Privacy Policy

Effective Date: January 1, 2026

VSS Limited ("VSS", "we", "us", or "our") is committed to protecting your privacy and ensuring the security of your personal information in accordance with the Kenya Data Protection Act, No. 24 of 2019 ("the Act"), which gives effect to Article 31(c) and (d) of the Constitution of Kenya. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website, use our services, or engage with us in any capacity.

VSS is registered with the Office of the Data Protection Commissioner (ODPC) as both a Data Controller and Data Processor. We process personal data in accordance with the principles set out in Section 25 of the Act.

By accessing our website or using our services, you consent to the practices described in this Privacy Policy. If you do not agree with the terms of this policy, please do not access our website or use our services.

1. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we process personal data on the following legal bases:

• Consent: Where you have given express, unequivocal, free, specific and informed consent to the processing of your personal data (Section 32 of the Act).
• Contractual Necessity: Where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract.
• Legal Obligation: Where processing is necessary for compliance with a legal obligation to which VSS is subject.
• Legitimate Interest: Where processing is necessary for the purposes of legitimate interests pursued by VSS, provided that such interests are not overridden by your fundamental rights and freedoms.
• Vital Interest: Where processing is necessary to protect the vital interests of the data subject or another natural person.

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide to us, including but not limited to:

• Name, email address, phone number, and postal address
• Company name, job title, and business contact information
• Account credentials (username and password)
• Payment and billing information
• Communication preferences and marketing consents
• Any other information you choose to provide through forms, surveys, or correspondence

2.2 Automatically Collected Information

When you visit our website, we automatically collect certain information, including:

• IP address and geographic location
• Browser type, version, and language preferences
• Operating system and device information
• Pages visited, time spent on pages, and navigation patterns
• Referring website addresses and search terms
• Date and time of access

2.3 Sensitive Personal Data

Under the Act, sensitive personal data includes information revealing race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details, sex, or sexual orientation. VSS does not collect sensitive personal data unless specifically required and with your explicit consent, and in accordance with Section 44 and 45 of the Act.

2.4 Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies to collect information about your browsing activities. For detailed information about our use of cookies, please refer to our Cookie Policy.

3. Data Protection Principles

In accordance with Section 25 of the Act, VSS processes personal data in line with the following principles:

• Lawfulness, Fairness and Transparency: Personal data is processed lawfully, fairly and in a transparent manner.
• Purpose Limitation: Personal data is collected for specified, explicit and legitimate purposes.
• Data Minimization: Personal data is limited to what is necessary for the specified purposes.
• Accuracy: Personal data is accurate and kept up to date.
• Storage Limitation: Personal data is stored for no longer than necessary.
• Integrity and Confidentiality: Personal data is secured against unauthorized processing, accidental loss, or damage.
• Accountability: VSS takes responsibility for compliance and can demonstrate adherence to these principles.

4. How We Use Your Information

We use the information we collect for various purposes, including:

• Service Delivery: To provide, maintain, and improve our products and services
• Communication: To respond to inquiries, send updates, and provide customer support
• Marketing: To send promotional materials, newsletters, and information about new products or services (with your consent, as per Section 37 of the Act)
• Analytics: To analyze website usage, understand user preferences, and improve user experience
• Security: To detect, prevent, and address technical issues, fraud, and security threats
• Legal Compliance: To comply with applicable laws, regulations, and legal processes
• Business Operations: To manage our business relationships, contracts, and transactions

5. Information Sharing and Disclosure

We may share your information in the following circumstances:

5.1 Service Providers

We may share information with third-party vendors, consultants, and service providers who perform services on our behalf, such as payment processing, data analysis, email delivery, hosting services, and customer support. These processors are bound by data processing agreements in accordance with the Act.

5.2 Business Partners

We may share information with our technology partners, including Microsoft, Cisco, and other vendors, to provide integrated solutions and support services.

5.3 Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction.

6. Data Security

In accordance with Section 41 of the Act (Data Protection by Design or Default), we implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure access controls and authentication mechanisms
• Regular security assessments and vulnerability testing
• Employee training on data protection and privacy
• Physical security measures at our data centers and offices
• Data Protection Impact Assessments as required by Section 31 of the Act

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

7. Data Retention

In accordance with the Storage Limitation principle (Section 25 of the Act), we retain your personal information for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. The specific retention period depends on the nature of the information and the purposes for which it is used. When personal data is no longer required, it is securely deleted or anonymized.

8. Your Rights as a Data Subject

Under the Kenya Data Protection Act, 2019 (Section 26), you have the following rights:

• Right of Access: Request access to the personal data we hold about you and obtain information about how it is processed
• Right to Rectification: Request correction of inaccurate or incomplete personal data (Section 40)
• Right to Erasure: Request deletion of your personal data where there is no compelling reason for continued processing (Section 40)
• Right to Data Portability: Request a copy of your personal data in a structured, commonly used, machine-readable format (Section 38)
• Right to Object: Object to the processing of your personal data in certain circumstances (Section 36)
• Right to Restrict Processing: Request limitation on the processing of your personal data (Section 34)
• Right Not to be Subject to Automated Decisions: Not to be subject to decisions based solely on automated processing, including profiling (Section 35)
• Withdrawal of Consent: Withdraw your consent at any time where processing is based on consent
• Marketing Opt-Out: Object to the processing of your personal data for direct marketing purposes at any time (Section 37)

To exercise any of these rights, please contact our Data Protection Officer using the information provided below. We will respond to your request within 30 days in accordance with Section 27 of the Act.

9. Cross-Border Data Transfers

VSS operates across multiple countries in East Africa. Your information may be transferred to and processed in countries other than your country of residence. In accordance with Section 48 and 49 of the Act, we ensure that:

• The recipient country or organization has adequate data protection safeguards
• Appropriate contractual clauses are in place with recipients
• Your consent is obtained where required for cross-border transfers
• The transfer is necessary for the performance of a contract or legal obligations
• Data is processed through data servers or centres in Kenya where required (Section 50)

10. Data Breach Notification

In accordance with Section 43 of the Act, in the event of a personal data breach, VSS will notify the Data Commissioner within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also communicate the breach to you without unreasonable delay, including the nature of the breach, likely consequences, and measures taken to address it.

11. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. In accordance with Section 33 of the Act, if we become aware that a child has provided us with personal information without parental consent, we will take steps to delete such information.

12. Third-Party Links

Our website may contain links to third-party websites, applications, or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

13. Complaints

If you believe that your personal data has been mishandled or your data protection rights have been violated, you have the right to:

• Contact our Data Protection Officer to raise your concern
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) under Section 56 of the Act
• Seek judicial remedy under Section 65 of the Act

The ODPC website is available at www.odpc.go.ke

14. Sub-Processors and Third-Party Data Processors

VSS uses carefully selected third-party service providers (sub-processors) to deliver our services. Each sub-processor is bound by appropriate Data Processing Agreements. The following third parties may process your personal data on our behalf:

15. Call Recording

VSS operates a telephony system that may record inbound and outbound calls for quality assurance, compliance monitoring, staff training, and dispute resolution purposes. The legal basis for call recording is our legitimate interest in maintaining service quality and compliance, balanced against your rights and expectations.

• Callers are verbally informed at the start of the call that the conversation may be recorded.
• Call recordings are stored securely on VSS-controlled on-premise infrastructure in Kenya.
• Recordings are retained for a maximum of 3 years and then automatically and permanently deleted.
• Access to recordings is restricted to authorised personnel only.
• You may request deletion of a specific recording by submitting a data erasure request.

16. Data Retention

VSS retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our standard data retention period is 3 years from the date of last activity, after which data is automatically and permanently purged from our systems. Specific retention periods by data category:

• Contact form submissions: 3 years
• Chat session transcripts: 3 years
• Tool assessment data: 3 years
• Call logs and recordings: 3 years
• Audit logs: 3 years
• Newsletter subscribers: Until unsubscribed + 3 years, or 3 years from last engagement
• CRM data (customer records): Duration of the business relationship + 7 years for contractual records
• Payment records: 7 years (Kenya tax and financial compliance)

17. Your Rights — How to Exercise Them

Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:

• Right of Access (s.26): Request a copy of the personal data we hold about you.
• Right to Rectification (s.35): Request correction of inaccurate or incomplete data.
• Right to Erasure (s.35): Request deletion of your personal data where there is no lawful basis for continued processing.
• Right to Data Portability (s.34): Receive your data in a structured, commonly used, machine-readable format.
• Right to Object (s.33): Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent (s.32): Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please submit a formal request using our Data Subject Request Form. We will respond within 21 days as required by the Act.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated policy on our website with a new effective date. We encourage you to review this policy periodically.

19. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, our data protection practices, or to exercise your data subject rights, please contact us: