Privacy Policy

Effective September 2026 · Republic of Kenya · Terms · Privacy

This policy explains what personal data Wasaa collects when you use woza.markets, why we collect it, who we share it with, and the rights you have under Kenyan data protection law.

1. Who we are

Wasaa Markets (“Wasaa”, “we”) runs the prediction market at woza.markets and is the data controller for the personal data described here. We process personal data in line with the Data Protection Act, 2019 and its regulations. You can reach us about privacy at support@wasaa.markets.

2. What we collect

  • Account data: your mobile number, and any username, name or email you add.
  • Identity data: national ID or other documents and details when we need to verify who you are, for example before a withdrawal.
  • Transaction data: deposits, withdrawals, trades, positions, balances and the M-Pesa references and phone numbers attached to them.
  • Safety settings: deposit limits and self-exclusion choices.
  • Technical data: IP address, device and browser type, and logs of requests to our servers, used to keep the service secure and working.
  • Communications: messages you send us and the SMS codes and notices we send you.

3. Why we use it and our lawful basis

  • To provide the service (contract): creating your account, signing you in, running trades, paying out profits and processing M-Pesa payments.
  • To meet legal obligations (legal obligation): age and identity checks, tax deductions and reporting, anti-money-laundering checks, and keeping records the law requires.
  • To keep Wasaa safe and fair (legitimate interests): preventing fraud, multiple accounts, market manipulation and abuse, and securing our systems.
  • To improve the product (legitimate interests): understanding how features are used, in aggregate.
  • Marketing (consent): we only send promotional messages if you have agreed, and you can opt out at any time.

4. Who we share it with

We never sell your personal data. We share it only where needed:

  • payment providers, including Safaricom (M-Pesa), to process deposits and withdrawals;
  • SMS providers, to deliver one-time codes and account notices;
  • hosting and infrastructure providers that run our servers and databases;
  • the Kenya Revenue Authority and other regulators, law-enforcement agencies or courts, where the law requires it;
  • professional advisers such as auditors and lawyers, under a duty of confidentiality.

Your public trading activity (for example trades on a market, or a leaderboard position) may be shown on the site without your phone number.

5. Transfers outside Kenya

Some of our service providers may store or process data outside Kenya. Where that happens we only transfer data as permitted by the Data Protection Act, 2019, with appropriate safeguards for its protection.

6. How long we keep it

We keep account and transaction records for as long as your account is open and afterwards for as long as tax, anti-money-laundering and other laws require. Data we no longer need is deleted or anonymised.

7. Your rights

Under the Data Protection Act, 2019 you have the right to:

  • be informed about how your data is used;
  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have data deleted where we no longer have a lawful reason to keep it;
  • object to processing, including for direct marketing;
  • receive your data in a portable format;
  • withdraw consent where processing is based on consent.

To use these rights, contact support@wasaa.markets from the phone number or email on your account. We may need to confirm your identity first. If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (ODPC).

8. Security

We protect your data with encryption in transit, access controls, one-time codes for sign-in, and a separate PIN for withdrawals. No system is perfectly secure, so please keep your phone and SIM safe and tell us straight away if you think your account has been accessed without your permission.

9. Cookies and local storage

The site stores a small amount of data in your browser to keep you signed in and remember preferences such as theme and layout. It may also cache pages and files so the site loads faster and still opens on a weak connection. You can clear this data in your browser settings at any time, which will sign you out.

10. Children

Wasaa is for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has opened an account, contact us and we will close it.

11. Changes to this policy

We may update this policy as the service or the law changes. The effective date above shows when it last changed, and we will let you know in the app about material changes. See also our Terms of Service.