Driver Privacy Policy

The Swyft Driver app is operated by Taleel Holdings LTD ("Swyft", "we", "us"), the data controller for your personal data. As required by the Data Protection Act, 2019, we are registered as a data controller with the Office of the Data Protection Commissioner (ODPC). You can reach our data protection contact at support@swyft.africa.

We collect the data needed to verify you, connect you with jobs, pay you, and keep the platform safe. We collect it directly from you, except where you ask us to obtain it from a verification partner or public record.

• Identity & KYC — your name, date of birth, national ID, passport-style photo, driving licence, and any NTSA/PSV credentials required for the service you provide.
• Contact & account info — phone number, email address, and your sign-in credentials.
• Vehicle & document data — vehicle type, registration/number plate, logbook, insurance details, and photos of your vehicle and documents.
• Location — your precise location, collected continuously while you are online and available for jobs, including while the app runs in the background. This is used to match you with nearby jobs, calculate fares, and give the customer live tracking during a move.
• Financial & payout info — your M-Pesa payout number, earnings, commission, and a record of each transaction. We do not store full payment card details.
• Job & performance data — jobs offered, accepted, completed, and cancelled, distances and times, and the ratings and reviews customers leave for you.
• App, device & diagnostics — device type, operating system, app version, a device identifier, push tokens, and crash logs used to keep the app stable and prevent fraud.

Some of the data we collect to verify you — such as your national ID and identity documents — is treated as sensitive personal data under the Data Protection Act, 2019. We process it only where you have consented and where it is necessary to verify your identity and eligibility, to meet our legal and regulatory obligations, and to establish, exercise, or defend a legal claim. We apply additional safeguards to this data, including restricted access and encryption of identity documents.

Under section 30 of the Data Protection Act, 2019, we rely on the following lawful bases when processing your data:

• Performance of a contract — to operate your driver account, match you with jobs, and process your payouts under our Driver Partner Agreement.
• Your consent — for background location collection, processing of your KYC documents, and any optional or marketing communications.
• Legal obligation — to keep KYC, transaction, and tax records required by Kenyan law.
• Legitimate interests — to keep the platform safe, prevent fraud, resolve disputes, and enforce our agreements.

The Swyft Driver app collects your location in the background, even when the app is not open, but only while you are online and available to receive jobs. We use it to:

• Match you with the closest available jobs;
• Estimate fares and arrival times;
• Share your live location with the customer during an active job;
• Support safety, dispute resolution, and fraud prevention.

Background location collection stops when you go offline. You can also revoke the location permission in your device settings at any time, but you will not be able to receive jobs while it is off. We do not sell your location data or use it for third-party advertising.

• To verify your identity, documents, and eligibility to drive;
• To match you with jobs and enable live tracking during a move;
• To calculate fares, commission, and process your payouts;
• To operate ratings and maintain safety and quality on the platform;
• To prevent fraud, investigate misuse, and resolve disputes;
• To provide support, keep the app stable, and meet legal obligations.

We share driver data only as needed to run the service:

• With customers — the details needed for a job you accept, such as your name, photo, phone number, vehicle details, and your live location during the active job.
• With service providers — such as payment and payout processors (M-Pesa and partners), mapping providers, identity/KYC verification partners, and cloud and analytics providers, who process data only on our documented instructions and are bound by written contracts to protect it, as required by section 42 of the Data Protection Act, 2019.
• With authorities — where required by law, or to protect the rights, property, and safety of our users, drivers, and the public.

We do not sell your personal data, and we do not share it for third-party advertising.

Some of our service providers may store or process your data on servers located outside Kenya. Where this happens, we transfer your data only in line with sections 48 and 49 of the Data Protection Act, 2019 — that is, where there are appropriate safeguards (such as contractual data-protection terms and a jurisdiction with comparable data protection law), where the transfer is necessary to perform our agreement with you, or where you have consented. Sensitive personal data is transferred outside Kenya only with your consent and confirmed safeguards.

In line with section 39 of the Data Protection Act, 2019, we keep your driver data for as long as your account is active and as needed to provide our services. After your account is closed, we may retain certain records — such as KYC, transaction, and payout data — for the period required by Kenyan tax, financial, and transport law, and to resolve disputes or enforce our agreements. We delete, anonymise, or pseudonymise data that we are no longer required to keep.

We use technical and organisational measures — including encryption of data in transit, access controls, and secure infrastructure — to protect your data, including your identity documents, and we build data protection into our systems by design and by default. No system is completely secure, but we work continuously to safeguard your information.

If a personal data breach occurs that poses a real risk of harm to you, we will notify the Office of the Data Protection Commissioner without undue delay and within 72 hours of becoming aware of it, and we will inform you where required, as set out in section 43 of the Data Protection Act, 2019.

Under the Data Protection Act, 2019, you have the right to:

• Be informed of how your personal data is used;
• Access the personal data we hold about you;
• Request correction of inaccurate, outdated, or misleading data;
• Request deletion or erasure of your account and data;
• Object to, or request that we restrict, certain processing;
• Receive your data in a structured, commonly used, machine-readable format and have it ported to another provider where technically feasible;
• Withdraw consent, including for marketing, at any time.

You can request account closure from within the app or via our account & data deletion request page. Some data must be retained where the law requires it (see Data retention above). To exercise any other right, contact support@swyft.africa. We may need to verify your identity, and we will action verified requests within the timelines set by law.

If you believe we have not handled your personal data lawfully, please contact us first at support@swyft.africa so we can put things right. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) under section 56 of the Data Protection Act, 2019 — via www.odpc.go.ke or info@odpc.go.ke.

We may update this policy from time to time. The latest version will always be available here with an updated date, and material changes will be notified to you in the app.

For privacy questions or data requests, contact our data protection contact at support@swyft.africa.