Akwaaba Rides Privacy Policy
Version: 1.0 · Effective date: [to complete] · Last updated: [to complete]
1. Who we are
Akwaaba Rides is a booking service for pre-arranged airport pickups in Ghana. It connects travellers arriving at Kotoka International Airport, Accra (ACC), Prempeh I International Airport, Kumasi (KMS), and other airports we add, with independent drivers who have been checked and approved by us.
Akwaaba Rides is a digital product operated by Astrovenza ("Akwaaba Rides", "we", "us"), the data controller for the personal data described in this policy.
| Registered name | Astrovenza (a business name registered under the Registration of Business Names Act, 1962 (Act 151)) |
| Business registration number | BN076950826 |
| Registered address | 2nd Trinity Street, East Legon, Accra, Ghana |
| Data Protection Commission registration number | [to complete] (renewed every two years under Act 843 s.50) |
| Privacy contact | privacy@[to complete] (until that address is set up: astrovenzav@gmail.com) |
| Data Protection Supervisor (Act 843 s.58) | [to complete: name, or delete this row if none is appointed] |
| UK representative (UK GDPR Art. 27) | [to complete: name and address, or delete if not required] |
| EU representative (GDPR Art. 27) | [to complete: name and address, or delete if not required] |
Drivers who use Akwaaba Rides are independent operators. They are not our employees. When a traveller pays a driver, that payment is between the traveller and the driver. Akwaaba Rides does not collect, hold or pass on fares.
2. Who this policy covers and which laws apply
This policy covers:
- Travellers: anyone who books a pickup, and the lead passenger named on a booking.
- Drivers: people who apply to drive with Akwaaba Rides, and approved drivers.
- Visitors to our website and web app.
Staff and contractors receive a separate internal notice.
We process personal data under the Data Protection Act, 2012 (Act 843) of Ghana, under the supervision of the Data Protection Commission (DPC).
Many of our travellers book from abroad. Where personal data originating from another country is sent to Ghana for processing, we process it in line with the data protection law of that country, as Act 843 s.18(2) requires. In practice, for travellers who book while in the United Kingdom or the European Economic Area, we apply the UK GDPR or the EU General Data Protection Regulation (GDPR) to their data. Those laws can also apply to us directly because we offer our service to people in those places (GDPR Art. 3(2)).
3. Summary
| What | Short answer |
|---|---|
| What we collect from travellers | Name, phone number, optional email, flight number and landing time, drop-off area and address or landmark, group size, bags and extras |
| What we collect from drivers | Identity and contact details, vehicle details, licence and vetting results, base airport, subscription payments |
| What we do not collect | Card numbers, mobile money PINs, payment tokens, copies of ID documents, live location |
| Who sees your data | The driver assigned to your trip (or the traveller, if you are a driver), our hosting providers, our email provider (drivers' sign-in codes), Paystack (drivers only), and authorities where the law requires |
| Where it is stored | With our hosting providers in London, United Kingdom. See section 8 |
| How long we keep it | Trip details for 90 days after the trip, then removed from the booking. Payment records for 6 years. See section 9 |
| Your rights | Access, correction, deletion, objection, a copy of your data, withdrawal of consent, and complaint to the DPC. See section 11 |
| Do we sell data? | No. Selling personal data is an offence under Act 843 |
4. The personal data we collect
Act 843 s.27 requires us to tell you what we collect, whether you have to provide it, and what happens if you do not. The tables below do that.
4.1 Travellers
| Data | Where it comes from | Required? | If you do not provide it |
|---|---|---|---|
| Lead passenger name | You, on the booking form | Required | Your driver cannot prepare a name sign, so we cannot take the booking |
| Phone number | You | Required | Your driver cannot reach you at the airport, so we cannot take the booking |
| Email address | You | Optional | We can only reach you by phone if there is a problem with your booking |
| Airport, flight number, landing date and scheduled time | You | Required | We cannot schedule a pickup |
| Drop-off area and address or nearby landmark | You | Required | We cannot price the trip or tell the driver where to go |
| Number of passengers, bags and extras (meet inside arrivals, child seat, extra stop) | You | Required (extras optional) | We cannot pick a vehicle that fits |
| Confirmation that you are 18 or over, the privacy notice version you saw, and your marketing choice | You, on the booking form | Age confirmation required; marketing optional | We cannot take a booking from someone under 18 |
| Booking code, fare, assigned driver and trip status | Created by Akwaaba Rides | n/a | n/a |
| Messages and the location pin you send your driver on WhatsApp | You, through WhatsApp | Optional | Your driver relies on the address you typed |
About WhatsApp. After booking, we give you your driver's WhatsApp number and a ready-written message so you can send your exact drop-off location. Anything you send through WhatsApp goes directly to the driver through WhatsApp, which is run by WhatsApp LLC / Meta under its own privacy policy. Akwaaba Rides does not receive or store those messages or locations.
4.2 Drivers
| Data | Where it comes from | Required? | If you do not provide it |
|---|---|---|---|
| Full name, phone number, email address | You | Required | We cannot create your account or send subscription receipts |
| Vehicle make and model, registration plate, vehicle class | You, checked against your vehicle documents | Required | We cannot match you to bookings |
| Driver's licence details and DVLA ride-hailing registration status | You, checked by our staff | Required | We cannot approve you to drive |
| Ghana Card (national ID) verification result | You | Required | We cannot confirm your identity |
| Police clearance / criminal record check result | You, with your written consent | Required for approval | We cannot approve you to drive |
| Base airport | You | Required | We cannot send you pickups |
| Subscription payment records (amount, date, Paystack reference, payment channel) | Paystack | Created when you pay | n/a |
| If you pay us directly by mobile money or bank transfer: the transaction ID, the number or account you paid from, and a screenshot of the payment | You | Optional (you can pay through Paystack instead) | We cannot confirm a direct payment |
| Trip history (bookings assigned to you, status changes and times) | Created by Akwaaba Rides | n/a | n/a |
Criminal record information is special personal data under Act 843 s.37. We collect only the result of the check (for example "clear" or "not clear" and the date), we collect it only with your express consent, and we use it only to decide whether you can drive with Akwaaba Rides. We do not keep copies of your ID or licence images after verification. See section 9.
4.3 Technical and security data (everyone)
When you use our website or web app, our hosting providers automatically record technical data: your IP address, browser type, the pages and functions you used, and the date and time. We use this to keep the service running, to protect it against attacks and abuse, and to investigate problems. Drivers and staff who sign in also generate sign-in records (time, IP address, device type).
Drivers who sign in keep a sign-in session in their browser's storage. We do not use advertising cookies or third-party analytics. See section 14.
4.4 What we do not collect
- Card numbers, mobile money PINs, payment tokens. Drivers pay their subscription on Paystack's secure checkout, or directly to Astrovenza's mobile money or bank account. Paystack, a payment service provider licensed by the Bank of Ghana, handles the payment details. We receive only a payment reference, the amount, the date and the type of payment method (for example "mobile money"). For a direct payment we receive only what you send us (see 4.2). Never send us your PIN; we will never ask for it.
- Fares. Travellers pay drivers directly. We do not process fare payments.
- Live location. Akwaaba Rides does not track the location of travellers or drivers.
- Data about children. We do not ask for the names or details of children travelling. We only ask how many passengers there are and whether a child seat is needed. Bookings must be made by someone aged 18 or over.
5. Why we use your data and our legal grounds
Act 843 s.20 says personal data may be processed with the person's consent, or without consent where it is necessary for a contract with them, required by law, or necessary for a legitimate interest. The GDPR has equivalent grounds in Art. 6.
| Purpose | Data used | Act 843 ground (s.20) | GDPR ground (Art. 6) |
|---|---|---|---|
| Take and confirm a booking, price it, and choose a suitable driver | Booking details | Necessary for the contract with you | Contract, 6(1)(b) |
| Let the driver and traveller find and contact each other (dispatch) | Names, phone numbers, flight, drop-off details, vehicle and plate | Necessary for the contract | Contract, 6(1)(b) |
| Check and approve drivers, and keep only vetted drivers on the platform (passenger safety) | Driver identity, licence and vetting data | Consent for criminal record checks (special personal data, s.37); otherwise necessary for the contract and our legitimate interest in passenger safety | Not applicable to drivers in Ghana; if it applies, 6(1)(b) and 6(1)(f) |
| Run the driver subscription: take payments, keep accounts | Driver contact and payment records | Contract; legal obligation (tax records) | 6(1)(b), 6(1)(c) |
| Airport access and security, where an airport operator or security agency requires driver or vehicle details | Driver identity and vehicle details | Required by law or legitimate interest in lawful airport access | 6(1)(c) or 6(1)(f) |
| Emergencies: sharing details with police, ambulance or the other party when someone's safety is at risk | Booking and contact data | Protecting the interests of the person concerned | Vital interests, 6(1)(d) |
| Prevent fraud and abuse: duplicate bookings, no-shows, fake accounts, attacks on the service | Phone number, booking history, technical data | Legitimate interest | 6(1)(f) |
| Answer questions, complaints and disputes | Anything relevant to the issue | Contract or legitimate interest | 6(1)(b) or 6(1)(f) |
| Meet legal duties: tax records, lawful requests from authorities | Payment and booking records | Required by law | 6(1)(c) |
| Marketing messages about Akwaaba Rides | Name, email or phone | Your prior written consent (s.40). You can withdraw it at any time | Consent, 6(1)(a) |
We do not use your data for purposes unrelated to those above. If we need to use it for a new purpose, we will check that the new purpose is compatible (Act 843 s.25) and tell you first.
Automated decisions. Our system assigns bookings automatically. It picks a driver who is approved, has an active subscription, drives the right vehicle size and is free at the landing time. It also blocks a booking when the same phone number already has a pickup at another airport within six hours, and it stops assigning pickups to a driver whose subscription has lapsed. If you think one of these automated decisions has treated you unfairly, you can ask for a person to review it (Act 843 s.41; GDPR Art. 22).
6. Who we share your data with
Between traveller and driver. To make the pickup work:
- your driver sees your name, phone number, flight, landing time, drop-off area and address, group size, bags and extras; and
- you see your driver's name, vehicle, registration plate and WhatsApp number.
Service providers (data processors) that run parts of Akwaaba Rides for us. Each acts only on our instructions under a written contract that requires confidentiality and security (Act 843 s.30; GDPR Art. 28):
| Provider | What they do | Data involved | Where |
|---|---|---|---|
| Supabase Inc. | Database, driver and staff sign-in | All data in this policy | London, United Kingdom |
| Vercel Inc. | Website and server hosting | Technical data; data passing through our servers | London, United Kingdom |
| Sendinblue SAS (Brevo) | Sending sign-in codes to drivers by email | Driver email addresses | France (European Union) |
| Paystack Payments Limited | Driver subscription payments | Driver name, email, payment details (handled by Paystack) | Ghana / [to complete] |
Authorities and others, when the law requires or safety demands. We share data with the Ghana Police Service, courts, the Data Protection Commission, the Ghana Revenue Authority, the DVLA, Ghana Airports Company Limited or other airport operators, and security agencies, when a law, court order or lawful request requires it. We also share it where it is needed to protect someone's life or safety. We check that each request is lawful and share only what it needs.
If Akwaaba Rides changes ownership. If Astrovenza merges, is sold or transfers the Akwaaba Rides business, your data may pass to the new owner, who must continue to protect it under this policy. We will tell you before that happens.
We never sell personal data.
7. Keeping your data secure
We use technical and organisational measures that suit the risks involved (Act 843 s.28; GDPR Art. 32). They include:
- encrypted connections (HTTPS) everywhere;
- encryption of stored data by our hosting provider, and additional encryption of travellers' names, phone numbers, emails and addresses inside our database;
- row-level access rules in our database, so drivers can see only their own trips;
- staff access only with a strong password and a second sign-in step (authenticator app), with automatic sign-out and an audit trail of staff actions;
- prices and payment confirmations checked on our servers, never trusted from a browser;
- no card or mobile money details held by us; and
- written contracts requiring the same standards from our service providers.
No system is perfectly secure. If something goes wrong, we will act as described in section 15.
8. International transfers and where your data is stored
Our database and servers are run by Supabase and Vercel, which store and process data in London, United Kingdom. Their support teams and some of their own suppliers may access data from the United States or other countries. So your data is stored and processed outside Ghana.
- Under Act 843: Act 843 does not set special rules for sending data abroad. We disclose where your data goes in this policy and in our DPC registration, and our providers are bound by written contracts to protect it (s.30).
- Under the GDPR and UK GDPR: where your data is subject to these laws and goes to a country without an adequacy decision, including Ghana and the United States, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the provider's certification under the EU-U.S. Data Privacy Framework, as applicable. You can ask us for a copy of the safeguards.
- Foreign data subjects (Act 843 s.18(2)): data you send from abroad, for example while booking from London, is processed in line with your home country's data protection law, as section 2 explains.
9. How long we keep your data
We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires (Act 843 s.24; GDPR Art. 5(1)(e)). After that we delete it or make it anonymous so that it can no longer identify you.
| Data | How long | Why |
|---|---|---|
| Traveller name, phone, email and drop-off address on a booking | Until 90 days after the scheduled landing date, then removed from the booking. The booking stays only as anonymous statistics (airport, zone, vehicle, fare, date, status) | Complaints and safety reports usually arise within this period |
| Record of a no-show or blocked duplicate booking | 12 months, kept as a scrambled (one-way hashed) phone number, not the number itself | Preventing repeated abuse |
| Driver account and trip history | While you drive with us, plus 2 years after your account closes | Safety complaints and disputes about past trips |
| Driver vetting results (ID, licence, police clearance) | While you drive with us, plus 2 years. The results only, not document images | Showing that vetting took place |
| Subscription payment records | 6 years from the end of the year they relate to | Tax record-keeping under the Revenue Administration Act, 2016 (Act 915) |
| Screenshots of direct payments | Deleted 90 days after we confirm or reject the payment. The transaction ID and amount are kept as a payment record | Resolving questions about the payment |
| Staff action audit trail | 2 years | Security and accountability |
| Server and security logs | Up to 90 days | Security monitoring and investigating incidents |
| Marketing consent records | As long as you are subscribed, plus 2 years | Proof of consent |
| Backups | Deleted data drops out of backups within [to complete: 30] days | Backups are kept for recovery only |
If a law, an ongoing investigation or a legal claim requires us to keep something longer, we keep it only for that reason, and only for as long as needed.
10. Accuracy
Please keep your details accurate (Act 843 s.26). Travellers can correct a booking by contacting us. Drivers can ask us to update their account details at any time.
11. Your rights
| Right | Under Act 843 | Under GDPR / UK GDPR | How it works at Akwaaba Rides |
|---|---|---|---|
| Know whether we hold your data and get a copy | s.32 | Art. 15 | We give you a copy of your data and tell you who it has been shared with |
| Correct inaccurate or incomplete data | s.33 | Art. 16 | We correct it, or explain with evidence why we believe it is accurate |
| Delete data | s.33 (data that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we are no longer authorised to keep) | Art. 17 | We delete it, unless we must keep it by law (for example payment records) or need it for an open dispute |
| Object, or stop processing that causes unwarranted damage or distress | s.20, s.39 | Art. 21 | We reply in writing within 21 days |
| Stop direct marketing | s.40 | Art. 21(2) | We stop straight away |
| Not be subject to solely automated decisions with significant effects, and ask for human review | s.41 | Art. 22 | See section 5 |
| Receive your data in a portable format | Not in Act 843; we offer it to everyone | Art. 20 | We send it to you as a JSON or CSV file |
| Restrict processing while a complaint is checked | Not in Act 843; we offer it to everyone | Art. 18 | We pause use of the data in question |
| Withdraw consent | s.20 | Art. 7(3) | Withdrawing consent does not affect what we did before. Drivers who withdraw consent to vetting checks cannot remain approved |
| Compensation for damage caused by a breach of the law | Act 843 | Art. 82 | |
| Complain to a regulator | DPC | ICO (UK), or your EU supervisory authority | See below |
How to use your rights. Email privacy@[to complete] or astrovenzav@gmail.com, or write to us at the address in section 1. Act 843 s.32 requires us to confirm your identity first. We will usually do this by sending a code to the phone number on your booking or account. We do not charge for requests unless they are clearly unfounded or excessive.
How long we take. We aim to respond within 30 days. That is inside the 40-day limit in Act 843 s.35(10) and the one-month limit in the GDPR (Art. 12(3)). Where the GDPR allows, we may extend this by up to two further months for complex requests, and we will tell you why.
Complaints. Please contact us first so we can try to fix the problem. You also have the right to complain to:
- Data Protection Commission, Ghana: www.dataprotection.org.gh
- UK Information Commissioner's Office: www.ico.org.uk (if you are in the UK)
- The data protection authority in your EU/EEA country (if you are in the EU/EEA)
12. Marketing
We send marketing messages only if you have given us your prior written consent, by ticking an unticked box (Act 843 s.40). Booking a pickup does not sign you up to marketing. Every marketing message tells you how to stop receiving them, and you can also email us to stop. Booking confirmations and messages about your trip are not marketing and are sent whatever your marketing choice.
13. Children
Akwaaba Rides is for adults. Bookings must be made by someone aged 18 or over, and the booking form asks you to confirm this. We do not knowingly collect personal data about children. We ask only for the number of passengers and whether a child seat is needed. If you believe a child has given us personal data, contact us and we will delete it.
14. Cookies and browser storage
- Travellers: the booking page does not set cookies.
- Drivers: the driver app keeps your sign-in session in your browser's local storage so you stay signed in. This is strictly necessary for the service.
- Fonts and code libraries: our pages load their fonts and code from our own servers, not from third parties. The only outside links are the WhatsApp and phone links you choose to tap.
- We do not use advertising cookies, tracking pixels or third-party analytics. If we add analytics, we will update this policy and ask for consent where the law requires it.
15. If there is a data breach
If personal data is accessed or acquired by someone without authority:
- We act immediately to contain the breach and protect the data.
- We notify the Data Protection Commission and the people affected as soon as reasonably practicable after we discover the breach (Act 843 s.31). Our own target is within 72 hours.
- Where the GDPR or UK GDPR applies, we notify the relevant supervisory authority within 72 hours of becoming aware of the breach, unless it is unlikely to put anyone at risk (Art. 33). We tell affected people without undue delay where the risk to them is high (Art. 34).
- We report cyber incidents to Ghana's Cyber Security Authority (CERT-GH).
- Our notice tells you what happened, what data was involved, what we are doing, what you can do to protect yourself, and who to contact. Where we know who obtained the data, we tell you that too.
We send notices by SMS, email, a notice on our website, or the media, depending on how many people are affected. We delay telling affected people only if the DPC or a security agency asks us to, so as not to hinder a criminal investigation.
16. Changes to this policy
We will update this policy when our service or the law changes. If a change is significant, we will tell you before it takes effect: by email or SMS for drivers, and on the booking page for travellers. The version number and date at the top show when it last changed. Previous versions are available on request.
17. Contact us
Astrovenza (Akwaaba Rides) 2nd Trinity Street, East Legon, Accra, Ghana Email: privacy@[to complete] / astrovenzav@gmail.com Data Protection Supervisor: [to complete]