Privacy Policy
Last updated: September 13, 2026 — Effective: September 13, 2026
1. Who we are
VUNVAULT is a cybersecurity company serving SMEs, SACCOs, fintechs, and enterprises across Africa. Contact: [email protected] | Nairobi, Kenya.
2. Data we collect
- Contact data: name, email, company, phone when you request an assessment or use contact forms.
- Technical data: IP, browser, device, pages visited (via analytics, only with consent).
- Assessment data: scope, scan results, reports you explicitly share for service delivery.
- Payment data: processed securely by Paystack — we do NOT store card numbers.
- Academy data: progress, quiz scores, certificate name stored locally + server for certificate verification.
3. How we use it
- Deliver and improve security services
- Communicate about your assessment, retainer, or certificate
- Security, fraud prevention, and legal compliance
- With consent: analytics to improve site performance, and marketing (you can opt-out anytime)
4. Legal bases (GDPR)
Contract (to deliver service), Legitimate Interest (security, improvement), Consent (analytics, marketing), Legal Obligation (tax, breach notification).
5. Sharing
We share only with:
- Payment processor (Paystack)
- Analytics provider (Google Analytics 4, only after consent)
- Hosting provider & email provider under DPA
- When required by law or to protect rights/safety
We never sell personal data.
6. Retention
- Contact inquiries: 24 months
- Assessment reports: 36 months or per contract
- Academy progress: until you clear browser storage, certificate records retained for verification
- Analytics: 14 months (anonymized)
7. Your rights
Under Kenya DPA 2019 and GDPR you have rights to access, correction, deletion, restriction, objection, portability, and to withdraw consent. Email [email protected] — we respond within 30 days.
8. Security
We use TLS/HTTPS, encrypted backups, least-privilege access, and regular patching. No system is 100% secure — in case of breach we notify the ODPC and affected individuals as required by law.
9. Cookies
We use:
- Essential cookies (security, consent memory) — always on
- Analytics cookies (GA4) — only if you Accept
- Preference cookies (language, currency) — only if you Accept
Manage via our cookie banner or your browser settings. See cookie banner for details.
10. International transfers
Data may be processed in Kenya and EU/US via our processors under Standard Contractual Clauses.
11. Children
Services not directed to under 16. We do not knowingly collect children's data.
12. Changes
We will post updates here and change the date. Material changes will be notified by email if you are a client.
13. Contact & Complaints
Privacy: [email protected]
Data Commissioner Kenya: Office of the Data Protection Commissioner
If in EU, you may lodge complaint with your supervisory authority.