Data Rights, Retention and Account Deletion Policy

This page tells you how to access, correct, export or delete data; object to eligible uses; withdraw consent; close an account; and understand records we may lawfully retain. It implements relevant rights under Malawi's Data Protection Act, 2024 and applies alongside our Privacy Policy. RYDZ cannot avoid these rights by merely terminating an account or calling a record anonymous.

Send an email to support@rydzmw.com with subject Privacy / Account Deletion Request, or, for deleting a rider account, use the in-app route described in section 5. State whether you seek access, correction, portability, withdrawal of consent, erasure, restriction, objection, account closure or an explanation. Include only information needed to locate your account and verify identity. Do not email your password, PIN or OTP. We may ask for proportionate proof when the request exposes personal information or relates to money, but we will not demand unnecessary identity scans. The apps do not currently offer a self-service data export; copies of your data are provided on request.

Eligible requests to access data and obtain a copy will be handled within legally required periods, including the Act's general 30-day access provisions. The Act also contains 30-day portability and 14-day correction provisions where their conditions apply. We will describe the categories and purposes of data, appropriate recipients and other transparency information. A person requesting information about another passenger or driver must demonstrate valid legal authority; a ticket purchaser does not automatically gain access to all a fellow passenger's personal information. Many profile details can also be corrected directly in the app.

You may request restriction or object where permitted by law, including to qualifying direct marketing. Consent for optional promotional messages or other consent-based processing may be withdrawn prospectively, for example by switching off "Offers and promotions" in the app's notification settings; necessary service messages and records required for a lawful booking may continue on their independent legal basis. Location permission can be changed in device settings, which may prevent live tracking/dispatch. We will explain any legally valid reason a request cannot be fully met.

Riders can delete their account in the RYDZ app: open Settings and choose Delete account, then confirm. The account is deactivated and you are signed out straight away, and your in-app notifications are deleted. For 30 days you can change your mind: sign back in and choose to recover the account. After the 30 days, RYDZ permanently deletes the account; this is carried out by RYDZ staff, so it can happen some time after the 30-day period ends rather than at the exact moment it ends. Before deleting an account, use or ask about any remaining RYDZ Wallet balance and any unused tickets by contacting support@rydzmw.com.

Captains cannot yet delete their account in the RYDZ Captain app. To close a Captain account, email support@rydzmw.com with the subject Account deletion request from the email address or phone number registered on the account.

RYDZ authenticates the request, checks pending journeys, unredeemed tickets, disputes, refunds, wallet balance and legal holds, and explains any practical action needed before closure. We disable access after processing the request, remove data lacking an ongoing legal basis and instruct relevant processors to erase covered records where required. Closure does not extinguish valid tickets, lawful payment claims or accrued Captain/Operator earnings. Our legal obligations may require retention of transaction, tax, fraud or safety records for a justified period. When a rider account is permanently deleted:

A Captain's account may include licensing, payout and incident information that needs a different retention period from ordinary passenger profile data. An Operator may be subject to obligations involving passenger manifests, tax and reconciled ticket reports. We will distinguish personal data of staff from business records and use minimization or de-identification when continuing retention is no longer necessary.

RYDZ has not adopted fixed retention periods in years for most categories. The table below describes how each category is kept today; we do not invent obligations or claim a schedule that is not applied.

An erasure request may be partially restricted by legal obligations, active legitimate disputes, statutory retention or other specific exemptions. We will explain the reason, extent and review route where lawful. Backup copies may expire through controlled rotations; active systems stop using data due for deletion. Shared passenger data may also be independently held by a carrier with a lawful retention duty; we will explain the separate Operator contact when relevant and assist appropriately.

We will acknowledge requests, provide decisions within statutory deadlines and identify how to contest a refusal. Where necessary, a data subject may complain to the Data Protection Authority, https://www.dpa.mw (opens in a new tab), without losing access to competent courts. Contact: support@rydzmw.com, +265 222 247 247.