Data Protection

Accountability

TaxiD acts as data controller for the personal data of riders, drivers, partners and corporate users of the platform, and as processor where a corporate customer instructs us in relation to its own employees' travel data.

Data protection accountability sits with the Office of the Data Protection Officer, reachable at sales@taxid.app.

Lawful basis

• Performance of a contract: delivering the trip, delivery, rental or charter you requested and billing for it.
• Legal obligation: tax invoicing, transport regulatory requirements and lawful requests from authorities.
• Legitimate interests: safety investigation, fraud prevention and platform integrity, balanced against your rights.
• Consent: device location while the app is in use, and any optional communications.

Retention

We retain personal data only as long as the purpose requires, or as long as the law obliges us to. Financial and tax records are retained for the statutory period. Safety and incident records are retained while the case and any appeal remain open, and for the period required to defend legal claims. Account data is deleted or irreversibly anonymised once no lawful basis remains.

Cross-border transfers

Platform data is processed on managed cloud infrastructure. Where a transfer outside Kenya is necessary — for example to a service provider hosting or supporting the platform — it takes place only under the safeguards required by Kenyan data protection law, supported by contractual protections with the recipient.

Security controls

• Role-based access with row-level authorisation enforced in the platform database, not only in the interface.
• Multi-factor authentication and device registration for administrative and privileged access.
• Audit logging of privileged actions and access to sensitive records.
• Encryption of data in transit, and of credentials and secrets at rest.
• Segregated environments, with production access restricted and reviewed.

Requests, complaints and breach response

Submit a data subject request or complaint to sales@taxid.app. We acknowledge, verify identity, and respond within the statutory period. If you are not satisfied with our response, you may escalate to the Office of the Data Protection Commissioner in Kenya.

If a personal data breach occurs that is likely to affect your rights, we assess it, contain it, notify the regulator within the required timeframe and inform affected people directly.