. Consent: For example, where you have provided your consent to receive certain marketing from us. You can withdraw your consent at any time, including by clicking on the “unsubscribe” link at the bottom of any marketing email we send you
B. Our legitimate business interests: Where it is necessary for us to understand our customers, promote our services and operate effectively, provided in each case that this is done in a legitimate way which does not unduly affect your privacy and other rights.
C. Performance of a contract with you: This would also apply where we need to take steps prior to entering into a contract with you. For example, where you have purchased a product from us and we need to use your contact details and payment information in order to process your order and ensure the product is delivered to you.
D. Compliance with law: Where we are subject to a legal obligation and need to use your personal data in order to comply with that obligation.
7. How We Share Your Personal Data
A. We may need to share your personal data with third parties for the following purposes:
• Sale of products and services: In order to deliver products and services purchased on our marketplace from third parties, we may be required to provide your personal data to such third parties.
• Working with third party service providers: We engage third parties to perform certain functions on our behalf. Examples include fulfilling orders for products or services, delivering packages, analysing data, providing marketing assistance, processing payments, transmitting content, assessing and managing credit risk, and providing customer service.
• Business transfers: As we continue to develop our business, we might sell or buy other businesses or services. In such transactions, customer information may be transferred together with other business assets.
• Detecting fraud and abuse: We release account and other personal data to other companies and organizations for fraud protection and credit risk reduction, and to comply with applicable law.
B. When we share your personal data with third parties we:
• require them to agree to use your data in accordance with the terms of this Privacy Notice, our Privacy Policy and in accordance with applicable law, and
• Only permit them to process your personal data for specified purposes and in accordance with our instructions. We do not allow our third-party service providers to use your personal data for their own purposes.
8. International Transfers
We may transfer your personal data to locations in another country, if this is permissible pursuant to applicable laws in your location. There are inherent risks in such transfers.
In the event of international transfers of your personal data, we shall put in place measures necessary to protect your data and ensure the same level of protection available in the country of data origin. We shall continue to respect your legal rights pursuant to the terms of this Privacy Notice and applicable laws in your location.
9. Data Retention
We will take every reasonable step to ensure that your personal data is processed for the minimum period necessary for the purposes set out in this Privacy Notice. Your Personal Data may be retained in a form that allows for identification only for as long as:
A. We maintain an ongoing relationship with you. This will enable us to improve your experience with us and to ensure that you receive communications from us
B. Your Personal Data is necessary in connection with the purposes set out in this Privacy Notice and we have a valid legal basis,
C. The duration of: (i) any applicable limitation period (i.e., any period during which a person could bring a legal claim against us), and
We will actively review the personal data we hold and delete it securely, or in some cases anonymise it, when there is no longer a legal, business or consumer need for it to be retained.
10. Data Security
We have put in place security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
11. Your Legal Rights
A. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
B. Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to access, correct or erase your personal data, object to or restrict processing of your personal data, right to ask that we transfer your personal data to a third party, and unsubscribe from our emails and newsletters.
C. Where you wish to permanently delete your data from our website and other applications, you can choose the option of closing your account. You can close your account by clicking on this link and following the instructions. Once your account is closed, all products and services that you access through your account will no longer be available.
D. We can refuse to accede to your request where it is unreasonable or where you have failed to provide additional information necessary to confirm your identity.
12. Data Controllers & Contact
If you have any questions or concerns about Vazaki’s Privacy Notice or you are looking for more information on how we process your personal data, or wish to exercise your legal rights in respect of your personal data, please contact the Data Privacy Officer by email at vazaki@Vazaki.com
We will investigate any complaint about the way we manage Personal Data and ensure that we respond to all substantiated complaints within prescribed timelines.
B. Data Privacy Policy
Contents
1. About this Policy: purpose; scope; and application
2. What is personal data?
3. How to manage personal data: the key principles of personal data protection
4. Privacy impact assessments: what are they and when do you need one?
5. Record keeping
6. How does Vazaki manage data privacy breaches?
7. What are the consequences of violation of this Policy?
8. Further information
1. About this Policy
1.1. Purpose
In the course of our business, Vazaki collects, handles and stores personal data of our customers, employees, sellers, suppliers, contractors and other individuals (“Data Subjects”). This information is a valuable and sensitive asset, that must be managed respectfully, and in accordance with all applicable local and international laws.
This Policy explains how any personal information which we process (or others process on our behalf) must be used in accordance with the law, and for Vazaki’s legitimate business purposes only.
1.2. Scope
This Policy covers:
● all personal data held by or on behalf of Vazaki, regardless of the media on which that data is stored, or of which individuals own that personal data; and
● all processing of such personal data, including all collection, recording, organization, storage, use, disclosure, transfer, deletion and any other handling of personal data.
1.3. Application
This Policy applies to all Vazaki’s employees; and to Vazaki’s sellers, suppliers, contractors and other third parties responsible for processing personal data for or on behalf of Vazaki, referred to in this Policy as our “Partners”.
We expect all Partners to maintain our standards of data privacy, as set out in this Policy.
2. What is personal data?
Personal data is any information relating to an identified or identifiable person, including: name; address; date or place of birth; photographs or videos (including CCTV footage); contact details (e.g. telephone number, email, address); national identifiers (e.g. ID numbers); professional status (e.g. job title, employer); location; online identifiers (e.g. IP addresses); and personal preferences (e.g. shopping and browsing habits), among numerous other types of personal data. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, mental, economic, cultural or social identity.
Sensitive personal data or special category personal data contains information relating to a person's race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health and sexual life or orientation.
3. How to manage personal data: the key principles of personal data protection
Vazaki adheres to the highest personal data protection standards which require personal data to be processed in accordance with the principles set out below.
3.1. Lawfulness and fairness
Personal data must be processed fairly and lawfully.
Vazaki shall only process personal data if so required to comply with applicable laws (e.g. for the purpose of employee tax deductions) or if it has received affirmative consent i.e. the Data Subject must make a positive statement or tick a box by way of consent.
Processing of personal data in reliance on any other legal basis, and without consent of the Data Subject, requires express written approval from the Vazaki General Counsel, and is otherwise strictly prohibited.
Processing of sensitive data requires express written approval from the Vazaki General Counsel, and is otherwise strictly prohibited.
3.2. Transparency
Personal data must be processed in a transparent manner.
Vazaki ensures that Data Subjects are duly informed before they disclose their personal data, by a clear and comprehensive privacy notice.
3.3. Purpose limitation and data minimisation
Personal data must be collected only for specified, explicit and legitimate purposes. Data collected must be adequate, relevant and limited to what is necessary for the identified purpose.
Collecting personal data that the business does not require for a specified purpose exposes Vazaki to unnecessary legal risks.
3.4. Accuracy
Personal data must be accurate and kept up to date where necessary. Vazaki endeavors to maintain the accuracy of our records through:
• self-service systems e.g. our Seller Centre enables sellers to update their details periodically;
• regular verification exercises; and
• by providing information to individuals so they know who to contact if their details change.
3.5. Data Subject’s rights and requests
Data Subjects are entitled to exercise various rights with respect to their own personal data, including but not limited to the following:
● withdrawing consent to processing of their personal data;
● requesting access to their personal data; and
● requesting erasure of their personal data in certain circumstances.
Vazaki’s Data Subject Rights Handling Guidance sets out processes for managing and responding to Data Subject requests, including mechanisms for communicating with Partners who may hold the relevant personal data in order to execute such responses.
3.6. Storage limitation
Personal data must not be kept for any longer than is necessary. Vazaki requires personal data to be anonymized or destroyed once the purpose for retaining that data, or the relevant time in the Document Retention Policy, has expired.
3.7. Security, integrity and confidentiality
Personal data must be processed in a manner which ensures its security using appropriate technical and organisational measures to protect against accidental loss, destruction or damage.
Security measures should be proportionate to the level of confidentiality and sensitivity of the personal data.
It is Vazaki’s goal to ensure security of personal data by:
● anonymising or pseudonymizing personal data wherever this is possible without compromising the purpose;
● putting in place appropriate contractual arrangements to ensure an appropriate level of protection for personal data when it is shared with a third party; and
● carrying out due diligence, as part of the supplier onboarding process, to verify that any third party suppliers who hold or have access to personal data on our behalf, meet our data protection standards.
3.8. Transfer limitation
Personal data must not be transferred across borders without the appropriate safeguards and consents being in place.
Vazaki maintains a record of all personal data transfers and requires you to inform and obtain approval from the Vazaki General Counsel in respect of any personal data that is transferred across borders.
4. Privacy Impact Assessments: what are they and when do you need one?
Privacy Impact Assessments are a tool which allow you to identify, assess and mitigate privacy risks. They can also help you to design more efficient and effective processes for handling personal data.
Vazaki requires a Privacy Impact Assessment to be completed where the activity falls outside Vazaki’s existing data map e.g. transferring data to a new supplier or collecting a new category of data.
5. Record keeping
Vazaki maintains a full and accurate data map of all personal data processing activities and data flows, including details of records of Data Subjects consents and the procedures for obtaining consents.
We expect our Partners to maintain detailed data maps in respect of all personal data that they process on behalf of Vazaki, and to make this information available to Vazaki.
6. How does Vazaki manage data privacy breaches?
Vazaki has in place procedures to deal with any suspected personal data breach and will notify affected individuals and applicable regulators where legally required to do so.
If you know or suspect that a personal data breach has occurred, immediately contact Compliancealert@Vazaki.com
7. What are the consequences of violation of this Policy?
Failure to comply with this Policy is a serious compliance breach.
Non-compliance is a disciplinary matter for employees. If you are a contractor, seller or supplier, it may constitute a breach of your contract with Vazaki and we may review, and/or terminate, your assignment with us.
8. Further information
The following documents contain further helpful information on how Vazaki manages personal data:
● Vazaki Privacy Impact Assessments Template and Guidance
● Vazaki Online Privacy & Cookie Notice
● Vazaki Document Retention Policy
● Vazaki Data Subject Rights Handling Guidance
If you are an employee of Vazaki and you have any questions about this Policy, or require approval of the General Counsel, please contact the lawyer responsible for your market.
If you are a Partner of Vazaki and you have any questions about this Policy or you require any approvals, please contact your Vazaki relationship manager.
If you know or suspect that a personal data breach has occurred, immediately contact Compliancealert@Vazaki.com
