Vouch — Data Processing Addendum (DPA)

Last updated: 5 July 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Kerry Lotee, trading as Vouch (“Vouch”, “Processor”) and the Merchant (“you”, “Controller”) who uses the Service. It governs how Vouch processes the personal data of your customers (“Buyers”) on your behalf. It is designed to meet the requirements of the Data Protection Act, 2019 (Kenya).

Where this DPA conflicts with the Terms of Service on matters of Buyer personal-data processing, this DPA prevails.

1. Roles

For personal data relating to your Buyers:

• You are the data Controller. You determine the purposes for which, and the manner in which, your Buyers’ personal data is processed. You are responsible for having a lawful basis for that processing and for meeting your obligations to Buyers under data-protection law.
• Vouch is the data Processor. Vouch processes Buyer personal data only on your documented instructions and only to provide the Service.

(Separately, Vouch is the Controller of your Merchant account data, as described in the Privacy Policy. That is not governed by this DPA.)

2. Scope of processing

Subject matter: Provision of the Vouch storefront, order, payment, transactional-email, and verified-review service.

Duration: For as long as your Vouch account is active, plus the retention periods in Section 8.

Nature and purpose: Hosting your storefront; recording and managing orders; routing payments through the payment provider; sending transactional emails to Buyers; collecting and publishing verified reviews.

Categories of personal data: Buyer name; WhatsApp number; email address; delivery or pickup preference; order details (items, amount, date/time); review content and chosen attribution; associated timestamps; limited technical data (e.g. IP address) processed by infrastructure providers for security.

Categories of data subjects: Your Buyers (your customers).

3. Vouch’s obligations as Processor

Vouch shall:

• process Buyer personal data only on your documented instructions, including the instructions inherent in your use of the Service, unless required to do otherwise by law (in which case Vouch will inform you where legally permitted);
• ensure that persons authorised to process Buyer data are bound by confidentiality;
• implement appropriate technical and organisational security measures (see Section 6);
• respect the conditions in Sections 4 and 5 for engaging sub-processors;
• assist you, taking into account the nature of processing, in responding to Buyer requests to exercise their data-protection rights;
• assist you in ensuring compliance with your security, breach-notification, and (where applicable) data-protection-impact-assessment obligations;
• at your choice, delete or return Buyer personal data at the end of the provision of the Service, as set out in Section 8, except where retention is required by law;
• make available to you information reasonably necessary to demonstrate compliance with this DPA.

4. Sub-processors

You give Vouch general authorisation to engage sub-processors to deliver the Service. The current sub-processors are:

Vouch will impose data-protection obligations on each sub-processor that are materially equivalent to those in this DPA, and remains responsible to you for each sub-processor’s performance. If Vouch adds or replaces a sub-processor, it will update this list and, where the change materially affects the processing of Buyer data, give you reasonable notice so you may object on reasonable grounds.

5. International transfers

Some sub-processors process data on servers outside Kenya. Vouch relies on the safeguards those providers offer (contractual and technical) and processes such transfers in a manner consistent with the Data Protection Act, 2019. Vouch will not transfer Buyer personal data outside Kenya except through these sub-processors as needed to provide the Service, or as you instruct.

6. Security

Vouch applies appropriate technical and organisational measures to protect Buyer personal data, including:

• access controls limiting who and what can access data;
• encryption of data in transit;
• restricting each sub-processor’s access to only the data needed for its function;
• rate limiting and abuse prevention;
• logging of security-relevant events, including data-breach events.

These measures are kept under review and may be updated to maintain an appropriate level of security.

7. Personal-data breaches

If Vouch becomes aware of a personal-data breach affecting Buyer data, Vouch will:

• log the breach event;
• notify you without undue delay after becoming aware;
• provide you with the information reasonably available to help you meet your own breach-notification obligations, including to the Office of the Data Protection Commissioner and to affected Buyers where required.

As Controller, you are responsible for making any legally required notifications to the ODPC and to affected Buyers; Vouch will support you in doing so.

8. Return and deletion of data

On termination of your account, or on your written request:

• Buyer contact details and preferences (name, WhatsApp, email, delivery preference) will be deleted or returned within 90 days;
• Transaction and financial records will be retained for 5 years to meet tax and records-keeping obligations under Kenyan law, then deleted;
• Published reviews will remain while your storefront is live, or until removed at a Buyer’s request or your instruction.

Vouch may retain data where and for as long as required by law.

9. Assistance with Buyer rights

Where a Buyer contacts Vouch directly to exercise a data-protection right (access, correction, deletion, objection, restriction), Vouch will, without undue delay, either forward the request to you or act on it on your documented instructions. You remain responsible, as Controller, for deciding how such requests are answered.

10. Liability and general

This DPA is subject to the limitation-of-liability provisions of the Terms of Service. If any provision of this DPA is found unenforceable, the remainder continues in effect. This DPA is governed by the laws of Kenya.

11. Contact

Kerry Lotee, trading as Vouch
Nairobi, Kenya
Email: hello@vouche.co.ke