1. Introduction
Personal data means information that identifies you (or can reasonably identify you) — for example your name, phone number, email, ID document, booking history, or device identifiers.
By creating an account, verifying as an organizer, or completing a booking, you acknowledge that we will process personal data as described here. Where Act 843 requires consent for a specific use (such as optional marketing), we will ask for it separately.
2. Who controls your data
VaybeEx decides why and how personal data is processed on the Platform (the data controller for Platform operations). Day-to-day privacy questions go to support@vaybeex.com.
Licensed payment companies and SMS providers process some payment and messaging data under their own systems when you pay or receive alerts. Trip organizers receive limited traveler details to run a booked trip; for that delivery purpose they handle that data as described in Section 14.
3. What we collect
We only collect what we need for the Platform. Categories include:
Identity & contact
- full name, email, phone number, city or region;
- profile photo and public bio or brand name (especially organizers);
- for organizer verification: national ID or similar documents and verification outcome.
Transaction & trip records
- trips viewed or wishlisted, bookings, seat counts, payment status, cancellation and refund records;
- payment metadata (amount, currency, method type such as MoMo or card, provider references) — not full card PAN/CVV on our servers when a licensed processor handles the card;
- payout or withdrawal details needed to send organizer funds.
Communications & support
- messages sent through the Platform and content of support emails;
- records that an SMS or email notice was sent (and related delivery logs from providers).
Device & usage
- IP address, browser or device type, approximate network location, pages visited, and error logs;
- cookies or similar tech for sessions and security (Section 11).
4. Where data comes from
- You — forms, uploads, bookings, messages, and settings;
- Your device — automatic technical data when you use the site or app;
- Payment & messaging partners — confirmation that a payment or SMS succeeded or failed;
- Organizers or travelers — limited details the other party needs for a shared booking (for example traveler name on a roster).
5. Why we use it
We use personal data to:
- register and authenticate accounts;
- operate listings, bookings, escrow-style fund holding, refunds, and organizer withdrawals;
- verify organizers and reduce fraud or abuse;
- send transactional notices (confirmations, reminders, payment updates) by email or SMS;
- send marketing only if you opt in (or where law otherwise allows) — you can stop marketing anytime;
- answer support requests and improve Platform reliability;
- meet legal duties and protect the Platform, users, and the public.
We do not use your data to make automated decisions that produce legal effects about you without human involvement, other than routine fraud or security filters.
6. Legal bases (Act 843)
Under the Data Protection Act, 2012 (Act 843), processing must be for a lawful purpose. We rely on:
- Consent — optional marketing; certain sensitive verification uploads where consent is the right ground;
- Contract — data needed to create your account, complete a booking, or pay out an organizer;
- Legal obligation — tax, accounting, law-enforcement, or regulatory requirements;
- Legitimate interest — Platform security, fraud prevention, and service improvement, balanced against your rights.
We aim to keep data adequate, relevant, not excessive, and as accurate as practicable for those purposes.
8. How long we keep it
We keep data only as long as needed for the purposes above, then delete or anonymise it unless a longer period is required by law.
- Account profile — while the account is open, then a short wind-down period for disputes or reactivation;
- Bookings & payments — for refunds, chargebacks, accounting, and statutory records;
- ID documents — while verification is relevant to organizer status, then securely removed or reduced to a verification flag where possible;
- Support logs — while useful to resolve issues, then archived or deleted.
9. How we protect it
We use access controls, encryption in transit where supported, staff need-to-know limits, and vendor checks appropriate to the sensitivity of the data (especially ID documents and payment metadata).
No online system is perfectly secure. If a breach creates a significant risk to you, we will take steps consistent with Act 843 and notify you and/or the Data Protection Commission when required.
10. Your rights
Under Act 843 (and subject to legal exceptions), you may ask to:
- access personal data we hold about you;
- correct data that is wrong or incomplete;
- withdraw consent where processing is based on consent (this does not undo earlier lawful processing);
- request deletion when data is no longer needed or processing is unlawful — unless we must keep it for law or ongoing disputes;
- object to certain processing, including marketing;
- complain to the Data Protection Commission (Section 16).
Email support@vaybeex.com with your request. We may verify your identity first and will respond within a reasonable time.
12. Children
Accounts are for people 18+. We do not knowingly collect children's data for registration. If a minor joins a trip, an adult should supply any needed details as set out in the Terms.
If you think we hold a child's data in error, contact support@vaybeex.com and we will delete it where appropriate.
13. Transfers outside Ghana
Some vendors (hosting, email, analytics) may process data outside Ghana. When that happens, we take reasonable steps — including contracts where appropriate — so the data still receives protection consistent with Act 843.
14. When organizers see your data
After you book, the organizer typically receives your name, contact details, and booking specifics needed to run the trip. They must:
- use that data only for the trip and related support;
- keep it secure and not sell or spam it;
- follow Act 843 and stop using it when the trip purpose ends (subject to any legal retention).
Misuse can lead to account suspension. Independent misuse outside our control is the organizer's responsibility; report concerns to support@vaybeex.com.
15. Changes to this Policy
We may update this Policy. The “Last updated” date will change when we do. Material changes may be notified on the Platform, by email, or SMS. Where Act 843 requires new consent for a new use, we will ask for it.
16. Contact & complaints
Privacy requests: support@vaybeex.com
If we cannot resolve your concern, you may complain to Ghana's Data Protection Commission, the supervisor under Act 843.
Booking rules and user duties: Terms & Conditions.