Primary Logo

Data Rights Request Procedure

Effective Date: 30 July 2026 · Version 2.0

This procedure explains how you can exercise your data protection rights as a Vyete user. Vyete Technologies Ltd ("Vyete") is committed to honouring these rights promptly and transparently in accordance with applicable data protection law.

1. Rights Available to You

Depending on your location, you may have some or all of the following rights regarding your personal data:

| Right | What It Means | |---|---| | Access | Obtain a copy of the personal data Vyete holds about you | | Rectification | Correct inaccurate or incomplete personal data | | Erasure | Request deletion of your personal data ("right to be forgotten") | | Restriction | Ask Vyete to limit how it processes your data in certain circumstances | | Portability | Receive your data in a structured, machine-readable format | | Objection | Object to processing based on legitimate interests or for direct marketing | | Automated decisions | Request human review of decisions made solely by automated processing |

2. How to Submit a Request

Tip

The fastest way to exercise your rights is through the Data Privacy section of your account at id.vyete.com. Access and Portability requests submitted there are fulfilled automatically by email. Erasure (account deletion) is handled separately in the same section.

1

Sign in to id.vyete.com

Go to id.vyete.com, sign in, and open Data Privacy from your account settings.

2

Select the right you wish to exercise

Choose from: Access, Portability, Rectification, Restriction, or Objection. Provide any additional context in the description field. (For Erasure, use the separate account-deletion option in the same section.)

3

Receive confirmation

Access and Portability requests are fulfilled immediately — check your email for the export. Other request types are reviewed by our privacy team; you'll receive acknowledgement within 3 business days and a reference number.

Alternative: Email Request

You may also submit a request by email to [email protected]. Include your full name, the email address associated with your Vyete account, a clear description of the right you wish to exercise, and any relevant details.

Alternative: Postal Request

Written requests may be sent to Vyete Technologies Ltd, Data Protection Officer, at our registered address (contact [email protected] for the current address). Postal requests may take longer to process.

3. Identity Verification

To protect your data, Vyete must verify your identity before processing any request. The level of verification depends on the sensitivity of the request:

  • Standard requests (access, portability): Verification via your registered email address or account confirmation link.
  • High-sensitivity requests (erasure, rectification of financial data): Additional identity document or account authentication may be required.

Vyete will not action a request until identity is confirmed. If verification fails, Vyete will notify you within 5 business days.

4. Response Timeframes

| Stage | Timeframe | |---|---| | Acknowledgement | Within 3 business days of receipt | | Identity verification | Within 5 business days | | Full response | Within 30 calendar days of receipt | | Complex requests | Up to 90 calendar days (we will notify you of any extension within 30 days) |

Vyete aims to respond faster than these limits in most cases.

5. Erasure Requests

5.1 When Erasure Applies

Vyete will erase your personal data when:

  • It is no longer necessary for the purpose it was collected.
  • You withdraw consent and there is no other legal basis for processing.
  • You successfully object to processing.
  • The data has been unlawfully processed.

5.2 When Erasure Cannot Be Fulfilled

Vyete may retain data despite an erasure request where retention is necessary for:

  • Compliance with a legal obligation (e.g., financial record-keeping requirements).
  • Establishing, exercising, or defending legal claims.
  • Fraud prevention and platform integrity purposes.
  • Completion of an in-progress transaction or dispute.

Vyete will explain which data cannot be erased and the legal basis for retention.

5.3 Effect on Your Account

An erasure request for your core account data will result in account closure. Vyete will confirm this before proceeding.

5.4 How Account Erasure Actually Works

Requesting erasure of your account (via the Data Privacy section at id.vyete.com, OTP-verified) does not delete anything immediately. Instead:

  1. Your account is disabled immediately — you're logged out and can't sign back in.
  2. A confirmation email is sent stating the exact date, 21 days from your request, on which deletion will be carried out, along with a one-click link to cancel.
  3. If you don't cancel, on that date Vyete permanently deletes: your login and session history, security logs, saved locations, device records, and account credentials.
  4. Order and review records tied to your account are anonymised, not deleted — the personal-data link is severed (your name and contact details are replaced or removed), but the order or review itself is retained, consistent with the retention grounds in Section 5.2 (financial record-keeping, fraud prevention, shop trust/dispute history).
  5. A final confirmation email is sent once deletion is complete.

Cancelling before the 21 days is up (via the link in the confirmation email) fully restores your account with no data loss.

6. Portability

Where your right to data portability applies, Vyete will provide your personal data in a structured, commonly used, and machine-readable format (JSON).

The automatic export available through the Data Privacy section at id.vyete.com includes your account and profile information (name, email, username, roles, account dates). For order history, review history, or saved addresses, submit your request by email to [email protected] — these categories are compiled manually and delivered within the timeframes in Section 4.

7. Objection to Direct Marketing

You may object to your personal data being used for direct marketing at any time. This can be done:

  • In your account under Notifications → Marketing Preferences.
  • By emailing [email protected].
  • By using the unsubscribe link in any marketing communication.

Opt-out requests for marketing are processed within 5 business days. Note that transactional communications (order confirmations, security alerts) are not affected.

8. Exemptions and Limitations

Your rights are not absolute. Vyete may refuse or limit a request where:

  • It is manifestly unfounded or excessive (Vyete will explain why and may charge a reasonable fee).
  • Fulfilling it would adversely affect the rights of another person.
  • It conflicts with a legal obligation or court order.
  • The data was collected for solely journalistic, academic, or public-interest purposes.

Where Vyete refuses a request, it will provide the reasons in writing within 30 calendar days.

9. Complaints

If you are dissatisfied with Vyete's response to a data rights request, you may:

  1. Escalate internally via [email protected], referencing your original request.
  2. Contact the Office of the Data Protection Commissioner (ODPC), Kenya's data protection authority, which oversees compliance with the Data Protection Act, 2019.
  3. If you are located in the UK or EU/EEA, you may instead (or additionally) contact your local data protection authority — for example the ICO in the United Kingdom or the DPC in Ireland.

Vyete is committed to resolving data protection concerns and will cooperate with any regulatory investigation.

10. Contact

All data rights requests and privacy enquiries: [email protected]

Data Protection Officer: [email protected]