Privacy Policy

RYDZ Technologies Limited, Grevillia Avenue, Blantyre, Malawi, is the controller for personal data it determines how and why to process when operating the RYDZ platform. The named transport Operator may act as an independent controller for passenger manifests, statutory transport records and providing its carriage service; in some workflows parties may have distinct or shared responsibilities, which are allocated in the agreement between RYDZ and that Operator. Contact support@rydzmw.com (subject Privacy Request) for privacy requests and questions; you can also write to RYDZ Technologies Limited, Grevillia Avenue, Blantyre, Malawi, or call +265 222 247 247.

This notice covers the website, ride app, Captain app, available ticketing journeys, business/operator interfaces, payment and wallet functions, verification, customer support and security. It explains the data involved; our reasons for using it; sharing, retention, transfers, choices and complaints under Malawi's Data Protection Act, 2024. We collect only what is appropriate, accurate and necessary for identified lawful purposes and do not sell personal information to data brokers.

Account and contact: name, phone, email, date of birth where appropriate, profile photo, sign-in method (email and password, Google or Apple), preferred language and account preferences, including notification preferences. Safety features: emergency contacts you choose to save in the rider app. Ride and ticket booking: pickup/drop-off, proposed route, meeting point, booking date, times and status, fare quote, fare offers and final charge, vehicle category, Captain identifier, in-app chat messages between rider and Captain, ratings and reviews, schedule, operator, route, passenger names or identifiers when necessary, seat allocation, QR/reference or other valid ticket credential, and journey changes. Payments: transaction reference, payment type, amount, the mobile-money number used, discounts, wallet ledger events, billing/receipt details, reversals and dispute evidence. Cards are not accepted for any RYDZ payment, and RYDZ never asks for or stores your mobile-money PIN.

Captain and Operator due diligence: personal/organizational contact details, national ID and other legal identity documents where authorized, driving licence, driver qualifications, licence and insurance documents and expiry dates, Certificate of Fitness, vehicle registration and vehicle photos, payout account details, operating permits, route information, capacity and compliance records. We may request beneficial ownership and lawful verification data when appropriate and required. Support: messages, complaints, feedback, ratings, reports, uploaded evidence, claim status and dispute outcomes. Do not submit sensitive information unrelated to your case.

The rider and Captain apps use precise GPS location for pickup selection, matching, routing, trip tracking, ETA and safety. The Captain app uses location while the Captain is online or on an active trip, including when the app is in the background where the device allows it. The rider app uses location to set your pickup, show nearby Captains and track your trip, and, when location permission is granted, records your location together with app-usage events such as opening the app or searching for a ride. Collection follows permission and purpose limits; continuous tracking outside a legitimate operational need is prohibited. Users can change OS location permissions; without access, live-matching and tracking may not work properly. Where feasible, enter a location manually instead.

We may process IP address, device type/OS, app version, notification token, a device identifier generated by the rider app, session and app-usage events, crash and error logs, fraud-risk signals, approximate location derived from IP, and authentication activity. The rider app uses Google Firebase Analytics to measure app usage. On the website, analytics cookies are used only if you accept them (see the Cookie Policy). We do not use app-permission access as blanket authorization to capture microphone, contacts, messages or other unrelated content; camera and photo access are used only when you choose to take or upload a photo or document.

We may receive payment success/failure and reversal status from mobile-money or financial providers; verified credentials from identity services or authorized check providers; booking and passenger-status updates from Operators; trip complaints and safety evidence from other participants; your name, email address and profile picture from Google or Apple when you choose to sign in with them; and map, communications or security logs from processors. We check that collection and sharing is lawful, relevant and proportionate.

We will document the basis for each processing activity; withdrawable consent is not used to disguise processing that is necessary for a contract or statutory records.

To carry out bookings, we share limited rider details and relevant pickup/drop-off information with the matched Captain; a ticket carrier receives necessary passenger/itinerary/seat/manifest information; payment partners receive the minimum needed to authorize or trace transactions. Hosting, maps, messaging and customer-support vendors process data under appropriate instructions and contractual safeguards. Access is role-restricted. We may disclose information to insurers, emergency responders or public authorities where legally required, lawfully authorized or necessary to protect vital interests. We may also disclose limited data to professional advisers in connection with valid legal claims and corporate transactions subject to safeguards.

The service providers RYDZ currently uses are:

Some hosting, analytics, cloud, map or messaging infrastructure processes data outside Malawi. In particular, Supabase hosts RYDZ's database and files on cloud infrastructure outside Malawi, and Google, Apple and Microsoft operate globally. Such transfers are made only when allowed by the Data Protection Act, 2024, including appropriate adequacy, contractual or other lawful transfer conditions and documented safeguards. Accepting this notice is not, by itself, treated as consent or legal authorization for a transfer.

A Captain should see only data necessary to handle the assigned ride, within a limited operational window. Operators should receive only data required for a paid reservation, boarding, refund or statutory manifest. We may display vehicle status, journey progress or driver identity to the relevant parties, but do not publish live passenger routes or identity openly. Safety evidence access is limited to a trained and authorized team. Ticket QR/barcodes and booking references should be treated as sensitive credentials because they may permit boarding.

Dispatch ranking, fraud alerts, estimated fares, demand-based pricing and cancellation monitoring may involve automated rules. For example, the order in which Captains receive ride requests takes into account distance and each Captain's recent acceptance and cancellation record. We will explain material automated outcomes where required, provide appropriate channels for human review of significant adverse account, payout, booking or safety decisions, test for unfair error patterns and avoid solely automated legally significant decisions except where lawful. A quoted ETA or risk flag is an operational estimate, not a legal finding about a person.

Data is retained only for a legitimate, specified purpose. Account/profile information is normally kept for the lifetime of an account and a reasonable closure period; ride/ticket and finance records may need longer retention for tax, accounting, fraud, passenger safety, disputes, contractual or statutory obligations. Verification files should be removed or minimized when checks and legal retention needs end. Backups expire on controlled schedules. Current retention practice, including what is kept after an account is deleted, is described in Data Rights and Account Deletion. We will never promise instantaneous deletion from legally required archives or backups.

Subject to applicable law and exemptions, you may request confirmation/access to your information; a copy of it; correction/completion; erasure; restriction; objection to particular processing; and data portability where applicable. You may withdraw consent for consent-based processing without affecting past lawful processing. Send a request to support@rydzmw.com with the subject Privacy Request; we will verify your identity proportionately and avoid collecting excessive extra identification. Where the Act provides specific timelines, we follow those timelines (for example, access and eligible portability requests generally within 30 days, correction requests generally within 14 days). We will explain any lawful denial, extension or retention.

You may also complain to the Malawi Data Protection Authority (DPA), https://www.dpa.mw (opens in a new tab), or seek other lawful remedies. Do not wait for internal support if you believe urgent external intervention is required.

We apply proportionate safeguards such as protected transmission, access controls, credential management, segregated permissions, monitoring, backups, development testing and staff access restrictions, based on actual implementation and risk. No system is infallible. In a qualifying personal-data breach, we will meet applicable reporting obligations, including the Data Protection Act's notification provisions (72-hour regulator notification under section 36 and notice to affected persons for high-risk breaches under section 37, where applicable). We will not publish technical detail that would create new risks during an active incident.

Website cookies and similar technologies are described in the Cookie Policy. Service-critical notifications can be necessary to deliver a booked journey; optional promotional communications have separate choices. Push permissions and preference controls can be changed in your device, browser or account settings, subject to transaction messages needed for a service you request. See Communications and Notifications.

Users under 18 require appropriately verified parental/guardian arrangements where permitted; Captains must be adults satisfying applicable licensing rules. If one user purchases a ticket for someone else, we may process the actual passenger's name and applicable travel documentation after appropriate notice and authorization. We do not knowingly process children's data for behavioral advertising. See Children and Minors Policy.

We date material changes and communicate them where appropriate. Significant new uses of data require an independent legal basis and, where required, fresh consent or prior notice. This Privacy Policy replaces the RYDZ Privacy Policy dated 12/03/2025 that was previously published on this website. Contact: support@rydzmw.com, +265 222 247 247, https://rydzmw.com (opens in a new tab), RYDZ Technologies Limited, Grevillia Avenue, Blantyre, Malawi.