Privacy Policy
Version 1.11 · GZ-08-0002 · Last updated 18 October 2026
Every data category below is taken from the data model in the repository, not from a template.
1. Who is responsible for your information
It depends on where you are, and we would rather be exact than simple.
If you are in Malawi, GETZUGA LOGISTICS LIMITED decides how your information is used — company number COY-YJU4GG6, a private company limited by shares incorporated in Malawi, of 39 Chizumulu Road, Area 44, Lilongwe. GETZUGA (PTY) LTD in South Africa processes it on that company's documented instructions, and not for its own purposes.
If you are in South Africa, GETZUGA (PTY) LTD decides, registration number 2008/013999/07, a private company registered in South Africa. Its business address is 2nd Floor, Oxford Gate, 54 Oxford Street, Durbanville, Cape Town, Western Cape, 7550, South Africa.
You do not have to work out which company to write to. Use the address below and we will route it to whichever of the two is answerable — that is our problem, not yours.
You can contact us about anything on this page at privacy@getzuga.com.
2. What this covers
Our mobile applications and the services behind them: booking and taking trips, the driver side of those trips, the in-app wallet, in-app messaging, and the marketplace.
The website has its own notice, and this page does not replace it. www.getzuga.com does far less than the applications do — it sets no cookies, runs no analytics, and loads nothing from any other company — and its notice says so specifically. Nothing on this page describes the website, and nothing in the website notice describes the applications.
3. What we collect, and why
| Category | What it is | Why we hold it |
|---|---|---|
| Account | Name, phone number, email address, and your PIN (stored so that it cannot be read back) | To create and secure your account |
| Sign-in with Google, Apple or Microsoft | The identifier that provider returns when you choose to use one. Which of the three is offered depends on configuration | So you do not need a separate password with us |
| Trips | Pickup and drop-off, times, distance, fare, cancellations | To provide the trip, price it, and settle disputes |
| Location trace | Latitude, longitude and speed recorded during a trip | Navigation, safety, and reconstructing what happened if a trip is disputed. See section 4 |
| Wallet and payments | Balance, transactions, top-ups, withdrawals | To move money correctly and keep an accurate ledger |
| Messages | Messages between rider, driver and support. Unlike calls, they are not end-to-end encrypted: see section 9 | To let you communicate during a trip, for safety, and so that a report of abuse or misuse in a conversation can be acted on |
| Calls | Who called whom, when, how long, which trip, and whether it connected. Not the conversation itself | So a call can be tied to the trip it was about, and a dispute or a safety report settled. See section 5 |
| Saved places | Addresses you choose to save | Convenience. You control these |
| Driver documents | Licence, permits and related identity documents, for drivers only | Because we are required to check that a driver may lawfully carry passengers |
| Selfie | One photo of your face, taken in the app with the camera. Required for drivers, optional for riders. Deleted within 30 days | To confirm you are who you say you are. See "Your selfie" below |
| Safety alerts | SOS alerts you raise, and what happened next | Safety, and evidence if something goes wrong |
| Marketplace listings | What you list, and its location while listed | To show your listing to buyers |
| Operational records | Records of administrative actions taken on an account | So that actions affecting you are accountable and reviewable |
We do not sell your personal information, and we do not use it for advertising.
Your selfie, specifically
A photo of your face, taken to confirm who you are, counts as sensitive information under the law in both our markets: special personal information in South Africa, and sensitive personal data in Malawi. So we take it only with your agreement, which you give when you tap Agree and take selfie.
- Drivers need one to be approved. Riders can skip it, and skipping costs a rider nothing.
- It is taken with the camera in the app. A photo from your gallery cannot be used.
- A person on our team checks it (for a driver, against their documents). We do not use face-recognition software.
- We delete the photo within 30 days and keep only the result of the check. The one exception is a legal matter about you that is still open.
- It is never shown to other users, and it is deleted with your account.
4. Location, specifically
Location is the most sensitive thing we hold, so it is set out separately rather than folded into a list.
- We record a location trace during a trip. It exists so a trip can be navigated, so a fare can be checked against distance actually travelled, and so a dispute or safety incident can be reconstructed.
- A location trace with the name removed is still identifying. It shows where a person sleeps and works. We treat it as personal information even after an account is anonymised, and we do not publish or sell it.
- How long we keep a trace, stated plainly: we do not delete trip location traces automatically today. We have decided that we should, and we have not switched automatic deletion on, because deleting on age alone would eventually destroy the evidence for an open safety matter or an unresolved dispute. We are building that check first. We would rather tell you this than publish a retention period that nothing enforces. When automatic deletion is running, this page will say so and will state the period.
5. Calls and the microphone, specifically
You can call your driver, or our support team, from inside the app. Calling is set out separately for the same reason location is: it uses a capability of your phone, and what we keep about a call is not obvious from the fact that you made one.
Your phone number is never part of a call. A call runs between the two apps. We do not give your number to a driver, we do not give a driver's number to you, and we do not use masked or temporary numbers either — there is no telephone number anywhere in the design. So a driver cannot keep your number after the trip, because they were never given it.
When we ask for the microphone: at the moment you place or accept a call, and not before. Not when you install the app, not when you sign up, and not when a trip starts. If you refuse, you cannot make or take calls, and everything else keeps working — including messaging.
A driver can only call you while your trip is live — from the moment a driver is assigned until the trip ends or is cancelled. Not before a driver is assigned, and not afterwards.
We do not record calls between riders and drivers. That is a property of how it is built, not a setting you could switch. The audio is encrypted between the two handsets, and recording it would mean putting a server of ours in the middle that could decrypt it. We have deliberately not built one, and there is nowhere in our systems for such a recording to be kept — no such store was ever created. Every change we make is checked automatically for this, and the check fails if anything is added that could record a call between a rider and a driver.
Some calls cannot connect directly between the two phones, because of the way some mobile networks are built. Those calls pass through a relay server of ours in South Africa. The relay cannot decrypt the call, so it cannot hear or record it. It does see which accounts are connected, their internet addresses, and when and for how long. It keeps that for a few days, to fix calls that fail, and then deletes it. If you are in Malawi, such a call passes through South Africa — see section 12.
What we cannot promise is what the other person does with their own phone. Anyone on any call can point a second device at it, and no app can prevent that. We are telling you what GetZuga does — not what the other party can be stopped from doing.
Support calls are different, because there we are the other side of the conversation. When in-app support calling begins, a call to our support team will be recorded only if you choose. Before the call connects, the app will ask you, with two equal choices — record this call, or message us instead — and neither is chosen for you. A short spoken reminder will play when the call connects. Choosing to message gets you the same help, without a delay.
How long we keep a recording: 30 days. Longer only if we need it for a complaint, a dispute, or because the law requires it — and then only until that is resolved.
Who can listen to a recording: the person handling your support request; a supervisor checking the quality of our support or looking into a complaint about the call; and our legal team, if there is a dispute or a lawful request. Every time a recording is played, we record who played it and why — and we record it before it plays.
Messaging instead is not a way to have less kept. It avoids a voice recording, but your messages are kept too, for at least as long as a recording would be.
None of this is running yet — today we record no calls at all. When it starts, this page will say so.
What we do keep about every call — including calls that were never answered:
- Who called whom, and which of you started it.
- When it started, when it ended, and how long it lasted.
- Which trip it belonged to, where there was one.
- Whether it connected, went unanswered, or failed — and why it failed, so that a call somebody ignored can be told apart from one our own service broke.
None of that is the conversation. It is the record that a call happened, and it exists so that a dispute about a trip can be settled and so that "did the driver ever call me" has an answer.
A call record outlives a deleted account, with the identity removed, for the same reason section 7 gives for trips: the other person's record of a call is not yours alone to erase.
6. How long we keep things
We keep information for as long as we need it for the purpose it was collected, and longer where a law requires it — for example, financial records, and evidence of a safety incident or an unresolved dispute.
Some records deliberately outlive an account. See section 7.
We are not publishing a table of retention periods, and that is deliberate. A period is only meaningful if something enforces it. Today, deletion happens when you ask us and when the rules in section 7 allow it, rather than on a timer. Where that changes, this page changes with it.
7. Deleting your account — what actually happens
This section is deliberately blunt, because the usual wording would be misleading.
When you delete your account we remove the information that identifies you — your name, phone number, email address, PIN and selfie. We keep some records with your identity removed:
- Trips, because the other person on that trip has their own record of being paid for it, and deleting yours would erase theirs.
- The wallet ledger, because financial records have to reconcile and cannot be rewritten.
- Safety alerts, because evidence of an emergency is not the raiser's alone to erase — the other party and any investigating authority have an interest in it.
- Call records, for the same reason as trips: that a call happened is the other person's record as much as yours. The conversation itself was never kept — see section 5.
So "delete" means you are no longer identifiable in our systems, not that every row is destroyed. We think that is the right balance and we would rather say so plainly than describe it as deletion without qualification.
Deletion can be delayed. If there is an open safety matter, an unresolved dispute, a trip in progress, or money owed on your account, we will tell you that your request is on hold and when it will be reviewed. We will not tell you the details of a matter under investigation. You can still complain to a data-protection authority — see section 10.
How to delete. In the app, under Settings, or by emailing privacy@getzuga.com. If you cannot sign in, email us and we will handle it without requiring you to.
If you hold a positive wallet balance, withdraw it before you delete. A balance is not automatically paid out on deletion.
8. Getting a copy of your information
You can ask us for a copy of the personal information we hold about you and we will provide it.
Today this is handled by a person rather than a self-service download — you ask us at privacy@getzuga.com, and we produce it. We are building the self-service version; until then, ask and we will do it for you.
Your copy excludes other people's information. Where a record involves someone else — a shared conversation, or the other party to a trip — their information is withheld rather than sent to you under a privacy right.
9. Who else sees your information
Service providers who run parts of the service for us, under contract, and who may only use it to provide that service. Ask us at privacy@getzuga.com for the current list and we will send it.
Other users, minimally and only when needed. A driver offered your trip is told nothing about you at all — where it starts, where it goes and what it pays, and nothing about the person. Your first name appears only after a driver has accepted, together with a photo and a rating, and never a full name.
That is deliberate: enough to greet someone and confirm you have the right person, and not enough to find them elsewhere. A driver's own details are disclosed more fully to you, because a driver is a vetted, licensed party operating a commercial service while a rider is a member of the public.
Anyone who can see your phone, while a trip is under way. When you have a trip in progress we put a line about it on your lock screen, and it is shown in full without unlocking. It carries the stage the trip has reached; once a driver is assigned, the driver's name and the vehicle's registration plate; and once the trip starts, where you are going — the destination by name, with an estimate of how long until you get there. It is there so you can tell that a car is coming, and how long is left, without unlocking your phone — which is the whole point of it if you are standing on a street at night.
So anyone who can see your screen can read where you are going. That is the part worth knowing before you decide, and it is not something you could find out for yourself without locking your phone in the middle of a trip. The line goes when the trip ends or is cancelled.
If you would rather it were not there, decline notifications or switch them off for GetZuga. The trip works in exactly the same way without it; you just have to open the app to see what is happening. We do not send you marketing notifications.
Unlike calls, messages are not end-to-end encrypted. That is what makes it possible for us to open a conversation between users at all, so the next paragraph sets out the only reasons we may.
Our own team, and this is the part most privacy notices leave vague. A conversation between you and another user — a driver, or another person on the marketplace — cannot be opened here out of curiosity. It can be opened only by someone responsible for your market, and only where there is a recorded reason: a report from you or from the other person, a safety alert raised on that trip, an open dispute or case about that trip or that conversation, or a legal hold. Every time one is opened we record who opened it, which reason allowed it, and how many messages were shown — and that record is written before the messages are.
A conversation with our support team is different, because we are the other side of it. You wrote to us, so we read it: that is the service you asked for. Those reads are recorded too.
Authorities, where we are legally required to, or to prevent serious harm. We check that a request is lawful and properly issued before we act on it, we give only what is asked for, and we tell you unless we are prohibited from doing so. Ask us at privacy@getzuga.com for our full approach.
10. Your rights
Depending on where you are, you have rights to ask for a copy of your information, to have it corrected, to have it deleted, and to object to some uses.
Contact us at privacy@getzuga.com and we will action it.
If you are not satisfied with how we have handled your request, you have the right to complain to a data-protection authority.
| Where you are | Authority | How to reach them |
|---|---|---|
| South Africa | Information Regulator (South Africa) | POPIAComplaints@inforegulator.org.za · inforegulator.org.za/complaints |
| Malawi | Malawi Data Protection Authority | dpa.mw/lodge-a-complaint · info@dpa.mw |
If your country is not in that table, contact us and we will tell you which authority applies and how to reach it. We would rather do that than name the wrong one.
You can complain to an authority without asking us first.
11. Age
The service is intended for adults. We do not currently verify anyone's age when they register, and we would rather tell you that than state a minimum we do not check.
Registration asks for a name, a phone number, a PIN and a country. It does not ask for a date of birth, and nothing in the service refuses an account on the basis of age.
For drivers there is more, and it depends on the country. A driver submits a government identity document. Where the identity number itself encodes a date of birth — as a South African identity number does — we hold that date. Where it does not, such as a Malawian national identity number or any passport, we hold no date of birth for that driver either. Driving also requires a licence, and carrying passengers requires a permit; both carry age requirements set by the authority that issues them rather than by us.
We do not knowingly collect information from children. If you believe a child has given us information, tell us at privacy@getzuga.com and we will remove it.
12. Where your information is processed, and what protects it there
Our applications, our file storage and our database all run in Microsoft Azure's South Africa North region. Our email and office systems run in Microsoft 365 in the region Microsoft assigns to a South African tenant.
So if you are in Malawi, your information is processed in South Africa. Two things protect it there, and we would rather name them than ask you to assume them.
South Africa has a data protection law — the Protection of Personal Information Act — which sets conditions for lawful processing comparable to Malawi's own, and an authority that enforces it.
And the two GetZuga companies are bound to each other by a written agreement, which requires the South African company to process Malawian users' information only on the Malawian company's instructions, to keep it secure, to tell the Malawian company promptly if anyone reaches it who should not have, and not to pass it to anyone in a further country except on terms at least as protective as these.
If you are in South Africa and something of yours is reached from Malawi, the same holds the other way round. Malawi has a data protection law — the Data Protection Act, 2024 — and the same written agreement binds the Malawian company in the same terms, including on passing information onward.
Some of the providers we rely on operate globally, so a map request, a sign-in check or a message we send you may be processed in a country neither of us picked — the provider decides where. Each is engaged under contract and may use your information only to provide the service to us.
What we cannot do is tell you in advance which country a particular request lands in, and we would rather say so than imply a precision we do not have. Ask us at privacy@getzuga.com for the current list of those providers and what each one handles.
13. Changes
We will update this page when the service changes, and the date at the top will change with it.
We do not currently send a notification when this page changes, so the date at the top is how you tell. If we make a change that materially reduces your rights, we will say so prominently on this page rather than let it pass as a routine edit.