1. Who we are
Vichbyte Tech Limited ("Vichbyte", "we") is a company registered in Kenya, Reg. No. PVT-BB16VYKJ., registered address [00], Nairobi, Kenya. Wazibot is a product of Vichbyte Tech Limited.
Controller and processor. We are the data controller for personal data we collect through this website and for our own business records (for example enquiries, client contacts and billing). When a client uses Wazibot to message its own customers, the client is the data controller and we act as a data processor, handling that data only on the client's documented instructions.
2. Data we collect
- Contact form and enquiry data: name, email, phone, company and your message.
- Business account details: client business name, contacts, users, billing and configuration.
- Phone numbers of client end-users who message a client's WhatsApp number.
- WhatsApp message content and metadata (such as timestamps, delivery status and message IDs) processed on behalf of clients.
- Usage and analytics data: pages visited, device and browser type, collected only after consent.
- Cookies and local storage: see our Cookie Policy.
3. Purposes and lawful bases
Under the Kenya Data Protection Act, 2019, we process personal data on these bases:
- Contract: to provide, operate and support Wazibot and other services for clients.
- Consent: for optional analytics and, where required, marketing communications. You can withdraw consent at any time.
- Legitimate interests: to answer enquiries, secure our systems, prevent fraud and improve our services, balanced against your rights.
- Legal obligation: to meet tax, accounting, regulatory and law-enforcement requirements.
4. Client responsibility for messaging consent
Clients are responsible for obtaining valid opt-in consent from their end-users before sending them WhatsApp messages through Wazibot, and for having a lawful basis for any data they ask us to process.
5. Meta / WhatsApp and other sub-processors
Wazibot runs on the WhatsApp Business Platform operated by Meta Platforms, Inc. and its affiliates. Messages sent and received through Wazibot pass through Meta's systems and are subject to Meta's Privacy Policy and WhatsApp's terms. We also use carefully selected providers for hosting and infrastructure, email delivery and payment processing. They may only process personal data on our instructions and under appropriate confidentiality and security commitments.
6. International transfers
Some providers, including Meta and cloud hosting providers, may process data outside Kenya. Where this happens we rely on safeguards recognised under the Kenya Data Protection Act, 2019, such as contractual protections and providers with appropriate security standards.
7. Retention
- Enquiries that do not become a client relationship: up to 12 months. [TODO: confirm]
- Client account and billing records: for the duration of the contract and up to 7 years afterwards for tax and accounting purposes. [TODO: confirm]
- Message content processed for clients: as instructed by the client, and deleted or returned when the contract ends, unless law requires otherwise.
8. Security
We use measures appropriate to the risk, including encrypted connections, access controls, encryption of stored credentials, separation of client data, backups and monitoring. No system is perfectly secure, but we work to protect data against loss, misuse and unauthorised access.
9. Your rights
Under the Kenya Data Protection Act, 2019 you have the right to be informed, to access your data, to correct inaccurate data, to have data deleted, to object to processing, to restrict processing and to data portability. To exercise these rights email privacy@Vichbyte.com. We may need to verify your identity, and we aim to respond within 30 days. If your data was processed on behalf of one of our clients, we will pass your request to that client or help them respond. See also Data Deletion Instructions.
10. Children
Our website and services are not directed at children under 18, and we do not knowingly collect their personal data.
11. Data breaches
If a personal data breach is likely to put your rights at risk, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it and inform affected clients and individuals without undue delay, as required by law.
12. Registration and complaints
ODPC registration: [ODPC REGISTRATION NO. / TODO]. If you are unhappy with how we handle your data, please contact us first. You may also complain to the Office of the Data Protection Commissioner (Kenya) at www.odpc.go.ke.
13. Contact and Data Protection Officer
Data Protection Officer: [TODO: name]. Email privacy@Vichbyte.com, or write to Vichbyte Tech Limited, [00], Nairobi, Kenya.
14. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page with its "Last updated" date. For significant changes we will notify clients directly.