Privacy Policy
1.Who is responsible for your data
The data controller for personal data processed through Wosia is IVIO Advocates LLP, Maziwa Lane off Kamiti Road, Block B, P.O. Box 3336–00100, Nairobi, Kenya. We process personal data in accordance with the Data Protection Act, 2019 (“the DPA”).
Our registration with the Office of the Data Protection Commissioner (“ODPC”) is in the course of renewal.
2.What we collect
- Identity and contact data: name, national ID or passport number, KRA PIN, date of birth, addresses, phone, email.
- Family and estate data you provide in the interview: spouses, children and dependants; executors and guardians; assets, liabilities and gifts; funeral wishes; personal messages.
- Sensitive personal data, only where you choose to provide it: information revealing religion (for example funeral rites), health or disability of you or a beneficiary, and family details of children.
- Payment data: amount, product, M-Pesa or card transaction references. Card numbers are handled by our payment providers and never stored by us.
- Technical and usage data: device, log and security data used to protect accounts.
3.The sealed password memorandum
If you use the optional password memorandum, its contents are encrypted with a passphrase known only to you before they reach us. We hold only ciphertext and cannot read, recover or disclose the contents — including to you, if the passphrase is lost. Keep the passphrase safe and consider how your executor will obtain it.
4.Why we process your data, and on what legal basis
- To provide the service you request — the interview, drafting checks, document generation, storage and dashboard (performance of a contract; DPA s.30(1)(b)).
- Sensitive personal data — to include the provisions you choose in your will (your explicit consent; DPA s.44). You may decline; related features simply will not be included.
- Advocate review — to enable the reviewing advocate to consider your draft and answers (performance of a contract; professional obligations).
- Payments, tax and accounting records (legal obligation).
- Security, fraud prevention and service improvement using aggregated, de-identified information (legitimate interests).
5.Who we share data with
We share personal data only with those who need it to deliver the service:
- Reviewing advocates of IVIO Advocates LLP and affiliated firms, where you purchase review — under professional duties of confidentiality. Every access is logged.
- Safaricom PLC — M-Pesa payment processing, and domain and email services.
- Postmark (ActiveCampaign) — delivery of service emails such as receipts and review notices.
- Render — application hosting and database hosting.
- Truehost — domain and hosting services.
- Google (Workspace) — internal firm correspondence and document handling.
- GitHub — source-code hosting for the Platform.
- Authorities, where disclosure is required by law or court order.
Each processor is engaged under a written agreement requiring confidentiality and security measures consistent with the DPA.
6.International transfers
Some of our providers store or process data outside Kenya. Where they do, we rely on the conditions for transfer in sections 48 and 49 of the DPA, ensuring appropriate safeguards and that the transfer is necessary for the performance of our contract with you. Details of hosting locations are available from the DPO on request.
7.How long we keep data
- Account and will data: for as long as your account is open. Wills are long-lived documents; we keep versions so that you and your executor can rely on them.
- On account closure or erasure request: personal data is deleted or irreversibly anonymised, except payment and accounting records retained for statutory periods, and records the firm must retain under professional rules following advocate review.
8.Your rights
Under the DPA you have the right to be informed; to access your data; to correct it; to request deletion; to object to or restrict processing; and to data portability. You can exercise export and erasure directly from your dashboard, or by contacting the DPO at ivio-dpo@mzizi-africa.com. We respond within the timelines set by the DPA.
If you are dissatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner.
9.Security
Personal data in the interview and documents is encrypted at the application layer before storage, in transit using TLS, and at rest. Access is role-restricted and logged, and we maintain an append-only audit log of access to personal data. In the event of a breach posing a real risk of harm, we will notify the ODPC within seventy-two (72) hours and affected persons without undue delay, as the DPA requires.
10.Children
The service is for adults. We do not knowingly open accounts for persons under 18. Information about your children that you provide for guardianship or gift provisions is processed as part of your instructions.
11.Cookies
We use strictly necessary cookies for sign-in and security. We do not use advertising cookies.
12.Changes and contact
We will notify you of material changes to this Policy before they take effect.
Data Protection Officer: Margaret A. Odhiambo,
ivio-dpo@mzizi-africa.com
IVIO Advocates LLP, Maziwa Lane off Kamiti Road, Block B, P.O. Box 3336–00100, Nairobi, Kenya