Privacy Policy

1. Introduction & Who We Are

Welcome to Vukacover, a digital platform designed to make insurance education, discovery, and financial empowerment accessible to Gen Z, young millennials, small and medium enterprises (SMEs), insurance agents, and insurance companies across Africa.

Vukacover is a product jointly developed and operated by:

• ZEP-RE (PTA Reinsurance Company) — a pan-African reinsurance institution headquartered in Nairobi, Kenya, serving the Eastern and Southern African region.
• AICE Africa (Artificial Intelligence Centre of Excellence) — an AI company focusing on building AI products across Africa, also headquartered in Nairobi, Kenya.

Together, as data controllers, we are committed to protecting the privacy and personal data of every user, agent, partner, and institution that uses the Vukacover platform (the "Platform"), whether accessed via website or mobile application.

This Data Privacy Policy ("Policy") explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over your data. By registering on or using the Vukacover Platform, you agree to the practices described in this Policy. If you do not agree, please do not use the Platform.

2. Scope of This Policy

This Policy applies to all users of the Vukacover Platform, including:

• Learners — individuals (Gen Z, young millennials, and SME representatives) who register to learn about insurance products, simulate coverage options, and earn loyalty rewards.
• Agents — licensed insurance professionals who use the Platform to refer clients, track learner engagement, and manage their digital presence.
• Insurance Companies — institutional partners who host their products and offerings on the Platform.
• Partner Organisations — loyalty reward providers and other third-party collaborators.
• Visitors — individuals who browse the Platform without creating an account.

This Policy covers data collected through all Vukacover touchpoints: the website, mobile application (iOS and Android), in-app wallets, referral systems, notifications, and any future digital channels operated under the Vukacover brand.

3. Personal Data We Collect

We collect different categories of personal data depending on your relationship with the Platform and the features you use:

3.1 Data We Do NOT Collect

Vukacover does not, and will not, collect:

• Full national ID or passport scans (beyond what is required for regulated KYC processes as mandated by law).
• Sensitive health data beyond insurance-relevant risk categorisation (and only where explicitly consented).
• Children's personal data — the Platform is intended for users aged 18 and above.
• Financial data beyond what is needed for wallet operations and reward disbursements.

3.2 How Data Is Collected

We collect your data through:

• Registration and profile forms (data you provide directly).
• In-app activity and interactions (automatically collected through cookies and analytics SDKs).
• Referral flows (data shared by the referring agent or learner).
• Third-party partners (loyalty reward partners who share redemption data in accordance with their own privacy policies).
• Device permissions you grant (e.g. camera access for profile photo upload, notifications).

4. Legal Basis for Processing Your Data

We only process your personal data when we have a valid legal basis to do so under the Kenya Data Protection Act, 2019 (DPA 2019) and applicable data protection legislation:

5. How We Use Your Personal Data

5.1 Account Management & Service Delivery

• Creating, maintaining, and securing your Vukacover account.
• Verifying your identity as a learner, agent, or institutional partner.
• Processing your in-app wallet transactions, loyalty point credits, and reward redemptions.
• Administering referral relationships between learners and agents.

5.2 Education & Personalisation

• Delivering personalised insurance education modules based on your profile and learning history.
• Running interactive product simulations tailored to your needs (e.g. life, health, motor, SME cover).
• Providing product recommendations from insurance companies hosted on the Platform.
• Tracking learning progress and awarding loyalty points on completion milestones.

5.3 Agent & Partner Enablement

• Connecting agents to learners through referral tools and performance dashboards.
• Enabling insurance companies to list, showcase, and simulate their products on the Platform.
• Administering reward partner programmes, including point issuance and redemption tracking.

5.4 Communication

• Sending transactional messages (account confirmations, OTPs, wallet receipts).
• Sending service notifications (new modules available, referral updates, loyalty milestones).
• Sending marketing communications (only with your explicit consent, with easy opt-out).

5.5 Safety, Compliance & Fraud Prevention

• Monitoring the Platform for fraudulent activity, abuse, and security threats.
• Complying with the Kenya Data Protection Act, 2019, Insurance Act (Kenya), and applicable AML/CFT obligations.
• Responding to regulatory requests from the Office of the Data Protection Commissioner (ODPC), IRA, and equivalent regional bodies.

5.6 Research, Analytics & Product Improvement

• Analysing anonymised usage patterns to improve content quality and user experience.
• Generating aggregated insights for ZEP-RE and AICE Africa on insurance literacy trends in Africa.
• Conducting user satisfaction surveys (participation is voluntary).

6. How We Share Your Data

We do not sell your personal data. We share data only in the circumstances described below, and always with appropriate safeguards in place.

6.1 Within the Vukacover Ecosystem

• Between ZEP-RE and AICE Africa as joint data controllers for platform operations.
• With insurance companies hosted on the Platform, only aggregated, anonymised insights unless you have explicitly engaged with or consented to contact from a specific insurer.
• With agents, limited referral data (e.g. the fact that you used their referral code and your learning progress, not your full profile) where you consented to the referral relationship.

6.2 With Trusted Service Providers (Data Processors)

We engage third-party processors who act only on our documented instructions:

• Cloud infrastructure providers (hosting, database management, and backup services).
• Mobile money and payment gateway operators (for wallet top-ups and reward disbursements).
• SMS and email communication platforms (for OTP and notification delivery).
• Analytics and crash reporting tools (anonymised or pseudonymised data only).
• Cybersecurity and fraud detection service providers.

All processors are bound by data processing agreements that require them to maintain confidentiality and implement appropriate security measures.

6.3 With Loyalty Reward Partners

When you redeem loyalty points with a partner, we share the minimum data necessary (e.g. your name and contact for redemption confirmation) with that partner. Each partner operates under their own privacy policy, and we recommend reviewing those policies. We will not share your full profile with partners without your explicit consent.

6.4 For Legal & Regulatory Compliance

We may disclose your data to regulators, law enforcement, or courts when required by law, including under the Kenya Data Protection Act, 2019; Insurance Act (Kenya, Cap. 487); AML/CFT regulations; and equivalent laws in other East and Southern African jurisdictions.

6.5 Business Transfers

In the unlikely event of acquisition or restructuring involving ZEP-RE or AICE Africa, your data may be transferred to a successor entity. We will notify you of any such change and you may request deletion of your data at that time.

7. International Data Transfers

Vukacover is built to serve users across East and Southern Africa. As such, your data may be processed in countries other than your country of residence. We ensure that any cross-border transfer is governed by standard contractual clauses, adequacy assessments, and binding contractual obligations on recipient processors to maintain security standards equivalent to those required by the Kenya DPA 2019.

You may request information on the specific safeguards applicable to any transfer of your data by contacting our Data Protection Officer (see Section 14).

8. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by law:

When your data is no longer needed, it is securely deleted or irreversibly anonymised.

9. Your Data Rights

Under the Kenya Data Protection Act, 2019, and applicable regional legislation, you have the following rights with respect to your personal data:

To exercise any of these rights, contact our Data Protection Officer as described in Section 14. We will respond within 30 days.

10. How We Protect Your Data

The security of your data is a foundational commitment of Vukacover. We implement a multi-layered security framework aligned to industry best practices and applicable regulatory requirements.

10.1 Technical Safeguards

• Encryption in Transit: All data transmitted between your device and our servers is protected using TLS 1.2 or higher (HTTPS).
• Encryption at Rest: Sensitive data stored in our databases is encrypted using AES-256.
• Password Security: Passwords are never stored in plain text; we use bcrypt hashing with salt for all stored credentials.
• Multi-Factor Authentication (MFA): Available and strongly encouraged for all user accounts; mandatory for agent and institutional partner accounts.
• API Security: All Platform APIs are authenticated and rate-limited. We apply OWASP API Security Top 10 principles.
• Penetration Testing: We conduct regular third-party penetration testing and vulnerability assessments.

10.2 Organisational Safeguards

• Data is accessed on a strict need-to-know basis with role-based access controls (RBAC).
• All personnel with access to personal data receive mandatory data protection training.
• All third-party processors are assessed for security compliance before engagement.
• We maintain a documented data breach incident response plan aligned to the 72-hour notification requirement of the Kenya DPA 2019.

10.3 Platform-Specific Safeguards

• Wallet transactions require PIN or biometric authentication and are logged immutably for audit purposes.
• Referral codes are cryptographically generated and single-use validated to prevent abuse.
• Sessions expire after a period of inactivity; concurrent session limits are enforced.
• Suspicious login attempts from new devices trigger step-up authentication.

11. Cookies & Similar Technologies

Vukacover uses cookies and similar tracking technologies to ensure the Platform functions correctly, to enhance your experience, and to analyse usage patterns. For full details see our Cookie Policy.

12. Children's Privacy

The Vukacover Platform is intended for users aged 18 years and above. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that personal data from a minor has been collected without appropriate consent, we will take immediate steps to delete such data.

If you are a parent or guardian and believe your child has registered on the Platform, please contact us immediately at privacy@omnicover.africa.

13. Changes to This Policy

We may update this Data Privacy Policy from time to time to reflect changes in our practices, Platform features, or applicable law. When we make material changes, we will:

• Update the "Last Reviewed" date at the top of this Policy.
• Notify registered users via in-app notification and email at least 14 days before the changes take effect.
• Where required by law, seek your renewed consent for material changes to how we process your data.

Your continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not accept the changes, you may close your account and request deletion of your data.

14. Contact Us & Data Protection Officer

We have appointed a Data Protection Officer (DPO) as required by the Kenya Data Protection Act, 2019. You can reach our DPO or our privacy team for any data rights requests, complaints, or enquiries:

15. Glossary

Data Controller

The entity that determines the purposes and means of processing personal data. In this Policy, ZEP-RE and AICE Africa are joint data controllers.

Data Processor

A third party that processes personal data on behalf of a data controller under documented instructions.

Personal Data

Any information relating to an identified or identifiable natural person.

Processing

Any operation performed on personal data, including collection, storage, use, disclosure, and deletion.

Consent

A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data.

Loyalty Points

Reward credits earned on the Platform through learning activities, referrals, and engagement, redeemable with partner organisations.

Wallet

The in-app digital wallet on the Vukacover Platform used to hold loyalty point balances and facilitate reward redemptions.

Agent

A licensed insurance professional registered on the Platform to refer clients and access educational tools.

KYC/AML

Know Your Customer / Anti-Money Laundering, regulatory verification processes to confirm identity and prevent financial crime.