V VycePay Join Pilot →
Legal · Kenya Data Protection Act

Privacy Policy

How VycePay collects, uses, shares, and protects personal data when you use our Kenya-first wallet, VyceScore, and related services.

Effective: 10 November 2026 Controller: VycePay Settlement partner: Choice Bank
Plain promise: We do not sell your transaction history. Personal data is handled in line with the Kenya Data Protection Act, 2019.

1. Who we are

VycePay (“we”, “us”) operates a Kenya-first digital wallet for SMEs and everyday users. VycePay is not a bank. Wallet balances are held and settled through our licensed banking partner, Choice Microfinance Bank (“Choice Bank”), under applicable Central Bank of Kenya (CBK) e-money and partner rules.

This Privacy Policy applies to the VycePay mobile apps, website (vycepay.com), APIs, and related support channels. It should be read with our Terms of Service.

2. What we collect

We collect personal data with your knowledge when you register, verify identity, use the wallet, contact support, or visit our sites. Categories include:

  • Identity & KYC: name, date of birth, nationality, National ID / passport details, photographs, and biometric / liveness checks required for onboarding.
  • Contact: mobile number, email address, and optional profile details (for example username).
  • Account & device: account identifiers, device type, app version, IP address, session and security signals (PIN/OTP events, device checks).
  • Transaction data: deposits, transfers, bill/airtime payments, merchant payments, fees, status, timestamps, and references across rails such as M-PESA, Airtel Money, Till, Paybill, and Pesalink where available.
  • Support interactions: messages, call notes, and complaint records.
  • Optional marketing preferences if you opt in to receive product updates.

We may also receive verification or risk-related information from our banking partner, fraud-prevention tools, or publicly available / restricted government databases where the law requires identity checks.

3. How we use data

We process personal data to:

  • Provide and operate the wallet, payments, statements, and customer support.
  • Complete KYC/AML checks and meet legal, tax, and regulatory obligations.
  • Prevent fraud, abuse, and unauthorized access; secure accounts with PIN, OTP, and device checks.
  • Settle funds through Choice Bank and interoperability partners needed to complete a payment you initiate.
  • Compute and improve VyceScore from your VycePay activity (see below).
  • Improve product reliability, troubleshoot issues, and produce aggregated, non-identifying statistics.
  • Send service messages (OTP, receipts, security alerts). Marketing messages require opt-in and can be stopped at any time.

Lawful bases under Kenyan data protection law may include performance of a contract, compliance with a legal obligation, legitimate interests (security, fraud prevention, product improvement), and consent where required.

4. VyceScore

VyceScore is an activity-based credit signal built from your real VycePay payment behaviour — for example frequency, volume, repayment behaviour where applicable, and ecosystem engagement. It is not a survey score and is not built by scraping your phone contacts or SMS inbox.

Your transaction history belongs to you. We may use it, with appropriate safeguards, to generate VyceScore and to facilitate credit or working-capital offers through regulated partners when you qualify. We do not sell your transaction history or credit profile to third parties for their independent marketing.

5. When we share data

We share personal data only as needed to run the service or as required by law, including with:

  • Choice Bank and other regulated settlement / interoperability partners (for example mobile-money operators) to process payments you request.
  • Technology and cloud providers acting as processors under confidentiality and security obligations.
  • Fraud-prevention, AML, and (where legally required or with your authorization) credit-reference bodies.
  • Law enforcement, courts, CBK, ODPC, or other authorities when presented with a lawful demand.
  • Professional advisers (legal, audit) under confidentiality.

Some details (for example your name or mobile) may be visible to the other party in a payment you send or receive, as is normal for mobile-money and bank transfers.

If we transfer data outside Kenya (for example cloud hosting), we will apply safeguards required by applicable data protection law.

6. Retention & security

We keep personal data only as long as needed for the purposes above, including AML, tax, dispute, and regulatory record-keeping periods. When no longer required, we delete or anonymize it where feasible.

We use technical and organizational measures appropriate to a financial service — including access controls, encryption in transit, logging, and least-privilege practices. No system is perfectly secure; please protect your PIN, OTP, and device.

VycePay does not knowingly onboard children under 18 except where a parent or legal guardian registers on their behalf as permitted by law and our processes.

7. Your rights

Subject to legal exceptions under the Kenya Data Protection Act, you may request to:

  • Be informed about and access personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Object to or request restriction of certain processing.
  • Request deletion (we may retain data where the law requires).
  • Request portability of data you provided, in a commonly used electronic form where applicable.
  • Withdraw consent where processing is based on consent (this does not affect prior lawful processing).

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.

8. Contact

Privacy and data-subject requests:

We may ask for information to verify your identity before fulfilling a request. We aim to respond within a reasonable time as required by law.

Changes

We may update this Policy from time to time. The effective date above will change when we do. Material updates may also be notified in-app or by email where appropriate. Continued use after an update means you acknowledge the revised Policy.