AfrikieGo Logistics Limited ("AfrikieGo", "we", "us") operates an on-demand, last-mile delivery platform in Rwanda, comprising our customer and rider mobile applications, our websites, and our administrative systems (together, the "Services"). This Privacy Policy explains what personal data we collect, how and why we use it, who we share it with, and the rights you have. We process personal data in accordance with Law N° 058/2021 of 13 October 2021 relating to the protection of personal data and privacy of the Republic of Rwanda.
1Who we are
The data controller is AfrikieGo Logistics Limited, based in Kigali, Rwanda. For any privacy matter, contact us at compliance@afrikiego.com.
2Information we collect
Information you provide
- Account & contact details — name, phone number, email address, and password (stored only in hashed form).
- Delivery details — pickup and drop-off addresses, recipient names and phone numbers, and order contents/notes you supply.
- Payment information — for card and mobile-money payments, transactions are processed by our payment provider; we retain only transaction references and status needed for reconciliation, not full card details.
- Rider information — for riders, identity and verification documents, vehicle details, and payout information.
- Communications — messages, support tickets, ratings, and feedback.
Information collected automatically
- Location data — with your device permission, GPS location (primarily from riders) to enable dispatch, live tracking, and safety features.
- Device & usage data — device identifiers, app version, and log data such as IP address and timestamps.
3How we use your information
- To provide and operate the Services — creating orders, dispatching riders, enabling live tracking, and completing deliveries.
- To process payments and reconcile cash-on-delivery and digital transactions.
- To keep our platform and users safe, including incident detection and response.
- To provide customer support and communicate with you (including delivery updates and, where permitted, service notices).
- To maintain accurate business and accounting records.
- To comply with legal obligations and to establish, exercise, or defend legal claims.
- To understand and improve our Services, using de-identified or aggregated data where possible.
4Lawful bases for processing
Depending on the activity, we rely on: performance of a contract (to deliver the Services you request); your consent (e.g., for device location or optional communications, which you may withdraw at any time); compliance with a legal obligation; and our legitimate interests in operating, securing, and improving the Services in a way that does not override your rights.
5How we share information
We do not sell your personal data. We share it only as needed to run the Services:
- Between users to fulfil a delivery — for example, a rider receives the drop-off address and recipient contact needed to complete your order.
- Service providers ("processors") who act on our instructions, including our payment provider (Pesapal), cloud and edge infrastructure (Amazon Web Services, Cloudflare), mapping (Google Maps), messaging and push notifications (Resend, Expo, Firebase Cloud Messaging), and accounting (Intuit QuickBooks).
- Authorities where required by law, regulation, legal process, or to protect the rights, safety, and property of users or the public.
- Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.
Each processor is engaged under terms requiring appropriate confidentiality and security safeguards.
6International data transfers
Some of our providers process or store data outside Rwanda (for example, database backups are held in Amazon Web Services' Cape Town (af-south-1) region). Where personal data is transferred outside Rwanda, we take steps to ensure a level of protection consistent with Law N° 058/2021.
7Data retention
We keep personal data only as long as necessary for the purposes above and for legal, tax, and accounting requirements, after which it is deleted or irreversibly anonymised. Financial records are retained for the period required by Rwandan law. Backup copies age out on a rolling schedule.
8How we protect your data
- All traffic to our Services is encrypted in transit (HTTPS/TLS).
- Passwords are stored only as salted cryptographic hashes; access tokens are protected and can be revoked.
- Access to personal data is role-based and limited to what each person needs, with sensitive actions logged.
- We run automated monitoring, maintain verified backups, and follow an incident-response process.
No system is perfectly secure, but we work continuously to protect your information.
9Your rights
Subject to applicable law, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure where retention is no longer justified; object to or request restriction of certain processing; request portability of data you provided; and withdraw consent where processing is based on consent.
10Data breaches
If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the NCSA and affected individuals as required by Law N° 058/2021.
11Children
The Services are intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
12Cookies and similar technologies
Our websites use only the cookies and local storage necessary to operate (for example, to keep you signed in). We do not use them to track you across other sites.
13Changes to this Policy
We may update this Policy from time to time. Material changes will be posted here with an updated effective date, and where appropriate we will notify you.
14Contact us
AfrikieGo Logistics Limited, Kigali, Rwanda — compliance@afrikiego.com.
Questions about this document or your data? Contact compliance@afrikiego.com.