Vicage Investment Privacy Policy
Last updated: [Insert Date]. Vicage Investment ("we", "our", "us") is committed to protecting your privacy and handling your data with care. This Policy explains the types of information we collect, why we collect it, how we use it, your rights, and the measures we take to protect it.
Scope & Overview
This Policy applies to personal data we collect about individuals who access our website, engage our services, or otherwise interact with Vicage Investment (clients, prospective clients, counterparties, job applicants, suppliers, and website visitors).
1. Information We Collect
We collect information necessary to provide our services, comply with legal obligations, and support our business operations. Categories include:
Personal & Identity Data
Full name, date of birth, nationality, identification documents (passport, national ID), contact details (email, phone, address), and professional information (employer, role).
Financial & Transactional Data
Bank account details, payment instructions, transaction records, financial statements provided for credit assessment, investment documents, and contract records.
Compliance & KYC Data
Documentation and screening outcomes used for Anti-Money Laundering (AML), Counter-Terrorism Financing checks, sanctions screening, and regulatory compliance.
Technical & Usage Data
IP addresses, device and browser metadata, pages visited, session times, cookies and analytics data used to improve site functionality and security.
Communications
Records of communications between you and Vicage, including emails, meeting notes, proposals, and other correspondence.
2. How We Use Your Information
We process data for purposes that include (but are not limited to): delivering services, performing due diligence, complying with legal obligations, improving our offerings, communicating with clients, and preventing fraud. We only use your data where we have a lawful basis — contractual necessity, legal obligations, legitimate interests, or your consent.
3. Legal Bases & Legitimate Interests
When required by law, we rely on specific legal bases for processing. These include:
- Contractual necessity: processing required to deliver services.
- Legal compliance: AML, tax and regulatory reporting.
- Legitimate interests: fraud prevention, audits, business continuity and improving our services.
- Consent: for marketing and newsletters where you have opted in.
4. Sharing & Disclosure
We do not sell personal data. Disclosures to third parties are limited to:
- Financial institutions and co-lenders participating in financing solutions.
- Professional advisors (legal, audit) under strict confidentiality.
- Technology and service providers who process data on our behalf.
- Regulators, tax authorities and courts when required by law.
5. International Transfers
Vicage operates with global partners. Where personal data is transferred internationally, we implement safeguards such as standard contractual clauses, encryption, and vendor controls to protect your information consistent with applicable laws.
6. Data Security
We implement industry-standard technical and organisational measures to protect data: encryption at rest and in transit, secure hosting, strict access controls, staff training, and periodic security reviews. In the unlikely event of a data breach, we have an incident response plan to contain the breach and notify affected parties and regulators as required.
7. Data Retention
We retain data only as long as necessary to fulfil the purpose it was collected for, and to satisfy legal, regulatory, and contractual obligations. Typical retention windows include:
- KYC / AML records: retained for a minimum of 5–7 years per financial regulations.
- Transaction records: retained for tax, audit and reporting requirements.
- Marketing consents: until withdrawal of consent.
8. Your Rights
Subject to local law, you may have the right to access, correct, delete, object to processing, restrict processing, or obtain a portable copy of your personal data. To exercise these rights, please contact our Data Protection Team (details below). We will respond in accordance with applicable law.
9. Cookies & Tracking
We use cookies and tracking technologies for analytics, security and functionality. You can manage cookie preferences through your browser. For details, refer to our Cookie Notice here.
10. Children
Our services are not intended for children under 18. We do not knowingly collect personal data from minors. If discovered, such data will be deleted immediately.
11. Changes to this Policy
We may update this Policy to reflect legal, regulatory, or business changes. Material changes will be communicated via our website or direct notice where feasible. Check the "Last updated" date at the top of this page.
12. Contact & Data Requests
If you have questions, wish to exercise a data right, or need more information about our privacy practices, contact:
Data Protection Officer
Vicage Investment
Email: privacy@vicageinvestment.com
Phone: +254108076878
Detailed Procedures & Operational Notes
Below we summarise practical measures, internal procedures and third-party controls we use to protect personal data and ensure compliance across Vicage operations.
Operational Controls
- Access Control: Role-based access with multi-factor authentication for sensitive systems.
- Encryption: Data encrypted at rest and TLS for data in transit.
- Vendor Management: Due diligence and contractual data processing agreements with all suppliers.
- Incident Response: Documented incident playbooks and regular drills.
- Audit & Assurance: Periodic internal and external security audits.
Third-Party Processors
We engage cloud hosting, analytics and communication providers. Each vendor signs Data Processing Agreements and must meet minimum security thresholds. Our internal list of processors and sub-processors is available upon request.
Data Minimisation & Accuracy
We only collect data necessary for the purposes communicated to you. We take steps to ensure data accuracy and provide mechanisms for you to update your information.
International Transfers & Safeguards
When data moves across borders, we rely on legal safeguards such as Standard Contractual Clauses, adequacy decisions, or specific contractual protections. All transfers are logged and evaluated for risk.
Data Breach Notification
In case of a security incident affecting personal data, we will promptly investigate, contain and notify affected individuals and regulators as required by law, including details of the incident and mitigation measures.
Legal & Regulatory Disclosures
We may disclose data to comply with a legal obligation, for fraud prevention, or to protect our rights and property. We strive to limit disclosures and request protective orders where applicable.
Employee & Applicant Data
Information collected in recruitment and employment contexts is processed under separate HR policies and only used for recruitment, onboarding, payroll, benefits and legal compliance.
If you are an applicant or employee and have questions about how your personal data is handled, please contact hr@vicageinvestment.com for full HR-data policies.
Marketing & Communications
We only send marketing communications to individuals who have consented or where a legitimate interest exists. Each marketing message includes an easy unsubscribe link. For preferences, contact marketing@vicageinvestment.com.
Newsletter & Insights
Subscribe to receive updates — you can unsubscribe at any time. Your email will not be shared with third parties for marketing without explicit consent.
Contact & Data Requests
To exercise any rights or make a request regarding your personal data, please contact our Data Protection Officer using the details below. We will respond in accordance with relevant legal timeframes.
Make a Request
Email: privacy@vicageinvestment.com
Phone: +254108076878
Postal: Vicage Investment, [Insert Address], Nairobi, Kenya
Complaints & Supervisory Authorities
If you are not satisfied with our response to a data request, you have the right to lodge a complaint with your local data protection regulator. If you are in Kenya, the Office of the Data Protection Commissioner is the supervisory authority.
Updates & Versioning
This Policy will be reviewed periodically. Significant changes will be highlighted on our website and, where appropriate, communicated directly to affected individuals.