1. Introduction
Wera (“Wera,” “we,” “us,” or “our”) operates a digital platform that connects households with verified home care professionals, including nannies, housekeepers, cooks, mama fua, gardeners, and babysitters. We take the privacy of every person who uses our platform seriously. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over it.
This Policy is issued in compliance with the Kenya Data Protection Act, 2019 (the “DPA”) and applies to all users of our website, mobile applications, and related services (collectively, the “Platform”).
2. Who We Are
Wera is the trading name of the entity operating this Platform, with its principal place of business in Nairobi, Kenya. For the purposes of the DPA, Wera is the Data Controller of the personal information you provide to us.
You can reach our Data Protection Officer at privacy@wera.co.ke.
3. Information We Collect
The information we collect depends on whether you are using the Platform as a household (employer) or as a home care professional (worker).
3.1 Information from Households
- Identity data: full name, profile photo.
- Contact data: phone number, email address, residential or service address.
- Household details: type and frequency of service required, household composition where you choose to share it.
- Payment data: M-PESA mobile number and transaction confirmations. We do not store M-PESA PINs.
- Booking and review history on the Platform.
- Communications you send to us or to workers through the Platform.
3.2 Information from Home Care Professionals
- Identity data: full name, date of birth, gender, National ID number, passport photo.
- Contact data: phone number, email, physical address, next of kin contact.
- Verification data: copy of National ID, biometric and demographic data submitted to IPRS for validation, police clearance certificate, references from previous employers.
- Work history, skills, languages, and salary expectations.
- Payment data: M-PESA mobile number for receiving placement-related compensation.
- Reviews submitted by households you have worked with.
3.3 Information Collected Automatically
- Device and connection data: IP address, device type, operating system, browser type.
- Usage data: pages viewed, features used, session timestamps, referring URLs.
- Approximate location derived from IP address.
4. How We Use Your Information
- To create and manage your account.
- To verify the identity and background of home care professionals.
- To match households with suitable verified workers.
- To facilitate bookings, trials, replacements, and placements.
- To process placement fees through M-PESA and issue receipts.
- To send service-related notifications, including verification status, booking updates, expiry reminders, and trial outcomes.
- To respond to support requests and resolve disputes.
- To improve the Platform, detect abuse, and prevent fraud.
- To comply with legal obligations and respond to lawful requests from authorities.
5. Legal Basis for Processing
We process personal data on one or more of the following bases under the DPA:
- Consent: for processing your National ID through IPRS and conducting background checks.
- Contract: to deliver the Platform services you have signed up for.
- Legal obligation: to meet tax, anti-money-laundering, and other statutory requirements.
- Legitimate interest: to detect fraud, secure the Platform, and improve our services, provided your rights do not override these interests.
6. Verification & Background Checks
Home care professionals consent in writing to a four-step verification process before being listed on the Platform. This includes validation of National ID details through Kenya's Integrated Population Registration System (IPRS), a criminal records check, reference calls to previous employers, and an in-home trial period once placed.
Households who book a worker are shown a transparent record of the checks completed and the date each check was last refreshed. We do not share raw documents (such as the National ID image) with households unless legally required to do so.
8. Third-Party Service Providers
We engage carefully selected processors to operate the Platform:
- Government registries: IPRS, for ID validation.
- Background-check providers: licensed agencies handling criminal records searches and reference calls.
- Payment processors: Safaricom (M-PESA Daraja) for receiving and disbursing funds.
- Communications: SMS and email delivery providers for transactional notifications.
- Cloud hosting: infrastructure providers used to store and process data.
- Analytics: aggregated usage analytics, configured to minimise personal data exposure.
Each processor is bound by a data processing agreement requiring them to handle your data only on our instructions and in line with the DPA.
9. Data Retention
We keep personal information for as long as your account is active and for a reasonable period afterwards to comply with legal obligations and resolve disputes. Typical retention periods:
- Account and verification records: for the life of the account plus 7 years after closure, to support disputes and regulatory enquiries.
- Payment records: 7 years, as required by Kenyan tax law.
- Booking and review records: for the life of the account, anonymised after closure.
- Marketing preferences: until you withdraw consent.
10. Security
We use encryption in transit, role-based access controls, and audit logging to protect your data. Sensitive documents are stored in restricted-access systems and accessed only by trained verification staff. No system can be guaranteed completely secure; if a data breach affects your personal information, we will notify you and the Office of the Data Protection Commissioner as required by law.
11. Your Rights
Subject to the DPA, you have the right to:
- Be informed about how your personal data is used.
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request deletion of your data, subject to our legal obligation to retain certain records.
- Object to or restrict certain processing.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with the Office of the Data Protection Commissioner of Kenya.
To exercise these rights, email privacy@wera.co.ke. We will respond within 30 days.
12. Children's Data
The Platform is not directed to anyone under 18. Workers offering childcare are made aware of and required to comply with Kenyan child protection laws. Households may share information about children in their household for the limited purpose of arranging childcare; we treat this data with heightened care and limit access to staff who need it to support the booking.
13. Cross-Border Transfers
Some of our processors operate or store data outside Kenya. Where this occurs, we ensure transfers comply with the DPA, including by using contractual safeguards and verifying that the destination jurisdiction provides adequate protection.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the Platform at least 14 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.
16. Contact Us
For any questions about this Privacy Policy or how we handle your personal information:
You may also lodge a complaint with the Office of the Data Protection Commissioner of Kenya via www.odpc.go.ke.