Privacy Policy

1Introduction

This Privacy Policy ("Policy") explains how Verified Biz Exchange ("VBE," "we," "us," or "our") collects, uses, stores, shares, and protects personal data when you visit, register on, or use verifiedbizexchange.com and its related dashboards, applications, and services (collectively, the "Platform").

This Policy is drafted to comply with the Data Protection Act, No. 24 of 2019 ("the Act"), the Data Protection (General) Regulations, 2021, and other applicable Kenyan law, including the Constitution of Kenya, 2010 (Article 31 — the right to privacy), the Kenya Information and Communications Act (Cap. 411A), and the Computer Misuse and Cybercrimes Act, No. 5 of 2018.

This Policy forms part of, and should be read together with, our Terms of Use, in particular the Data Protection & Privacy section of those Terms. By using the Platform, you acknowledge that you have read and understood how we handle your personal data as described here.

2Who We Are — The Data Controller

For the purposes of the Data Protection Act, 2019, Verified Biz Exchange is the data controller responsible for deciding how and why your personal data is processed on the Platform.

Verified Biz Exchange is a business name registered in Kenya under the Business Registration Service Act (Cap. 499, Section 14), Business Registration Number BN-AYSOQ59Q, with its principal place of business in Karatina, Nyeri County, Kenya. More on our legal status as a registered business name, rather than a limited company, is set out in Section 3 of our Terms of Use.

3Definitions

These terms, borrowed largely from the Data Protection Act, 2019, are used throughout this Policy.

4Scope of This Policy

This Policy applies to personal data we collect through:

• The public Platform, including the homepage, listings pages, individual listing pages, franchise pages, and verification pages;
• The seller dashboard, where sellers manage listings, advertising bookings, invoices, and account settings;
• The verification application process, where prospective sellers submit identity and business documents;
• Contact forms, enquiry forms, and messaging features used to connect buyers and sellers; and
• Our administrative systems, to the extent they process data about you (for example, when an administrator reviews your verification application).

This Policy does not apply to third-party websites or services we link to, or to the practices of Sellers or Buyers themselves once they leave the Platform to communicate directly (for example, over WhatsApp or phone).

5Personal Data We Collect

The data we collect depends on how you use the Platform. The table below sets out each category in detail.

5.1 Account & identity data

• Full name, phone number, email address, and physical address;
• Password (stored only as a one-way cryptographic hash — we never store or can see your plain password);
• Two-Factor Authentication (2FA) data, if you enable it: an encrypted authenticator secret and single-use backup codes (stored as bcrypt hashes, never in plain text);
• Account activity such as login timestamps, session identifiers, and device type, used for single-device session enforcement and security monitoring.

5.2 Verification data (Sellers)

• Full legal name, National ID number, and KRA PIN;
• A clear photograph of the front and back of your Kenyan National ID card, uploaded during the verification application;
• Business details: business name, ownership type, industry, years in operation, employee count, monthly revenue and profit, physical location, website (if any), and reason for sale;
• A unique application reference number generated for tracking your verification status.

5.3 Listing data

• Details you choose to publish about a business, franchise, lease, or rental — description, asking price, photos, category, and map coordinates (if you use the location picker);
• Any correspondence submitted through the listing enquiry or messaging panel.

5.4 Payment & commission data

• Payment reference numbers, transaction status, and amounts relating to Verification Fees and Advertising Package purchases, processed through Paystack;
• We do not collect or store your full card number, M-Pesa PIN, or banking credentials — these are handled directly by our payment processor, as explained in Section 12.
• For Sellers on the Free tier, the sale confirmation details you self-report when marking a Listing "Sold" — including the final agreed sale price, sale date, and any supporting evidence of the price you provide — used solely to calculate and invoice the success commission described in Section 11.6 of our Terms of Use.

5.5 Technical & usage data

• IP address (including where forwarded through a proxy, via the X-Forwarded-For header);
• Browser type and version, device type (desktop, mobile, or tablet), and operating system;
• Pages visited, listings viewed, ad impressions and clicks, and enquiry submissions, together with associated timestamps;
• An approximate county-level location, derived from your IP address (GeoIP), used only in aggregate for analytics — never your precise coordinates unless you voluntarily use a location-picker feature.

6How We Collect Your Data

We collect personal data in three ways:

6.1 Directly from you

When you register an account, apply for verification, create or update a Listing, make a payment, send an enquiry, contact support, or otherwise interact with a form on the Platform.

6.2 Automatically, through your use of the Platform

Our servers automatically log technical information — such as your IP address, browser, device type, and pages viewed — every time you visit the Platform, whether or not you have an account. This happens through server-side logging and lightweight tracking beacons used for ad impression, click, and enquiry-conversion analytics (see Section 10).

6.3 From third parties

We may receive limited confirmation data from our payment processor (such as whether a transaction succeeded) and, where legally required or where you engage our verification checks, we may cross-reference identity information you provide against publicly available or officially issued records.

7Why We Use Your Data & Our Legal Basis

Under the Data Protection Act, 2019, we must have a lawful basis for every purpose for which we process your data. The table below sets these out.

8Verification Documents & Sensitive Data

Because VBE's core promise to Buyers is that every Seller has been verified, our verification process necessarily collects sensitive identity data. We treat this data with the highest level of care. The verification process itself — including the four-point check and the Blue Badge it leads to — is described in Section 8 of our Terms of Use.

8.1 What we do with your National ID

When you apply for verification, you upload clear photographs of the front and back of your National ID card. Our system automatically checks that the ID number you typed matches the number printed on the uploaded image, and that the document is a genuine Kenyan National ID rather than a student card, driving licence, or passport, before your application proceeds to human review by our verification team.

8.2 Where these documents are stored

ID card images and verification documents are stored in access-controlled storage on our hosting infrastructure and served only through an authenticated internal streaming mechanism — they are never placed in a publicly browsable folder or linked to directly. Access is limited to authorised VBE administrators for the sole purpose of reviewing your application.

8.3 What we do not do

• We do not publish your National ID, KRA PIN, or financial figures on your public Listing;
• We do not share your verification documents with other Sellers or Buyers;
• We do not use your National ID for any purpose other than verifying your identity and, where fraud is confirmed, maintaining our internal blacklist described in Section 21 of our Terms of Use.

9Cookies, Sessions & Similar Technologies

The Platform uses a small number of cookies and browser-storage mechanisms, strictly limited to what is needed to make the Platform work securely.

We do not use third-party advertising cookies to track you across other websites. Some in-page functionality (such as a payment reference used to confirm a booking after you return from Paystack) may briefly use your browser's session storage; this data stays on your device and is not a tracking cookie.

Because these cookies are strictly necessary for the Platform's core security and functionality, we do not currently display a cookie-consent banner for them, consistent with the "strictly necessary" exemption recognised under Kenyan data protection guidance. If we introduce non-essential cookies (for example, third-party analytics or advertising cookies) in the future, we will update this Policy and request your consent where required.

10Analytics, Location & Advertising Data

To understand how the Platform is used and to report performance to Advertisers, we maintain internal analytics records, including:

• Ad impression and click logs, recording the advertisement shown, the county-level location, device type, browser, and IP address of the viewer;
• Listing view and enquiry-conversion logs, used to show Sellers how their Listing is performing;
• Aggregate device and browser-share statistics, used to improve the Platform's design and performance.

10.1 County-level location, not precise tracking

Where we record a "county," this is derived from your IP address at a coarse, county level (GeoIP) — it is not your GPS coordinates, and we do not track your precise movements. On pages presented as national in scope, we deliberately leave the county field blank rather than guess, so that our statistics are never misleadingly precise.

10.2 Fire-and-forget logging

Impression and click events are logged using a background mechanism that completes after your page has finished loading, so that analytics never slow down your browsing experience. This logging happens automatically as part of normal use of the Platform and does not require a separate action from you.

11Who We Share Your Data With

We do not sell your personal data. We share it only in the following circumstances (see also Section 16 of our Terms of Use on third-party services):

11.1 Service providers (data processors)

• Payment processors — Paystack, and where applicable M-Pesa Daraja, to process Verification Fee and Advertising Package payments;
• Hosting & infrastructure providers — to store data and run the Platform's servers and databases;
• Communication providers — email and WhatsApp Business messaging, used to send you account notifications, verification-status updates, and, where a Buyer initiates contact, to relay enquiries to Sellers.

11.2 Other users, in limited circumstances

When your Listing is published, the business details you have chosen to make public (business description, asking price, photos, general location, and a contact method you provide, such as a WhatsApp number) are visible to any visitor to the Platform. Your National ID, KRA PIN, exact financial figures, and verification documents are never shown to other users.

11.3 Legal & regulatory disclosure

We may disclose personal data where required to do so by Kenyan law, a court order, or a lawful request from the Office of the Data Protection Commissioner, the National Police Service, or another competent authority — for example, in connection with a fraud investigation under the Computer Misuse and Cybercrimes Act, 2018.

11.4 Business transfers

If VBE's business is sold, merged, or restructured, personal data may be transferred to the successor entity, subject to that entity honouring the commitments in this Policy.

12Payments & Financial Data

All payments on the Platform — Verification Fees, Advertising Package purchases, and Free-tier success commission invoices — are processed through Paystack, a licensed payment service provider. When you pay, your card, M-Pesa, or bank details are entered directly into Paystack's secure payment page, not into VBE's own servers. VBE receives only a payment reference, the amount, and a success or failure status, which we use to activate your verification application or advertising booking, or to mark a commission invoice as settled.

Paystack's own privacy and security practices govern the data you enter directly on their payment page; we encourage you to review Paystack's privacy policy for details of how they handle that information. For the Fees themselves — amounts, invoicing, and refunds — see Section 11 of our Terms of Use.

13International Data Transfers

Some of our service providers, such as hosting, email, or payment infrastructure, may process data on servers located outside Kenya. Where this occurs, we take steps consistent with the Data Protection Act, 2019, and the Data Protection (General) Regulations, 2021, to ensure the receiving party provides an adequate level of protection — for example, through contractual data-protection commitments — before any such transfer takes place.

14How Long We Keep Your Data

We keep personal data only for as long as necessary for the purposes described in this Policy, or as required by law. Approximate retention periods are set out below.

When data is no longer needed, we securely delete or irreversibly anonymise it. You may also request earlier deletion of certain data, as explained in Section 16. Blacklisting itself, and its effect on your account, is described in Section 21 of our Terms of Use.

15How We Protect Your Data

We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including:

• Encryption at rest for sensitive secrets, such as Two-Factor Authentication keys, encrypted using AES-256-GCM authenticated encryption before storage;
• One-way hashing for passwords and backup codes, using industry-standard bcrypt hashing, so that even VBE cannot recover your original password or backup codes;
• Constant-time verification for one-time passcodes and backup codes, to prevent timing-based attacks;
• Access-controlled document storage for ID card images and verification documents, served only through an authenticated internal mechanism rather than public file paths;
• CSRF protection and session-integrity checks on all forms that change your account, listing, or payment data;
• Single-device session enforcement and audit logging of key account and security events, including IP address, to detect suspicious activity;
• Rate limiting and anti-scraping protections to prevent automated harvesting of data published on the Platform;
• Restricted administrative access, with verification and blacklist actions logged and requiring a written reason;
• Published crawler access rules at robots.txt, so search engines and other automated visitors are only permitted to index public marketplace pages — never account, payment, or administrative systems. A plain-language explanation of what is and is not publicly reachable is set out in our Sitemap, Section 11 ("Pages We Keep Private").

No system can be guaranteed completely secure. If you believe your account has been compromised, contact us immediately using the details in Section 26. Unauthorised attempts to bypass these protections may also breach Section 14 of our Terms of Use.

16Your Rights as a Data Subject

Under the Data Protection Act, 2019, you have the following rights in relation to your personal data:

• Right to be informed — to know what data we collect and why (this Policy is how we fulfil that right);
• Right of access — to request a copy of the personal data we hold about you;
• Right to rectification — to have inaccurate or incomplete data corrected, for example updating your phone number or business details;
• Right to erasure — to request deletion of your personal data, subject to our legal obligations to retain certain records (such as payment records or confirmed-fraud blacklist entries);
• Right to restrict processing — to ask us to limit how we use your data in certain circumstances, for example while a dispute about its accuracy is resolved;
• Right to object — to object to processing based on legitimate interest, including analytics or marketing;
• Right to data portability — to receive certain data you provided to us in a structured, commonly used format;
• Right to withdraw consent — where processing is based on your consent (such as marketing emails), you may withdraw it at any time without affecting processing that already took place;
• Right to lodge a complaint — with the Office of the Data Protection Commissioner, as described in Section 25.

To exercise any of these rights, contact us using the details in Section 26. We will respond within a reasonable time and in any event within the timeframes required under the Data Protection (General) Regulations, 2021. We may need to verify your identity before actioning certain requests, to protect your data from being accessed by someone impersonating you.

17Marketing Communications & Opt-Out

We may send you optional marketing communications — for example, about new features, promotions on Advertising Packages, or Platform updates — where you have consented to receive them, typically at the point of registration.

We do not send marketing messages regarding transactional matters (such as verification status, payment confirmations, or security alerts) as "marketing" — these are necessary account notifications and cannot be opted out of while you hold an active account.

You may withdraw your consent to marketing communications at any time by using the unsubscribe link included in our emails, or by emailing support@verifiedbizexchange.com.

18Automated Decisions & Profiling

Certain steps in our verification process use automated checks — for example, confirming that the National ID number you typed matches the number printed on your uploaded ID image, and flagging documents that appear to be a student card, driving licence, or passport rather than a National ID. These automated checks support, but do not replace, human review: every verification application is ultimately reviewed and decided upon by a member of our verification team before your Blue Badge is granted or your application is rejected.

We do not use automated profiling to make any decision that produces a legal or similarly significant effect on you without human involvement.

19Children's Privacy

The Platform is intended for use by adults capable of entering into binding commercial transactions under Kenyan law. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete it promptly. If you believe a minor has provided us with personal data, please contact us using the details in Section 26.

20Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner without undue delay, and in any event within the timeframe required by the Data Protection Act, 2019. Where the breach is likely to result in a high risk to you, we will also notify you directly, describing the nature of the breach and the steps we are taking in response.

21Third-Party Links

The Platform may contain links to third-party websites, including payment processors, social media platforms, and, in some cases, links or contact details provided by Sellers. This Policy does not apply to those third-party sites, and we encourage you to review their own privacy policies before providing any personal data to them.

22Changes to This Policy

We may update this Policy from time to time to reflect changes in our data practices, the Services we offer, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or an in-Platform notice. We encourage you to review this Policy periodically.

23Do Not Track & Aggregated Data

Some browsers send a "Do Not Track" (DNT) signal. There is no single accepted technical standard for how a website should respond to DNT, so, like most Kenyan and international sites, we do not currently alter our data collection based on it. Because the Platform relies on strictly necessary cookies only (Section 9) rather than third-party tracking cookies, enabling DNT will not materially change what we collect from you.

Where we publish or share statistics derived from Platform data — for example, county-level demand trends discussed with Franchisors, or aggregate device-share figures used to improve the Platform — that data is anonymised or aggregated so that it cannot reasonably be used to identify an individual. Anonymised and aggregated data falls outside the scope of "personal data" under the Data Protection Act, 2019, and this Policy does not restrict our use of it.

24Exporting Your Data

Section 16 already gives you a general right to data portability. In practice, most account holders can export their own data without waiting on a support request: your dashboard lets you download your current Listings, verification status history, and invoice history directly as a spreadsheet or PDF. For anything not available there — such as a full copy of the personal data we hold about you — email support@verifiedbizexchange.com and we will provide it in a structured, commonly used electronic format (typically CSV or PDF) within the timeframe required by the Data Protection (General) Regulations, 2021.

25How to Complain to the ODPC

If you are unhappy with how we have handled your personal data, we ask that you first contact us directly using the details in Section 26 so that we can attempt to resolve your concern. If you remain unsatisfied, you have the right to lodge a complaint with:

26Contact Us & Our Data Protection Officer

If you have any questions about this Policy, wish to exercise a data subject right, or want to report a suspected privacy or security concern, please reach out — we typically respond within a few hours during business hours.