Privacy Notice

Last updated: 23 June 2026

PichaPap turns a selfie into a compliant passport, ID or visa photo over WhatsApp. This notice explains what personal data we handle, why, how long we keep it, and your rights under Kenya's Data Protection Act, 2019.

The short version: We use your selfie only to make your photo, and we delete the selfie you send us once your finished photo is delivered. We never sell your data, and we never see or store your M-Pesa PIN.

1. Who we are

PichaPap is a service operated by Vutia Enterprises (“we”, “us”), based in Nairobi, Kenya. We are the data controller for the information described here.

Contact: WhatsApp +254 747 444407 · email privacy@ve.ke.

2. What we collect

Data	Why we need it
The photo (selfie) you send	To crop, format and produce your passport/ID/visa photo.
Your WhatsApp phone number	To deliver the finished photo and provide support, in the same chat.
M-Pesa payment confirmation (amount, transaction/receipt reference, payer number)	To confirm your KES 50 payment and for accounting. We receive this from Safaricom after you approve the prompt — we never see your M-Pesa PIN.
Basic message details (the request, timestamps)	To run the conversation and resolve issues.

We do not collect your ID number, biometrics beyond the photo itself, location, or contacts.

3. Why we use it (lawful basis)

To perform the service you asked for — making and delivering your photo, and taking payment (performance of a contract).
Legitimate business interests — fraud prevention, support, and keeping basic transaction records.
Legal obligation — retaining payment records as required by Kenyan tax/accounting law.

4. How long we keep it

Your uploaded selfie: deleted automatically after your finished photo is delivered (and in any case within a short period). We do not build a library of your face.
Your finished photo: kept briefly so you can re-download it, then removed.
Payment & order records (phone number, amount, M-Pesa reference): kept only as long as needed for accounting and legal requirements.

5. Who we share it with

We never sell your personal data. We share the minimum necessary with service providers who help us run PichaPap:

Meta Platforms (WhatsApp Business Platform) — to receive your message and deliver your photo.
Safaricom (M-Pesa / Daraja) — to process your payment.
Our image-processing provider — to remove the background and format the photo.

These providers act on our instructions. Some may process data outside Kenya; where they do, we rely on the protections each provides.

6. Your rights

Under the Data Protection Act, 2019 you have the right to:

be informed about how your data is used;
access the personal data we hold about you;
ask us to correct it if it is wrong;
ask us to delete it (“right to erasure”);
object to or restrict certain processing.

To exercise any of these, message us on WhatsApp +254 747 444407 or email privacy@ve.ke. We will respond within the timeframes set by law.

7. Security

We use encrypted connections (HTTPS) and limit access to your data. No system is perfectly secure, but we keep what we hold to a minimum and delete source photos promptly to reduce risk.

8. Children

If a photo is for a child (e.g. a passport photo), it should be submitted by a parent or guardian, who is responsible for providing consent.

9. Changes to this notice

We may update this notice as the service evolves. The “last updated” date above shows the latest version.

10. Complaints

If you are unhappy with how we handle your data, you may contact us first, and you also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya — www.odpc.go.ke.