How we collect, use, and protect your personal data.
Wallet Yetu is operated by Wallet Yetu Investment Group, Nairobi, Kenya ("Wallet Yetu", "we", "us" or "our"). Wallet Yetu provides digital treasury and contribution-management services through WhatsApp and associated web interfaces.
For personal data processed through our services, Wallet Yetu acts as the data controller where it determines the purposes and means of processing. We may also use third-party service providers as data processors or independent controllers for particular services.
For privacy-related enquiries, data-subject requests or concerns, contact us at support@walletyetu.com.
The information we process depends on how you interact with Wallet Yetu and which features you use.
| Category | Examples of Data | How We Obtain It |
|---|---|---|
| Group Administrator | WhatsApp phone number, name or identifying information, group ID, group name, group invitation/link information, and authorised withdrawal details such as an M-PESA phone number, Till number, PayBill number and, where applicable, PayBill account/reference information. | Provided by the administrator or received through the Wallet Yetu/WhatsApp service. |
| Contributor | Name, M-PESA phone number, contribution amount, transaction/reference number, payment status, confirmation information and transaction timestamp. | Provided during the contribution process or returned by the payment provider. |
| WhatsApp Group Data | Group ID, group name, WhatsApp identifiers where supplied, messages or commands addressed to Wallet Yetu, relevant group events, message IDs, timestamps and delivery/status information required to operate the service. | Received through the WhatsApp/Meta integration when the Wallet Yetu service is used. |
| Transaction & Ledger Data | Contribution and withdrawal records, amounts, transaction references, payment status, reconciliation information, timestamps and audit information. | Generated through use of Wallet Yetu and received from payment providers. |
| Technical Data | IP address, browser and device type, operating-system information, page/request timestamps, approximate technical information and security/log information. | Collected automatically when you use our website or technical services. |
We do not intentionally request or store M-PESA PINs, passwords, full payment credentials, or national identification numbers unless a specific lawful and necessary purpose requires otherwise. M-PESA PIN entry for an STK Push payment is handled through the payment provider's payment interface and is not provided to Wallet Yetu.
We may process personal data for the following purposes:
| Purpose | Typical Legal Basis |
|---|---|
| Creating and administering Wallet Yetu group collections | Performance of a contract; legitimate interests |
| Processing and confirming M-PESA contributions | Performance of a contract; legitimate interests |
| Processing authorised withdrawals to M-PESA, Till or PayBill destinations | Performance of a contract; legitimate interests |
| Maintaining contribution and withdrawal ledgers and communicating transaction updates | Performance of a contract; legitimate interests |
| Fraud prevention, abuse detection, security and access control | Legitimate interests; legal obligation |
| Customer support, troubleshooting and dispute investigation | Performance of a contract; legitimate interests |
| Accounting, tax, record-keeping and other legal or regulatory obligations | Legal obligation |
| Improving and securing the service, including aggregated or anonymised analytics | Legitimate interests; consent where required |
| Communicating material service, security, tariff or policy changes | Performance of a contract; legitimate interests; legal obligation where applicable |
Where we rely on consent as a legal basis, you may withdraw that consent where applicable. Withdrawal of consent does not affect processing that was lawfully carried out before the withdrawal.
This information is visible to members of the relevant WhatsApp group and is part of the group's treasury/accountability functionality. Wallet Yetu does not control who is a member of a WhatsApp group or what group members may do with information they can already see.
If you do not want your contribution information communicated through a Wallet Yetu group ledger, you should not use the Wallet Yetu contribution service for that collection and should arrange an alternative payment method with the group administrator.
Wallet Yetu uses WhatsApp/Meta services to communicate with groups and process commands and events necessary to operate the digital treasurer service. Depending on the integration and the events delivered to Wallet Yetu, this may include group identifiers, group names, WhatsApp identifiers, messages or commands directed to Wallet Yetu, participant-related events, message identifiers and timestamps.
We do not use access to a WhatsApp group as permission to collect unrelated private conversations. We process information received through the integration only for purposes connected with operating, securing, supporting and improving the Wallet Yetu service, subject to applicable law and the permissions provided by the relevant platform.
We may disclose or make personal data available to third parties where reasonably necessary to provide the service, protect users, comply with law, or perform functions on our behalf.
We do not sell your personal data to third parties.
Some of our technology and service providers may process or store personal data outside Kenya. Where personal data is transferred outside Kenya, Wallet Yetu will take appropriate steps and apply safeguards required by applicable Kenyan data protection law.
We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including operating the service, maintaining accurate financial records, resolving disputes, preventing fraud, enforcing agreements, and meeting legal, tax, accounting or regulatory obligations.
Where there is no continuing legal or operational reason to retain personal data, we may delete, anonymise or securely dispose of it. Some information may remain in backups for a limited period until those backups are securely overwritten.
We implement reasonable technical and organisational safeguards designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. Depending on the system involved, these measures may include:
No internet service or storage system can be guaranteed to be completely secure. If we become aware of a personal data breach that triggers a legal notification requirement, we will take the required steps to notify the Office of the Data Protection Commissioner and affected data subjects within the applicable statutory timelines.
Subject to applicable legal conditions and exemptions, you may have rights including:
Request access to personal data we hold about you.
Request correction of inaccurate or incomplete personal data.
Request deletion where there is no lawful reason for continued retention.
Object to certain processing, including processing based on legitimate interests where applicable.
Request restriction of certain processing where the applicable legal requirements are met.
Request your personal data in a structured, commonly used and machine-readable form where applicable.
Withdraw consent where processing is based on consent, subject to applicable limitations.
Lodge a complaint with the Office of the Data Protection Commissioner (ODPC).
To exercise a privacy right, contact us at support@walletyetu.com. We may need to verify your identity before fulfilling a request. We will respond within the period required by applicable law, subject to lawful extensions, exemptions and circumstances requiring additional verification.
Wallet Yetu may use cookies and similar technologies that are strictly necessary for website functionality, security, session management and authentication.
We do not use advertising cookies for behavioural advertising. If we introduce analytics, marketing or other non-essential cookies that require consent, we will provide the appropriate notice and consent mechanism where required.
Wallet Yetu is not directed at children. We do not knowingly seek to collect personal data from children in circumstances where such collection is prohibited by applicable law.
If you believe that a child has provided personal data to Wallet Yetu in circumstances where it should not have been collected, please contact support@walletyetu.com so that we can assess and take appropriate action.
Wallet Yetu does not currently make decisions producing legal or similarly significant effects on individuals solely through automated processing.
We may use automated technical controls for security, fraud prevention, transaction validation, rate limiting or service reliability. Where applicable law gives you rights regarding automated decision-making or profiling, those rights will be respected.
Wallet Yetu depends on third-party services, including WhatsApp/Meta, M-PESA/Safaricom, hosting and infrastructure providers. Those providers may independently process certain information under their own privacy notices, terms and legal obligations.
Wallet Yetu is not responsible for the privacy practices of third parties outside our reasonable control. You should review relevant third-party privacy information where appropriate.
We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, payment-provider arrangements or data-processing practices.
The latest version will be published on this page with its revised "Last updated" date. Where a change is material and applicable law requires notification, we may notify affected users through appropriate channels, which may include WhatsApp, email or an in-service notice.
We encourage you to contact Wallet Yetu first so that we can investigate and try to resolve your privacy concern. You may also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.
Office of the Data Protection Commissioner
For privacy questions, personal-data requests, complaints or other data-protection enquiries: