Privacy Policy — PukaWay

    Your privacy matters to us. This policy explains exactly what data PukaWay collects, why we collect it, how we use it, and your rights under the Ghana Data Protection Act, 2012 (Act 843).
  

1 Who We Are

PukaWay ("we", "our", or "us") is a food and goods delivery platform connecting customers, vendors, and delivery riders in Ghana. The PukaWay mobile application is operated by PukaWay Technologies.

2 What Data We Collect

The data we collect depends on whether you use PukaWay as a customer, vendor, or rider.

Category	Data Collected	Who It Applies To
Account Info	First name, last name, email address, phone number	All users
Location	GPS coordinates (delivery address for customers; live location during active deliveries for riders)	Customers, Riders
Payment Info	Mobile Money number, MoMo account name, and network (for payouts). Card payments are processed entirely by Paystack — we do not store card numbers.	All users
Business Info	Store name, address, cuisine type, operating hours, business description	Vendors
Vehicle Info	Vehicle type, license plate number	Riders
Identity Documents	Scanned copies of government-issued ID, driver's license, or other verification documents	Vendors, Riders
Order Data	Items ordered, delivery address, order status history, reviews and ratings	All users
Device Data	Device notification token (for push notifications), app version	All users

3 How We Use Your Data

Providing the service: Processing orders, matching riders to deliveries, calculating delivery routes, and enabling real-time tracking.
Payments: Facilitating customer payments via Paystack and disbursing earnings to vendors and riders via Mobile Money.
Account verification: Reviewing documents submitted by vendors and riders to ensure safety and trust on the platform.
Notifications: Sending order status updates, delivery alerts, and important account notices via push notification or email.
Safety and fraud prevention: Detecting and preventing unauthorized account access, fraudulent orders, or platform abuse.
Improving the platform: Understanding usage patterns to fix bugs, improve features, and build a better experience.
Legal compliance: Meeting our obligations under Ghanaian law and responding to lawful government requests.

4 Third-Party Services We Use

We use trusted third-party providers to operate PukaWay. Each provider handles data only as necessary to perform their function.

Provider	Purpose	Data Shared
Supabase	Database, authentication, and file storage	Account info, order data, documents
Firebase (Google)	Push notifications	Device notification token
Paystack	Payment processing (PCI DSS compliant)	Payment amount, transaction reference
OpenStreetMap	Map tiles for delivery tracking display	No personal data transmitted

We do not sell your personal data to any third party. We do not use your data for advertising purposes.

5 Location Data

Customers: We use your saved home location to show nearby vendors and estimate delivery distance. We do not track your location in the background.

Riders: During an active delivery, your GPS location is shared in real-time with the assigned customer so they can track their order. Location sharing stops as soon as the delivery is marked complete. We do not track rider location outside of active deliveries.

6 Identity Documents

Vendors and riders are required to submit verification documents (e.g. Ghana Card, driver's license). These are stored securely in encrypted cloud storage and are only accessible to PukaWay platform administrators for the purpose of verifying your account. Documents are not shared with customers or other third parties.

7 Data Retention

Active account: We retain your data for as long as your account is active.
Deleted account: When you request deletion, we remove your personal data within 30 days, except where we are required by law to retain certain records (e.g. financial transaction records).
Order records: Order history may be retained for up to 7 years for accounting and dispute resolution purposes.

8 Data Security

We protect your data using industry-standard measures including:

Encrypted data transmission (HTTPS/TLS)
Row-Level Security (RLS) policies so users can only access their own data
Authentication tokens with automatic expiry
Access controls limiting which staff can view sensitive data

No method of transmission or storage is 100% secure. If a data breach occurs that affects your rights, we will notify you as required by the Ghana Data Protection Act.

9 Children's Privacy

PukaWay is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has registered on our platform, please contact us immediately and we will delete the account.

10 Your Rights

Under the Ghana Data Protection Act, 2012 (Act 843), you have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Delete your account and associated personal data
Object to how we process your data in certain circumstances
Withdraw consent where processing is based on consent

To exercise any of these rights, contact us through the official PukaWay support channel. We will respond within 30 days.

11 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page and, where the changes are significant, notify you via the app or by email. Continued use of PukaWay after changes are posted constitutes your acceptance of the updated policy.

12 Contact Us

For any privacy-related questions, data requests, or concerns, please use the official PukaWay support channel.

PukaWay Technologies
Ghana