---
Last Updated: July 28, 2026
Data Controller: Vuuka Technologies Kenya Limited, Kutus, Kirinyaga County, Kenya
Registered with ODPC as Data Controller & Processor
This Policy explains how Vuuka collects and protects your data when you use Vuuka Matatu, Vuuka Boda, Vuuka Tuk-Tuk, Vuuka Rentals, and Vuuka Parcel.
1. DATA WE COLLECT
a) When you register (Rider/Passenger):
Name, phone number, email, profile photo, ID Number (for Rentals & high-value Parcel), emergency contacts (for safety tracking).
b) For Parent/Guardian Tracking Feature:
If you enable "Track My Child", we collect child's name, school, and consent from parent. Child must be under 18 and parent must provide consent. This is to enable parents to track their children from and to school without hustle.
c) Location Data (Most Important):
We collect real-time GPS when app is in use, during trip, and 5 minutes after trip ends for safety. This is how we stop mugging by unidentified persons and lost luggage - every trip is tracked and recorded. If you enable Parent Tracking, location is shared with your verified parent/guardian.
*d) Trip & Parcel Data:*
Pickup, drop-off, route, fare, Matatu SACCO, Boda plate number, parcel description, weight, parcel photo, delivery proof.
e) Payment Data:
M-Pesa number, M-Pesa transaction code, Airtel Money number, Card last 4 digits & expiry. We NEVER store your M-Pesa PIN or full card number. Payments processed via Safaricom Daraja & Flutterwave.
f) Device & Safety Data:
Phone model, Android version, app logs, crash reports, speed, harsh braking reports for driver safety scoring.
g) For Drivers, Riders & SACCOs:
ID, KRA PIN, Driving License, PSV Badge, Certificate of Good Conduct, logbook, NTSA inspection, insurance, SACCO registration certificate, bank/M-Pesa payout details, selfie for facial verification.
2. WHY WE USE YOUR DATA (Legal Basis under Sec 30 DPA)
- *To provide service (Contract):* To connect you to nearest Matatu/Boda/Tuk, calculate fare, process M-Pesa payment, track parcel to avoid lost luggage.
- *Safety (Legitimate Interest & Vital Interest):* To identify every driver/rider - no more unidentified muggings, to share trip with emergency contact, to comply with police requests for safety.
- *Legal Obligation:* To comply with NTSA, KRA (tax), DCI, ODPC.
- *Consent:* For marketing SMS, for Parent/Child tracking, for promotional calls. You can withdraw anytime in App > Settings.
3. WHO WE SHARE WITH
- Drivers/Riders: We share your first name, pickup point, drop-off point, rating ONLY. We do NOT share your ID or phone unless trip is active and masked calling is off.
- Parents/Guardians: If you enable tracking, we share live trip with verified parent.
- SACCOs & Fleet Owners:* For Matatu & Rentals.
- Service Providers: Safaricom M-Pesa, Google Maps, AWS Africa (Cape Town) for hosting, SMS provider.
- Authorities:NTSA, Kenya Police, ODPC, KRA when legally required or for safety incident.
- We DO NOT SELL your data. Ever.
4. YOUR RIGHTS - Under Kenya Data Protection Act 2019
You have the right to:
1. *Access:* Get copy of your data - free once per year
2. *Correction:* Correct wrong phone, name, ID in App > Profile
3. *Delete:* Request deletion of account. Note: We must retain trip & payment data for 7 years per KRA tax law
4. *Object:* Object to marketing or Parent Tracking
5. *Withdraw Consent:* Stop tracking sharing anytime
To exercise: Email
dpo@vuuka.app with ID and phone number. We reply within 21 days per law.
5. CHILDREN'S DATA - SCHOOL TRACKING
Vuuka does not allow users under 18 to register alone. For our School Tracking feature, a parent/guardian 18+ must register the child, provide consent, and verify relationship. Location of child is ONLY shared with verified parent and retained for 90 days.
6. HOW LONG WE KEEP DATA
- Active account: While account active
- Trips & GPS routes: 1 year for safety disputes, then anonymized
- Parent Tracking logs: 90 days
- M-Pesa & Tax records: 7 years as required by KRA
- Driver documents: While active + 3 years
7. SECURITY - No More Lost Luggage, No More Lost Data
We use TLS encryption, encrypted M-Pesa APIs, and hashed passwords. Every Matatu, Boda, Tuk is verified. Your parcel has photo proof + GPS. However, no internet system is 100% secure. Please keep your PIN and phone safe.
8. CROSS-BORDER TRANSFER
Data is hosted in AWS Africa - Cape Town, South Africa. South Africa has adequate protection under Sec 49 DPA. We have Data Processing Agreements with all processors.
9. COOKIES
We use cookies on
http://vuuka.app website to remember language and login. No third-party advertising cookies.
10. CHANGES TO POLICY
If we change policy, we will notify via App and SMS. Major changes will require you to Accept again.
11. CONTACT US - Mother & Son Team from Kutus
If you have questions, we are here.
*Vuuka Technologies Kenya Limited*
Kutus Town, Kirinyaga, Kenya
Phone: +254 7XX XXX XXX
*This is Vuuka - Power of Movement In Your Pocket. Safe, Tracked, Identified.*
---
Do you want me to now export all 4 documents (Terms, Driver Terms, About Us, Privacy Policy) into *one branded PDF with Vuuka logo for ODPC & Play Store submission*?
