Privacy policy

Last updated: 1 Nov 2026

1. Who Is Responsible for Your Personal Data?

VibePass is operated by SOPAGO KENYA Limited (“VibePass”, “we”, “us” or “our”), which is responsible for determining how and why personal data is processed in connection with our website and services.

Website: vibepass.life
Privacy contact: info@vibepass.life

This Privacy Policy explains how we collect, use, share and retain personal data when you browse our website, purchase or receive a voucher, redeem an experience, contact us or interact with our business.

We process personal data in accordance with Kenya’s Data Protection Act, 2019, its applicable regulations and any other data protection laws that apply to our activities.

2. Personal Data We Collect

Depending on how you interact with VibePass, we collect the following categories of personal data:

Identity and contact information

  • Your name, email address and telephone number.

  • Billing address and other information required to process your order.

  • Business contact details when you enquire about corporate gifting or a partnership.

Order and voucher information

  • Experiences purchased, order numbers, voucher identifiers and voucher recipient details.

  • Voucher issue dates, expiry dates and redemption status.

  • Information relating to exchanges, booking assistance and customer service requests.

Gift recipient information

  • The recipient’s name and contact details supplied by the purchaser.

  • Gift messages or other personalisation submitted with an order.

Payment and transaction information

  • Payment method, payment status, transaction references and information needed to reconcile payments or resolve payment issues.

  • Payment information processed by the payment provider used at checkout.

Communications and preferences

  • Messages you send us and information supplied when requesting assistance.

  • Newsletter subscriptions, marketing preferences and consent records.

Website and device information

  • Information such as your IP address, browser type, device information and interactions with our website, collected through website logs, cookies or similar technologies, depending on the tools enabled and your choices.

Please do not send passwords, payment PINs, one-time verification codes or full card details to customer service.

3. How We Collect Personal Data

We collect personal data:

  • Directly from you, when you place an order, complete a form, subscribe to updates or contact us.

  • From a purchaser, when someone buys a voucher for you or provides your details as a gift recipient.

  • From venues and service providers, where needed to confirm payment, assist with a booking, verify redemption or resolve a problem.

  • Automatically through our website, using logs, cookies and similar technologies as described in this policy.

If you provide another person’s details, please ensure that you have a lawful basis to share them, provide only the information needed and make this policy available to that person. Where consent is required, obtain it before sharing their information.

We will provide any additional notice required when personal data is received from someone other than the individual concerned.

4. Why We Use Personal Data and Our Legal Bases

We use personal data only where we have an applicable lawful basis.


Purpose

Legal basis

Process purchases, administer orders and issue vouchers

Performance of a contract with you or steps requested before entering into a contract

Deliver and administer a gift voucher for someone who is not the purchaser

Our legitimate interests in fulfilling the purchaser’s gift order, subject to the recipient’s rights, or consent where required

Verify vouchers, record redemption and coordinate with venues

Performance of a contract where the individual is a party; otherwise an applicable lawful basis for recipient administration

Respond to enquiries and resolve order or experience issues

Performance of a contract, steps requested before entering into a contract, or legitimate interests in providing customer assistance, depending on the enquiry

Maintain accounting records and respond to lawful regulatory requests

Compliance with legal obligations

Protect our website, investigate misuse and prevent fraud

Legitimate interests in protecting customers, partners and our business, subject to individuals’ rights

Send newsletters and promotional communications

Consent

Use optional analytics or advertising technologies that require consent

Consent

Where we rely on legitimate interests, we consider whether the processing is necessary and whether your rights and interests override those interests.

Providing information required to fulfil an order is necessary for us to supply the relevant service. If you do not provide it, we may be unable to complete your purchase or assist with your request. Optional marketing consent is not a condition of purchase.

5. Gift Purchases and Recipient Privacy

When you purchase a voucher for another person, we use the recipient information you provide to deliver and administer the gift, support its use and handle related enquiries.

Receiving a gift does not automatically subscribe the recipient to marketing communications.

Gift messages should not contain health information, identification documents or other sensitive personal information.

6. Who We Share Personal Data With

Where necessary for the purposes described in this policy, we share relevant personal data with:

  • Hotels and experience venues, to verify vouchers, arrange or support bookings, provide the purchased experience and resolve related issues.

  • Shopify, which provides our online storefront and commerce infrastructure.

  • Payment providers, to process transactions, confirm payment and handle payment-related enquiries.

  • Bird, which supports customer information management and email communications.

  • Other technology providers, where used for hosting, voucher administration, security and customer support.

  • Professional advisers and public authorities, where necessary for legal, accounting, regulatory or dispute-resolution purposes.

We limit disclosures to information relevant to the purpose of sharing.

Venues and payment providers may also process information as independent data controllers for their own responsibilities. Their privacy notices explain those activities.

7. International Data Transfers

Some technology providers may store or access personal data outside Kenya.

Where personal data is transferred internationally, the transfer must have a lawful basis under applicable data protection law. Depending on the circumstances, this may require appropriate safeguards, a recognised adequacy decision, an applicable necessity condition or valid consent.

You may contact us to request information about the destinations and safeguards relevant to your personal data.

8. Cookies and Similar Technologies

Our website uses cookies and similar technologies to support functions such as navigation, shopping cart operation, checkout and security.

Optional technologies may also be used for analytics or advertising, depending on the tools enabled on our website. Where consent is required, these technologies must not operate before the relevant consent is obtained.

You can manage your choices through Cookie Settings, where available, and through your browser settings. Blocking certain cookies may affect website functionality.

9. Marketing Communications

Where you subscribe or otherwise provide the required consent, we use your contact details to send VibePass news, offers and experience updates.

You can withdraw your consent at any time by using the unsubscribe option in a marketing message.

Withdrawing marketing consent does not affect the lawfulness of earlier processing. It also does not prevent necessary service messages about an existing order, voucher or enquiry.

10. How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including relevant legal, accounting and dispute-resolution requirements.

The criteria we use include:

  • Whether an order, voucher or customer service request remains active.

  • Whether records are needed to investigate a complaint, payment issue or legal claim.

  • Applicable statutory recordkeeping periods.

  • Whether you have withdrawn consent to processing that depends on consent.

We may retain a limited record of a marketing opt-out to ensure that your preferences continue to be respected.

When retention is no longer justified, personal data should be securely deleted or anonymised.

11. Keeping Personal Data Secure

We are responsible for applying appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

No website, storage system or method of transmission can be guaranteed completely secure. Please protect your voucher links and account credentials, where applicable, and contact us promptly if you suspect unauthorised use.

Where a personal data breach requires notification under applicable law, we will notify the relevant authority and affected individuals as required.

12. Your Data Protection Rights

Subject to applicable legal conditions and exceptions, you may have the right to:

  • Be informed about how your personal data is used.

  • Access your personal data.

  • Correct inaccurate or incomplete information.

  • Request erasure of personal data.

  • Object to processing, including direct marketing.

  • Request restriction of processing.

  • Request portability of personal data.

  • Withdraw consent where processing relies on consent.

  • Exercise rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

To make a request, contact info@vibepass.life and describe the right you wish to exercise.

We may request proportionate information to verify your identity or authority to act for someone else. We will respond within the time limits required by applicable law. If we cannot fulfil a request, we will explain the reason and any available complaint options.

13. Questions and Complaints

If you have a question or concern about your personal data, contact:

SOPAGO KENYA Limited
Email: info@vibepass.life
Address: Delta Corner Annex, Ring Rd Westlands Ln, Nairobi

You also have the right to lodge a complaint with Kenya’s Office of the Data Protection Commissioner (ODPC). You do not need to complete our internal complaint process before exercising that right.

Where another country’s data protection laws apply, you may also have rights to complain to the relevant supervisory authority.

14. Changes to This Privacy Policy

We may update this policy to reflect changes in our services, data handling practices or legal requirements. The “Last updated” date identifies the latest version.

Where required, we will provide additional notice of material changes or obtain fresh consent before introducing processing that requires it.

Reading this policy or using our website does not, by itself, constitute consent to optional marketing, tracking or other processing that requires consent.