Privacy Policy
This Privacy Policy explains how Patjo Holdings Ltd ("eTaxi", "we", "us") collects, uses, shares, and protects your personal data when you use the eTaxi rider app, driver app, and website (together, the "Services"). We are the data controller for this data and we process it in line with Kenya's Data Protection Act, 2019 and its Regulations.
1. Who we are and how to reach us
Controller: Patjo Holdings Ltd, P.O. Box 1529–00606, Nairobi, Kenya. For any privacy question or to exercise your rights, contact our privacy team at privacy@etaxi.co.ke. General support: hello@etaxi.co.ke.
2. The data we collect
Account & profile
- Your name, phone number, and email address.
- A profile photo. For drivers, this is a live selfie taken in-app for identity verification and safety.
- Login credentials and, where you use phone or Google sign-in, the associated identifiers.
Driver information
- National ID, driving licence, and (where applicable) PSV licence details.
- Vehicle details such as make, model, registration/number plate, and insurance information.
- Documents you upload for verification.
Location data
- Precise GPS location. For riders, we collect location when you set a pickup or drop-off and during an active trip. For drivers, we collect location continuously while you are online, including in the background, so we can match you to nearby riders, guide navigation, and support safety.
- Trip pickup, drop-off, and route information.
Trip & usage data
- Booking history, fares, distance and time, cancellations, ratings, and feedback.
- In-app communications and support messages. Calls between riders and drivers may use number masking.
Payment data
- Your M-Pesa phone number and transaction references, amounts, and status.
- We do not collect or store your M-Pesa PIN or any card details. M-Pesa payments are processed by Safaricom through the M-Pesa (Daraja) service; you enter your PIN on your own phone, not in our app.
- For drivers, wallet balances, commission owed, and withdrawal (payout) records.
Device & technical data
- Device model, operating system, app version, language, and device identifiers.
- IP address, push-notification token, and diagnostic, crash, and usage information collected through Google Firebase to keep the apps working reliably.
3. How and why we use your data
We process your data on the legal bases set out in the Data Protection Act, 2019 — performance of our contract with you, your consent, our legitimate interests, and compliance with legal obligations — to:
- Register and manage your account and verify driver identity and eligibility.
- Connect riders with nearby drivers, calculate fares, and enable navigation.
- Process payments, commissions, wallet top-ups, and driver payouts.
- Provide safety and anti-fraud features, including selfie verification and account checks.
- Send trip updates, receipts, and service notifications.
- Provide customer support and resolve disputes.
- Improve, secure, and troubleshoot the Services.
- Comply with law and respond to lawful requests from authorities.
4. Who we share data with
- Riders and drivers: to complete a trip, we share the information each side needs — for example first name, rating, photo, approximate or live location, vehicle details, and a masked contact number.
- Safaricom (M-Pesa / Daraja): to process payments and payouts.
- Google / Firebase: for authentication, cloud messaging (push notifications), maps and places, and diagnostics.
- Service providers who process data on our behalf under contract and only on our instructions.
- Authorities and legal: where required by law, court order, or to protect the safety, rights, or property of users or the public.
- Business transfers: if we merge, are acquired, or transfer assets, data may pass to the successor entity under this Policy.
We do not sell your personal data.
5. International transfers
Some of our processors — such as Google/Firebase — may store or process data on servers outside Kenya. Where this happens, we take steps to ensure your data receives protection consistent with the Data Protection Act, 2019.
6. How long we keep data
We keep your data for as long as your account is active and as needed to provide the Services. After that, we retain certain records where required for legal, tax, safety, dispute-resolution, or fraud-prevention purposes, and then delete or anonymise the rest.
7. Your rights
Under the Data Protection Act, 2019 you have the right to be informed about, and to access, correct, delete, or restrict the use of, your personal data; to object to certain processing; to data portability; and to withdraw consent where processing relies on it. To exercise any of these, email privacy@etaxi.co.ke. If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.
8. Security
We use technical and organisational measures — including encryption in transit, access controls, and verification checks — to protect your data. No system is completely secure, but we work to protect your information and to notify you and the ODPC of a breach where the law requires.
9. Children
The Services are for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.
10. Changes to this Policy
We may update this Policy from time to time. We will post the new version here with a revised "Last updated" date and, where changes are significant, notify you in the app.
11. Contact
Questions about this Policy or your data: privacy@etaxi.co.ke.