Privacy Policy

TaxiTao ("TaxiTao," "we," "us," or "our") is a technology platform that connects customers with independent drivers for transportation services. We are committed to protecting your privacy and handling your personal data responsibly and transparently.

This Privacy Policy is governed by the Kenya Data Protection Act, 2019 (DPA 2019), the Kenya Information and Communications Act, 1998 (KICA), and the Consumer Protection Act, 2012 (CPA). Where applicable, we also comply with the General Data Protection Regulation (GDPR) for users in the European Union.

By accessing or using the TaxiTao platform (web or mobile), you agree to this Privacy Policy. If you do not agree, you must stop using our services.

We collect the following categories of data:

• Account Information: Name, email, phone number, password (hashed), role (customer, driver, admin).
• Driver Profile Data: Vehicle details, plate number, subscription status, business location, profile photo, rating and review statistics.
• Ride and Booking Data: Pickup and drop-off locations, dates, times, fare estimates, completed trip details, and communication logs relevant to the booking.
• Payment and Subscription Data: Payment confirmations, subscription periods, amounts paid, and basic M-Pesa transaction references (where provided by you).
• Device and Usage Data: IP address, device type, browser, app version, and basic analytics on how you use the platform.
• Location Data: Approximate or precise location for drivers (to show availability) and for customers (to set accurate pickup points), when permission is granted.

We use your data to:

• Provide and operate the TaxiTao booking platform.
• Match customers with available drivers and manage ride requests.
• Communicate with you about bookings, account activity, and service updates.
• Verify driver subscriptions and manage access to ride details.
• Improve our services, security, and fraud prevention.
• Comply with legal obligations and respond to lawful requests from Kenyan authorities.
• Generate aggregate, anonymised analytics to understand platform usage and improve our services.

We process your data in accordance with the Kenya Data Protection Act, 2019 and other applicable laws. Our legal bases include:

• Performance of a contract (providing rides and services you request) — Section 30(c) of the DPA 2019.
• Legitimate interest (improving safety, fraud prevention, and service quality) — Section 30(d) of the DPA 2019.
• Compliance with legal obligations under Kenyan law, including tax regulations, transportation safety requirements (NTSA), and anti-money laundering provisions.
• Your consent (for optional features like marketing communications or GPS tracking) — Section 32 of the DPA 2019. You may withdraw consent at any time.

For users in the European Union, processing is also governed by Articles 6 and 7 of the GDPR.

We do not sell your personal data. We share data only when necessary to provide the service and in accordance with the DPA 2019:

• With drivers:Customers' pickup/drop-off points, name, and contact phone for booked or active trips.
• With customers:Driver's name, rating, vehicle details, and contact phone for accepted trips.
• Payment processors: M-Pesa and related payment service providers for fare collection, subscription billing, and refund processing.
• Cloud hosting providers: Infrastructure providers that store and process data on our behalf, subject to strict data protection agreements.
• Communication services: Providers that facilitate SMS, email, and in-app notifications for booking updates and account alerts.
• Analytics providers: Aggregate, anonymised data processors that help us understand platform usage.
• Government and regulatory authorities: When required by law, court order, NTSA regulations, KRA tax obligations, or to protect safety and prevent fraud.

All third-party processors are bound by data processing agreements that require them to protect your data to the standards required by the DPA 2019.

We keep your data only for as long as necessary to fulfill the purposes described in this policy, in compliance with the DPA 2019 and other applicable regulations:

• Trip and booking records: Retained for 7 years from the date of the trip for regulatory compliance, tax reporting, dispute resolution, and safety investigations.
• Payment and subscription records: Retained for 7 years for accounting, tax (KRA), and audit purposes.
• Driver verification documents:Retained for the duration of the driver's partnership and 7 years thereafter for regulatory compliance.
• Account data: Retained while your account is active. You may request deletion, subject to legal retention requirements.
• Driver ratings and performance data: Retained indefinitely to maintain service quality standards.
• Marketing consent records: Retained for 3 years after consent is withdrawn, as evidence of compliance.

When data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.

Under the Kenya Data Protection Act, 2019 (Section 26) and, where applicable, the GDPR, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure — Request deletion of your account and certain data, subject to legal retention requirements.
• Right to object — Object to certain types of processing, including direct marketing.
• Right to data portability — Request your data in a structured, commonly used, machine-readable format (e.g., CSV or JSON).
• Right to withdraw consent — Withdraw consent at any time where processing is based on consent (e.g., marketing, GPS tracking).
• Right to lodge a complaint — File a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya if you believe your data protection rights have been infringed.

To exercise any of these rights, contact us using the details in the Contact section below. We will respond to your request within 30 days as required by the DPA 2019.

Our security measures include encryption of data in transit and at rest, secure authentication, role-based access controls, regular security assessments, and automated threat monitoring.

TaxiTao is not intended for children under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

Your personal data is primarily stored and processed within Kenya. However, some of our service providers may process data in countries outside Kenya. When we transfer data internationally, we ensure appropriate safeguards are in place as required by the DPA 2019 (Section 48), including:

• Ensuring the receiving country has adequate data protection laws, or
• Entering into standard contractual clauses with the receiving party that require them to protect your data to the standards required by Kenyan law, or
• Obtaining your explicit consent before the transfer.

For users in the European Union, international transfers also comply with GDPR Chapter V requirements, including adequacy decisions and Standard Contractual Clauses (SCCs).

Our web platform uses cookies and similar tracking technologies to operate effectively and improve your experience. Cookies are small text files stored on your device.

Types of cookies we use:

• Strictly necessary cookies: Required for the platform to function, including session management, authentication, and security. These cannot be disabled.
• Functional cookies: Remember your preferences (e.g., language, location settings) to provide a personalised experience.
• Analytics cookies: Help us understand how visitors use our platform so we can improve performance and usability. These collect aggregate, anonymised data.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair platform functionality.

We do not use advertising or third-party tracking cookies.

In the event of a personal data breach, we will respond in accordance with the DPA 2019 (Section 43):

• We will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware of a breach that is likely to result in a risk to your rights and freedoms.
• Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay.
• We will maintain a record of all data breaches, including the facts relating to the breach, its effects, and the remedial action taken.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we do, we will update the "Last Updated" date at the top of this page.

Significant changes may be communicated via email or in-app notifications. Your continued use of the platform after changes are posted constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us: