This policy explains how Tracemark, operated by Vespera Digital, handles personal data in connection with the Tracemark platform. It covers the people who use Tracemark on behalf of a customer organisation, and the people who contact us about it.
Two roles
Tracemark holds two kinds of information. The first is the data a customer puts into the platform: activity records, evidence documents, approvals and the names of the people who prepared and reviewed them. For that data the customer decides what is collected and why, and we process it on the customer’s behalf and on its instructions, under its agreement with us.
The second is the information we need to run the service and the commercial relationship: account details for each user, sign in and security records, billing contacts and correspondence. For that information Vespera Digital is responsible.
What we collect
- For each user: name, work email address, organisation, role and the entities and sites the user is permitted to see.
- Security records: sign in times, the actions each user takes and the network address and device information needed to protect accounts.
- Everything a user records in the platform, including submissions, comments, approvals and uploaded evidence documents.
- For billing and contracts: the names, email addresses and roles of the people we deal with.
- Anything you send us when you book a walkthrough or ask for support.
How we use it
To provide the platform and its controls, to keep accounts and data secure, to record the audit trail that the product exists to provide, to support customers, to invoice and to meet legal obligations. We do not sell personal data, we do not use it for advertising, and we do not use customer data to train artificial intelligence models.
The audit trail
Tracemark records who submitted, reviewed and approved each figure, and that record cannot be altered. This is the purpose of the product: an auditor must be able to see who approved a reported number. When a user leaves a customer organisation, the account is deactivated, but the user’s name remains attached to the actions already taken, for as long as the customer’s data is held.
Who else processes data
We use infrastructure, storage and email providers to run the platform, under contracts that require them to protect the data and use it only to provide their service to us. The hosting region for a customer’s data is stated in its order. Where data is processed outside the country in which it was collected, we rely on contractual safeguards and the protections the law requires.
How long we keep it
Customer data is kept for as long as the customer’s subscription is active. When a subscription ends, the customer has 30 days to export its data, after which we delete it from the active service. Backups are cleared within a further 30 days. Billing records are kept for as long as tax and accounting law requires.
Your rights
You can ask for access to the personal data we hold about you, ask us to correct it, object to its use or ask us to delete it, subject to the limits the law allows. Where a request concerns data a customer controls, such as the records in its own platform, we pass it to that customer and help it respond. You may complain to the Office of the Data Protection Commissioner in Kenya, or to the data protection authority in your own country.
Security
Data is encrypted in transit and at rest. Each customer’s data is separated from every other customer’s at the database level, evidence documents are private, and access is granted by role and by scope.
Contact
Privacy questions and requests reach us at support@vespera-org.com.