Privacy Policy | WhaWallet

Last updated: May 2026 | This policy is compliant with the Kenya Data Protection Act 2019 and the Kenya Data Protection (General) Regulations 2021.

1. Who We Are

WhaWallet is operated by Whawallet Investment Group, Nairobi, Kenya ("we", "us", "our"). We are the data controller for personal data collected through the WhaWallet platform at whawallet.com.

For privacy-related enquiries, contact our Data Protection Officer at support@whawallet.com.

2. What Data We Collect

Category	Data Collected	Source
Group Admin	WhatsApp phone number, WhatsApp group invite link, M-Pesa/Till/Paybill number for withdrawals	Provided directly by admin on registration
Contributor	M-Pesa phone number, name (as returned by M-Pesa), contribution amount, timestamp	M-Pesa payment confirmation (STK push callback)
WhatsApp Group	Group ID, group name, messages sent by the WhaWallet bot	WhatsApp Business API
Technical Data	IP address, browser/device type, page visit timestamps	Automatically collected when you visit our website

We do not collect: National ID numbers, passwords, bank account credentials, or any data beyond what is necessary to operate the Service.

3. How We Use Your Data

Purpose	Legal Basis (Data Protection Act 2019)
Processing M-Pesa contributions and posting updates to the WhatsApp group	Performance of a contract / Legitimate interest
Processing withdrawals to the admin's M-Pesa / Till / Paybill	Performance of a contract
Maintaining a contribution ledger visible to group members	Legitimate interest (transparency and accountability)
Fraud prevention and platform security	Legitimate interest / Legal obligation
Complying with CBK regulations, tax obligations, or law enforcement requests	Legal obligation
Improving the Service (anonymised analytics)	Legitimate interest

4. Data Shared with Third Parties

We share your data only where necessary:

Safaricom / M-Pesa: Payment processing. Your phone number and transaction details are shared to initiate and confirm STK push payments. Safaricom's own privacy policy applies to their processing.
Meta / WhatsApp Business API: Messages sent by the bot to your WhatsApp group are processed via Meta's infrastructure. Meta's privacy policy applies.
Vercel (hosting): Our web application is hosted on Vercel. Server-side logs may contain IP addresses. Vercel's data processing agreement is in place.
Regulatory authorities: We will disclose data if required by Kenyan law, court order, or a lawful request by the Central Bank of Kenya, DCI, or other competent authority.

We do not sell your personal data to any third party, ever.

5. Contribution Data Visible in WhatsApp Groups

            Important: When you contribute via WhaWallet, your name (as registered with M-Pesa) and
            contribution amount are posted as an update in the WhatsApp group. This is a core feature of the Service —
            the transparency ledger. By contributing, you consent to this disclosure within the group.
        

If you do not want your name and amount visible to group members, do not use WhaWallet to contribute — instead, arrange payment directly with the group admin.

6. Data Retention

Contribution and withdrawal records: Retained for 7 years from the date of transaction in compliance with Kenya's tax and financial records requirements.
Group registration data: Retained for the duration the group is active plus 1 year after the last transaction.
Website logs / technical data: Retained for 90 days then deleted.

You may request earlier deletion of data not subject to a legal retention obligation by contacting us (see Section 9).

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

HTTPS encryption for all data in transit.
Access controls limiting who within Whawallet Investment Group can access personal data.
Secure, access-controlled database storage on Vercel's infrastructure.
No storage of full M-Pesa PINs or payment credentials — these are handled entirely by Safaricom's STK push system.

No system is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify you and the Office of the Data Protection Commissioner (ODPC) within 72 hours as required by law.

8. Your Rights Under the Kenya Data Protection Act 2019

Right of Access

Request a copy of the personal data we hold about you.

Right to Rectification

Ask us to correct inaccurate or incomplete data.

Right to Erasure

Request deletion of data we no longer need to hold (subject to legal retention obligations).

Right to Object

Object to processing based on legitimate interests.

Right to Portability

Receive your data in a structured, machine-readable format.

Right to Complain

Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

To exercise any of these rights, contact us at support@whawallet.com. We will respond within 21 days.

9. Cookies

WhaWallet's website uses minimal cookies strictly necessary for the Service to function (e.g., session management). We do not use advertising or tracking cookies. No third-party analytics cookies are set without your consent.

10. Children's Privacy

WhaWallet is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our platform, contact us immediately and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy periodically. The latest version will always be available at this URL with the revised date. Material changes will be notified to registered group admins via WhatsApp or email.

12. Contact & Data Protection Officer

For any privacy questions, data requests, or concerns:

Email: support@whawallet.com
Website: whawallet.com
Location: Nairobi, Kenya

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC): odpc.go.ke