Privacy Policy

This policy explains how Varsity Go (“Varsity Go”, “we”, “us”) handles personal data when you use the Varsity Go passenger app, the Varsity Go Rider app and this website. We are the data controller for that data under the Kenya Data Protection Act, 2019 (the “Act”) and the Data Protection (General) Regulations, 2021.

We try to collect only what we need to give you a safe ride, pay riders correctly and keep our records honest. We do not sell personal data.

1. The data we collect

Everyone who uses the apps

• Account details: your mobile number, your name, and whether you use the passenger or rider app.
• Sign-in codes: the one-time codes we text you. We store only a protected form of each code and delete them within two days.
• Device details: a push-notification token, your phone’s platform (Android or iOS) and the app version, so we can send trip updates.
• Technical data: IP address, request times and error details in our server logs, used to keep the service secure and working.
• Ratings and feedback: star ratings, tags and comments you leave after a trip, and anything you send to support.

Passengers

• Trip details: pickup and drop-off places, the route, times, the price and its breakdown, and the trip’s status history.
• Location: your phone’s location while you are using the app, to set your pickup and show you riders nearby. If you press SOS, we keep receiving your location while the SOS screen is open.
• Payments: the M-Pesa number charged, amounts, M-Pesa receipt numbers, and your Varsity Go wallet history. We never see your M-Pesa PIN.
• Trusted contacts: the names and numbers of people you choose to alert in an emergency. Please ask them first.

Riders

• Vetting documents: photos of your national ID (front and back), your driving licence, your motorcycle, a live selfie, your number plate and bike description. We use them to confirm who you are and that you may carry passengers.
• Location while online: while you are online, the Rider app sends your location every few seconds (more often during a trip), including with the screen off. A notification is always visible while this happens. It stops when you go offline or sign out.
• Trip routes: while you are on your way to a pickup or carrying a passenger, we keep the positions your app sends, so we can check the fare distance, investigate safety reports, and find roads and footpaths that are missing from the map. We don’t keep this trail while you are online without a trip.
• Earnings and payouts: trips, fares, fees, payout amounts and references, and the identifier of the M-Pesa payout channel we register for you.
• Performance: offers received and accepted, completed and cancelled trips, your ratings, and your daily goal and streak.

Visitors to this website

• If you join the waitlist: your mobile number, the page you joined from and your device type (Android, iOS or other). We use it only to text you when the app is available.
• This website uses no advertising or analytics cookies and no third-party trackers.

2. Why we use it, and our legal basis

Automated decisions. We offer trips to riders automatically, based on distance and availability. We do not suspend riders or remove passengers automatically: a person on our team reviews flags and decides.

3. Who sees your data

• The other person on your trip. Your rider sees your name, pickup and drop-off. Passengers see their rider’s name, selfie, bike photo, plate, rating and live position. While the trip is active, each of you can see the other’s phone number so you can call. It is hidden once the trip ends. Riders see their average rating and tag counts, not who left a rating.
• People you share a trip with. A share link shows the bike’s position, the rider’s name and plate, your first name and your destination. It expires shortly after the trip ends.
• Trusted contacts. If you press SOS, they receive an SMS with a live trip link.
• Our team. Trained staff with role-based access handle rider checks, safety incidents, support and finance. Every change they make is logged.

We use these service providers (processors), who may only use the data to provide their service to us:

• Cyzora and Safaricom (M-Pesa): payment collection and rider payouts.
• HostPinnacle: delivery of SMS messages (sign-in codes, safety alerts, payout notices).
• Google Firebase Cloud Messaging: delivery of push notifications to your phone.
• Google Maps Platform and OpenFreeMap: map images in the apps and on trip-share pages. Your device requests the map directly, so the provider sees your IP address and the map area viewed. We never send them your name, phone number or trips.
• Our hosting and storage providers, who run our servers and store encrypted backups and rider documents.

We share data with the police or other authorities only when the law requires it, or when it is needed to protect someone’s life or safety.

4. Transfers outside Kenya

Some providers, such as Google, may process data on servers outside Kenya. Where that happens, we rely on the safeguards in sections 48 to 50 of the Act and the Regulations, including the provider’s contractual commitments to protect the data to a standard comparable to Kenyan law. Ask us for details.

5. How long we keep it

6. Deleting your account

You can delete your account in the app under Settings → Delete account. When you do:

• your name, trusted contacts and devices are erased, and you are signed out everywhere;
• any money in a passenger wallet is refunded to your M-Pesa number;
• riders must wait until any unpaid earnings have been paid out, and must be vetted again if they ever return;
• trip and payment records are kept for the period above, without your name.

7. Your rights

Under section 26 of the Act and the related provisions, you have the right to:

• be told how your data is used (this policy);
• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data deleted where we have no lawful reason to keep it;
• object to processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on it.

Email [email protected] from, or mentioning, the phone number on your account. We will confirm it’s you and reply within the time the Regulations allow. We don’t charge for reasonable requests.

If you’re unhappy with our answer, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

8. Security

Data travels encrypted (HTTPS). Sensitive values such as trip PINs and payment credentials are encrypted at rest. Rider documents are private and viewable only by authorised staff through short-lived links. Staff accounts require two-factor authentication, and access is limited by role and logged. If a breach is likely to harm you, we will notify the Data Protection Commissioner within 72 hours, as section 43 of the Act requires, and tell you without undue delay.

9. Age

Varsity Go is for people aged 18 and over. We don’t knowingly collect data from anyone younger. If you believe a child has an account, tell us and we will delete it.

10. Changes

If we change this policy in a way that matters, we will tell you in the app before the change applies. The date at the top shows when it last changed.

11. Contact

Varsity Go, Maseno, Kisumu County, Kenya.
Privacy: [email protected]
Support: [email protected]