Privacy Policy

This Privacy Policy explains how Emohpay Technology Solutions, trading as VumaGigs ("VumaGigs", "we", "us", or "our"), collects, uses, stores, shares, and otherwise processes personal data when you use our website at https://vumagigs.com, our WhatsApp Business channel, and our ticketing, payment, and related services (together, the "Services").

VumaGigs is an event ticketing service for organizers and attendees in Kenya. Organizers create events through WhatsApp, set ticket types, prices, and capacity, and connect M-Pesa. Attendees buy on a shared web link, pay by M-Pesa STK push or Paybill, receive a QR ticket on the website, and may optionally claim a copy or receive updates in WhatsApp.

Data controller: Emohpay Technology Solutions, trading as VumaGigs, Nairobi, Kenya. Email: info@vumagigs.com. Website: https://vumagigs.com.

We process personal data in accordance with the Constitution of Kenya, 2010 (Article 31), the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021, and other applicable Kenyan law. Where we determine the purpose and means of processing, we act as a data controller. Where we process data on documented instructions of an event organizer, we may act as a data processor for that processing. Event organizers are independent controllers of event content they submit and of any attendee data we share with them for their event.

This Policy is a notice. It does not create a warranty, insurance, or fiduciary duty beyond Kenyan law. If you do not agree, do not use the Services.

This Policy applies to event organizers who create or manage events through WhatsApp or any VumaGigs channel; attendees and buyers who open a ticket link, buy tickets on the website, pay, claim a ticket on WhatsApp, or receive event messages; visitors to https://vumagigs.com; and anyone whose phone number or name is provided to us in connection with an order, refund, entry, or support request.

By using the Services, messaging our WhatsApp number, creating an event, placing an order on the website, or paying for a ticket, you confirm that you have read this Policy and that you are at least 18 years old.

We collect only what we need to run ticketing and payments. Depending on how you use the Services, this may include the categories below.

Identity and contact data: phone numbers you provide for M-Pesa payment and for ticket delivery or WhatsApp claim; WhatsApp phone number and display name if provided by Meta when you message us; any name or details you type in chat, on a form, or in a WhatsApp Flow; organizer and buyer account identifiers we generate.

Event data submitted by organizers: event title; venue; date and time; ticket type names; prices in Kenya Shillings; capacity; sales window; and related event details.

Order and ticket data: event selected; ticket types and quantities; order amount; order status (initiated, STK sent, paid, expired, or failed); ticket serial numbers; QR ticket records; checkout tokens; timestamps.

Payment data: M-Pesa payment phone number; Paybill or STK checkout identifiers; M-Pesa receipt numbers; payment status and amount. We do not collect, store, or have access to your M-Pesa PIN, password, or OTP.

WhatsApp message data: inbound and outbound messages, button replies, Flow responses, ticket claim messages, and short lived session data used to complete event creation or optional ticket delivery. Draft event sessions may be held temporarily (including in cache) and then deleted when the flow completes or times out.

Technical and security data: server logs, webhook delivery records, approximate timestamps, and identifiers needed to authenticate Safaricom, Meta, or our own callbacks, prevent fraud, and debug failures.

Website data: marketing pages and ticket checkout pages on https://vumagigs.com. Checkout may collect phone numbers and order details you submit. The site may record standard server logs (for example IP address, browser type, and pages requested) as part of hosting and security. We do not sell website analytics profiles. If we later add cookies or analytics, we will update this Policy.

We do not intentionally collect national ID numbers, KRA PINs, bank cards, precise GPS location, photos of faces, or special categories of personal data (health, biometrics, ethnicity, religion, or similar) as part of the core ticketing flow. Do not send such data in chat. If you send it unsolicited, we may delete it where practicable.

We obtain personal data directly from you in WhatsApp, on the website, or by email or phone; automatically from Meta Platforms Ireland Limited and its affiliates when you use WhatsApp to contact us (phone number, profile name, message content, and delivery metadata), under Meta's terms; from Safaricom PLC when you pay via M-Pesa Daraja (STK push, Paybill, receipt, and related payment metadata); from the event organizer, if they identify you as a buyer, guest, or staff member; and from our hosting, database, and queue infrastructure when you use the Services.

We process personal data only where at least one lawful basis under the Data Protection Act, 2019 applies.

Contract: processing that is necessary to create your account from a phone number or WhatsApp identity, create and list events, hold ticket inventory, take payment on the website, issue a QR ticket, handle expiry of unpaid orders, and provide support.

Consent: WhatsApp communications you initiate; optional WhatsApp ticket claim or event updates and future drop messages to ticket holders who bought through the Services; and any processing we describe as optional. You may withdraw consent by messaging us STOP or writing to info@vumagigs.com, without affecting processing already completed.

Legitimate interests: preventing fraud and abuse, securing the Services, reconciling payments, keeping audit trails, improving reliability, and defending legal claims. We balance these interests against your rights.

Legal obligation: tax, accounting, law enforcement, court, or ODPC requests, and other duties under Kenyan law.

You are not legally required to give us data. If you withhold phone number or payment details, we cannot sell you a ticket or run your event on the Services.

We use personal data to identify organizers and buyers by phone number or WhatsApp identity and issue an internal user identifier; create, store, and display events, ticket types, capacity, and sales windows; create orders on the website, reserve capacity for a limited time, expire unpaid holds, and issue tickets after confirmed payment; send M-Pesa STK prompts to the payment number you provide and record Paybill or STK callbacks, receipts, and status; show QR tickets on the website and, when you claim them, send ticket images or service messages in WhatsApp; let organizers view their events and sales counts; send event updates, reminders, and service notices to ticket holders for an event they purchased, including messages an organizer asks us to send about that event; scan or look up a ticket serial at entry; prevent fraud, duplicate tickets, inventory abuse, and webhook tampering; keep financial and operational records; comply with law and enforce our terms; and contact you about onboarding, support, or material changes to this Policy.

We do not sell personal data. We do not use attendee phone numbers to advertise unrelated third party products. Organizer marketing of their own future events to people who already bought a ticket through VumaGigs is part of the Services and is described above.

We share personal data only as follows.

Meta / WhatsApp: messages, Flows, and your phone number are processed by Meta to deliver WhatsApp. Meta's processing is governed by Meta's terms and privacy policy. We do not control WhatsApp as a product.

Safaricom / M-Pesa: payment phone number, amount, and transaction identifiers are processed by Safaricom PLC to complete M-Pesa payments. We do not control M-Pesa. Failed, delayed, or reversed payments are handled under Safaricom's rules.

Event organizers: for a given event, we may share with the organizer of that event such attendee data as is reasonably necessary for that event: ticket type, quantity, payment status, ticket serial, and phone number. The organizer is independently responsible for how they use that data, including gate entry, refunds, and their own messages. We are not responsible for an organizer's misuse.

Service providers: hosting, database, cache, logging, and similar vendors who process data on our instructions and only to provide infrastructure.

Professional advisers and authorities: lawyers, accountants, insurers, courts, police, ODPC, KRA, or other authorities where required or permitted by law, or to establish, exercise, or defend legal claims.

Business transfer: if we sell, merge, or reorganize the business, personal data may transfer to the successor, who must continue to protect it in line with this Policy or give you notice of changes.

We do not share personal data with advertisers for their independent marketing. We do not publish your phone number on the public website.

WhatsApp is operated by Meta. Message data is transferred outside Kenya, including to Ireland, the United States, and other countries where Meta or its subprocessors operate. Those countries may not have a data protection law that the Cabinet Secretary has gazetted as adequate.

By using WhatsApp with the Services you consent to that transfer as necessary to perform the contract and to communicate with you. We also rely on the contractual necessity of the transfer where WhatsApp delivery or organizer onboarding requires Meta, and on appropriate safeguards where we can impose them on our own vendors. Website checkout and QR tickets on https://vumagigs.com do not require WhatsApp.

M-Pesa processing by Safaricom is in Kenya.

You understand that once a message is on WhatsApp, Meta's security, retention, and law enforcement practices apply in addition to ours.

We keep personal data only as long as needed for the purposes above, including legal, tax, and dispute periods, then delete or irreversibly anonymise it where practicable.

WhatsApp event creation drafts in session storage: up to 30 minutes after last activity, then deleted.

Unpaid or expired orders: kept as records of inventory and fraud control, with status marked expired or failed.

Paid orders, M-Pesa receipts, and tickets: kept for at least seven (7) years after the transaction or the event date, whichever is later, to meet accounting, tax, and dispute needs, unless a longer period is required by law.

Organizer and buyer account phone numbers: kept while the account is active and for a reasonable period after last use so we can handle refunds, chargebacks, repeat events, and legal claims.

Server and security logs: a shorter operational period unless needed for an investigation.

We may retain data longer if a claim, investigation, or legal hold is pending.

We use reasonable technical and organizational measures appropriate to the risk, including access controls, encrypted transport where we control the channel (HTTPS and WhatsApp's transport as provided by Meta), secrets for webhooks, and least privilege access to production systems.

No method of transmission or storage is fully secure. WhatsApp, M-Pesa, your phone, and the public internet are outside our full control. We do not warrant that the Services are immune from unauthorized access, hacking, or loss. You are responsible for control of your handset, SIM, WhatsApp account, and M-Pesa PIN.

To the maximum extent permitted by Kenyan law, we are not liable for breaches or outages at Meta, Safaricom, telecom operators, or hosting providers; tickets or messages forwarded by you to other people; organizer or venue handling of attendee lists or gate scans; or loss arising because you used a phone number you do not control.

Nothing in this Policy excludes liability that cannot be excluded under the Data Protection Act, 2019 or other mandatory Kenyan law, including liability for our own unlawful processing where such liability cannot be limited.

Subject to the Data Protection Act, 2019 and its exemptions, you may request to be informed about the processing of your personal data; access your personal data; object to processing based on legitimate interests or direct marketing; correction of inaccurate or incomplete data; deletion, where the Act allows; restriction of processing in the cases the Act provides; and data portability, where technically feasible and where processing is by automated means on the basis of consent or contract.

We may need you to verify the WhatsApp number or identity that matches the record. We may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive, as the Act allows.

We will respond within the statutory period (generally thirty (30) days, extendable as the Act permits).

Some data cannot be deleted immediately, including payment records we must keep for tax or to prove a ticket was issued.

To exercise rights, write to info@vumagigs.com. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya: https://www.odpc.go.ke

The Services are for persons aged 18 and above. We do not knowingly create organizer accounts or process ticket purchases for children. If you believe a child has provided data, contact us and we will delete it where the law requires, subject to payment record duties.

We use automated systems to create users from phone numbers; hold and expire unpaid orders; match M-Pesa callbacks to orders; issue ticket serials; and send template or service messages. These steps are necessary to perform the contract. They do not constitute solely automated decisions with legal effect beyond completing or refusing a ticket purchase based on payment, capacity, and sales window. There is no credit scoring.

If you are an organizer you warrant that you have a lawful basis to run the event and to receive attendee data; information you submit is accurate and not unlawful, defamatory, or infringing; you will use attendee phone numbers only for that event (entry, refunds, safety, and operational messages) unless you have your own lawful basis for more; you will not upload other people's data into our Flows or chat without authority; and you will comply with the Data Protection Act, 2019 in your own capacity.

You indemnify Emohpay Technology Solutions and VumaGigs against claims, losses, and regulator costs arising from your event, your content, your handling of attendees, or your breach of this section, to the maximum extent permitted by law.

VumaGigs is a technology intermediary. We are not the organizer, venue, or merchant of the underlying event unless we expressly say so in writing for a specific event. Ticket contracts for attendance are between the buyer and the organizer. Payment collection through M-Pesa is a payment instruction, not a guarantee of event quality.

The Services depend on WhatsApp and M-Pesa. Their terms apply in addition to this Policy. We are not responsible for third party privacy practices. The website may link to WhatsApp. Once you leave our site, this Policy no longer governs that third party.

Questions, access requests, withdrawal of consent, and complaints about our processing should be sent to info@vumagigs.com. You may also use the official VumaGigs Business number published on https://vumagigs.com. Postal: Emohpay Technology Solutions, Nairobi, Kenya.

Please allow us a chance to resolve the issue. You may also complain to the Office of the Data Protection Commissioner.

We may update this Policy from time to time. The "Last updated" date will change. The current version will be published at https://vumagigs.com/privacy. Continued use after an update constitutes notice of the new version. Material changes may also be sent by WhatsApp to recent users where reasonably practicable. We are not obliged to obtain a fresh signature.

This Policy is governed by the laws of Kenya. Subject to your right to approach the ODPC, courts of Kenya in Nairobi have exclusive jurisdiction over disputes arising out of this Policy, to the extent such a choice is lawful.

This Policy is issued in English. If we later provide a Kiswahili version and there is a conflict, the English version prevails, except where Kenyan law requires otherwise.