Data Protection at VEPSuite

A shared approach to protecting information

Data protection works best when the service provider and customer organisation understand their responsibilities. VEPSuite applies administrative, technical, and organisational safeguards designed to protect information. Your organisation remains responsible for deciding what information it enters, who can access it, and how its users handle it.

Access and account control

VEPSuite supports role-based access so organisations can give users permissions suited to their work. Administrators should assign access according to role, review it when responsibilities change, remove accounts that are no longer needed, and protect sign-in details.

• Use individual accounts rather than shared credentials.
• Grant only the access needed for each person’s duties.
• Review administrator and sensitive workflow permissions regularly.
• Report suspected account compromise or unexpected access promptly.

Hosting, data location, and safeguards

Hosting arrangements and data location depend on the deployment agreed with your organisation. Before onboarding, confirm the applicable hosting region, service providers, backup arrangements, and any relevant contractual safeguards with the VEPSuite team.

Technical controls can vary by deployment and configuration. VEPSuite can provide current information about the safeguards and hosting arrangements relevant to a proposed or active service. No online service can promise that risk is eliminated entirely.

Using information in VEPSuite

Organisations should enter only information needed for their business workflows and ensure they have the authority to do so. Do not place passwords, payment card details, or unrelated sensitive personal information in support requests or public channels.

Retention, export, and deletion

Retention, export, and deletion of workspace information are handled according to the organisation’s service agreement and applicable configuration. Workspace administrators should identify the appropriate internal contact for access, correction, export, or deletion requests.

Malawi regulatory context

Organisations handling personal data in Malawi should assess their responsibilities under the Data Protection Act, 2024, and applicable regulations. Requirements depend on an organisation’s role and processing activities; seek qualified guidance for compliance decisions.

Official sources: Data Protection Act, 2024 and Malawi Data Protection Authority.

If you have a security or privacy concern

Contact the VEPSuite team at info@vepsuite.com with your organisation name, a way to reach you, and a brief description of the concern. Do not include passwords or unnecessary personal or confidential records. We will direct your request to the appropriate team.