1. Purpose
This Privacy Policy ("Policy") provides an exhaustive statutory disclosure of the principles, technical practices, legal bases, and administrative safeguards implemented by DRYVE247 LTD ("DRYVE247", "Company", "we", "us", or "our") in collecting, processing, storing, disclosing, and transferring personal data through the DRYVE247 mobility sharing marketplace, mobile applications, website ([www.dryve247.com](https://www.dryve247.com)), and connected vehicle telematics infrastructure. This Policy fulfills the mandatory notification and registration requirements of the Data Protection Act, 2012 (Act 843) of Ghana, while aligning operations with international privacy standards, including the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA).
2. Scope
This Policy applies universally to all natural persons whose personal data is processed by DRYVE247 within or outside the Republic of Ghana, including registered Renters, vehicle Hosts, corporate Fleet Operators, Approved Drivers, Chauffeurs, website visitors, and customer support callers (collectively, "Data Subjects" or "Users").
3. Definitions
All capitalized terms not defined herein shall bear the meanings set forth in Document 1 and Act 843.
"Biometric Data" means personal data resulting from specific technical processing relating to the physical, physiological, or behavioral characteristics of an individual, which allows or confirms the unique identification of that individual, including facial geometry scans, liveness detection measurements, and automated facial recognition match scores.
"Data Controller" means DRYVE247 LTD, which determines the purposes and manner in which personal data is processed under Section 96 of Act 843.
"Data Protection Commission (DPC)" means the regulatory body established under Section 2 of Act 843 charged with protecting personal privacy and ensuring compliance with data protection principles in Ghana.
"Personal Data" means data from which an individual can be identified, directly or indirectly, in particular by reference to an identification number, location data, online identifier, or one or more factors specific to their identity.
"Special Personal Data" means personal data revealing religious beliefs, health data, criminal convictions, or biometric data processed for identification purposes under Section 27 of Act 843.
4. Parties Covered
This Policy binds DRYVE247 LTD (incorporated under the Companies Act, 2019 (Act 992)), its directors, employees, contracted data processors, third-party technology vendors, and every Data Subject interacting with the Platform.
5. Eligibility
The Platform is intended exclusively for individuals aged eighteen (18) years and older (and twenty-one (21) years or older for driving rentals). We do not knowingly collect, process, or solicit personal data from children under the age of eighteen (18) years. If we discover that personal data of a minor has been ingested without verifiable parental/guardian consent, that data will be purged immediately.
6. Rights of Data Subjects
Under Sections 32 through 40 of the Data Protection Act, 2012 (Act 843), you possess specific fundamental statutory rights:
Right of Access (Section 32): You have the right to request confirmation of whether DRYVE247 processes your personal data and to receive a clear copy thereof.
Right to Object to Processing (Section 33): You have the right to object at any time to the processing of your personal data where processing causes unwarranted damage or distress, or for direct marketing purposes.
Right to Rectification and Erasure (Section 34): You have the right to request the correction of inaccurate, misleading, or outdated personal data, or the deletion of data retained unlawfully.
Right Regarding Automated Decision-Making (Section 36): You have the right to require that decisions significantly affecting you (such as automated credit or fraud blocking) are not based solely on automated processing without human intervention.
Right to Complain to the Regulator: You have the right to lodge a formal complaint with the Data Protection Commission (DPC) of Ghana at complaints@dataprotection.org.gh [REGULATORY CONFIRMATION REQUIRED].
7. Core Responsibilities & Privacy Principles
DRYVE247 adheres strictly to the eight (8) quality principles set forth in Section 17 of Act 843:
Accountability: Ensuring governance standards across all data processing lifecycles;
Lawfulness of Processing: Processing personal data strictly on established statutory legal bases;
Specification of Purpose: Collecting personal data for specific, explicitly defined, and legitimate marketplace purposes;
Compatibility of Further Processing: Ensuring data is not processed further in a manner incompatible with its original collection;
Quality of Information: Taking reasonable steps to maintain accurate and complete records;
Openness / Transparency: Providing clear, transparent notice regarding processing methods;
Security Safeguards: Implementing robust physical, electronic, and managerial controls against unauthorized access, destruction, loss, or alteration;
Data Subject Participation: Providing straightforward mechanisms for individuals to enforce their statutory rights.
8. Prohibited Conduct
DRYVE247 prohibits:
Selling, renting, or leasing user personal data or contact details to third-party data brokers;
Processing Special Personal Data (including biometrics) without explicit, separate consent or lawful statutory mandate;
Accessing, altering, or sharing telematics tracking logs by staff members without an authorized ticket for safety, claims, or system maintenance;
Retaining identifiable data beyond the mandatory statutory schedules established in Document 29.
9. Comprehensive Data Inventory Matrix
The following structured matrix details every category of personal data collected, the operational rationale, the statutory legal basis under Act 843 and GDPR, external recipients, and default retention parameters:
Data Category: Identity & Demographic Specific Elements Collected: Full legal name, date of birth, residential address, nationality, gender, emergency contacts Operational Purpose: Account creation, legal capacity verification, fraud prevention, communication Lawful Legal Basis (Act 843 / GDPR): Act 843 § 20(a) (Contract performance) / GDPR Art. 6(1)(b) Authorized Recipients: Customer support, authorized hosts (name only), identity verification vendors Retention Period: Active account life + 6 years following closure (Act 992)
Data Category: Government Credentials Specific Elements Collected: Ghana Card PIN, National Identity Register data, foreign passport, visa/entry stamps, DVLA Driver’s Licence, International Driving Permit (IDP) Operational Purpose: Statutory driver validation, confirming road legal capacity under Act 683, preventing vehicle conversion Lawful Legal Basis (Act 843 / GDPR): Act 843 § 20(c) (Legal obligation) / GDPR Art. 6(1)(c) Authorized Recipients: Authorized identity and licence-verification recipients; an independent insurer only where necessary for a specific incident and supported by a lawful disclosure basis Retention Period: Active account life + 6 years after trip (NRCD 323)
Data Category: Biometric & Facial Data Specific Elements Collected: Live selfie capture, 3D facial geometry landmarks, liveness detection vectors, automated match confidence scores Operational Purpose: Preventing identity impersonation, detecting synthetic identity fraud, stolen ID mitigation Lawful Legal Basis (Act 843 / GDPR): Act 843 § 27 (Explicit consent for Special Personal Data) / GDPR Art. 9(2)(a) Authorized Recipients: Specialized identity verification vendor (AWS Rekognition / Smile ID) Retention Period: Biometric vectors: 30 days post-verification; Source selfie: account lifespan
Data Category: Financial & Billing Specific Elements Collected: Masked payment card PAN, cardholder name, expiry date, mobile money wallet numbers, billing address, transaction tokens Operational Purpose: Processing rental charges, capturing security deposits, processing post-trip fines, disbursing host payouts Lawful Legal Basis (Act 843 / GDPR): Act 843 § 20(a) (Contract performance) / GDPR Art. 6(1)(b) Authorized Recipients: Bank of Ghana-licensed PSPs (Paystack, Hubtel), acquiring banks, accounting auditors Retention Period: 7 years following transaction for GRA tax compliance (Act 896)
Data Category: Vehicle Asset Data Specific Elements Collected: DVLA registration number, VIN, chassis stamp, make, model, year, roadworthiness certificate, insurance policy schedules Operational Purpose: Validating vehicle eligibility under Document 8, verifying ownership under Document 9, confirming road safety Lawful Legal Basis (Act 843 / GDPR): Act 843 § 20(a) (Contract performance) / GDPR Art. 6(1)(b) Authorized Recipients: Authorized renters and permitted verification recipients; issuer confirmation only as needed to verify the Host's independently obtained policy Retention Period: Duration of vehicle listing + 6 years after delisting
Data Category: Telematics & Location Specific Elements Collected: Real-time GPS coordinates, vehicle heading, speed vectors, harsh acceleration/braking forces, ignition states, diagnostic trouble codes (DTCs) Operational Purpose: Asset tracking, geofence border containment (Doc 35), crash detection, mileage verification, emergency recovery Lawful Legal Basis (Act 843 / GDPR): Act 843 § 20(a) (Contract performance) & § 20(e) (Legitimate interest in asset protection) Authorized Recipients: DRYVE247 Security Operations Center (SOC), Hosts (active trip only), Ghana Police Service Retention Period: Raw pings: 90 days; Disputed/accident trips: 6 years for litigation hold
Data Category: Condition Documentation Specific Elements Collected: 360-degree check-in/out photographs, damage close-ups, fuel gauge readings, odometer dashboard photos, digital condition inspection reports Operational Purpose: Objective evidentiary baseline for adjudicating post-trip damage and fuel claims (Doc 11, Doc 12) Lawful Legal Basis (Act 843 / GDPR): Act 843 § 20(a) (Contract performance) / GDPR Art. 6(1)(f) Authorized Recipients: Relevant Host or Renter and authorized assessors; an independent insurer or legal adviser only for a specific lawful disclosure under Document 64 Retention Period: 6 years for contractual dispute limitation (Act 25)
Data Category: In-App Comms & Support Specific Elements Collected: In-app messaging logs, recorded customer support telephone audio, dispute tickets, safety incident notes Operational Purpose: Quality assurance, resolving disputes, preventing platform circumvention, detecting harassment Lawful Legal Basis (Act 843 / GDPR): Act 843 § 20(a) (Contract performance) & § 20(b) (Legal claims defense) Authorized Recipients: Dispute Review Panel, internal Trust & Safety, legal counsel Retention Period: Audio records: 12 months; Written logs: 3 years following trip resolution
Data Category: Technical & Device Logs Specific Elements Collected: IP address, browser user-agent, mobile device hardware model, operating system version, push notification tokens, session cookies Operational Purpose: Cybersecurity monitoring, detecting brute-force intrusions, validating electronic signature validity Lawful Legal Basis (Act 843 / GDPR): Cybersecurity Act (Act 1038) / GDPR Art. 6(1)(f) (Legitimate interest in network security) Authorized Recipients: Cloud hosting providers (AWS), Cyber Security Authority (CSA) upon lawful order Retention Period: 12 months rolling retention in security log pipelines
10. Evidence and Documentation Requirements
Users exercising privacy rights or requesting access must submit a formal verification request accompanied by a certified copy of their Ghana Card or international passport to verify data subject identity prior to disclosure.
11. Payments and Financial Consequences
Exercising data subject rights under Act 843 is free of charge. However, DRYVE247 reserves the statutory right under Section 32 of Act 843 to charge a reasonable administrative fee of GH₵ 100 / USD $10 or decline to act where requests are manifestly unfounded, repetitive, or excessive.
12 Independent Insurance Responsibilities
Incident Records: Retain accident and damage records only for an applicable lawful purpose and documented retention period under Document 29, including a specific legal hold where required. DRYVE247 is not an insurer and does not impose blanket retention merely to administer user insurance claims.
13. International Data Transfers
Personal data collected in Ghana is stored securely within cloud data centers located in Europe (e.g., AWS Region eu-central-1 / Frankfurt) and South Africa. All cross-border data transfers comply strictly with Section 47 of Act 843 and the Cross-Border Data Transfer Notice (Document 31), utilizing robust encryption and Standard Contractual Clauses (SCCs).
14. Safety and Security Obligations
DRYVE247 deploys enterprise-grade security controls, including AES-256 data encryption at rest, TLS 1.3 encryption in transit, strict Role-Based Access Control (RBAC), multi-factor authentication for administrative access, and regular vulnerability scanning, in compliance with the Cybersecurity Act, 2020 (Act 1038).
15. Reporting of Data Breaches
In the event of a personal data breach posing a risk to the rights and freedoms of Data Subjects, DRYVE247 shall notify the Data Protection Commission (DPC) of Ghana and affected Users within seventy-two (72) hours of becoming aware of the breach, pursuant to Section 31 of Act 843 and Document 79.
16. Disputes and Regulatory Complaints
Any dispute regarding data processing practices shall be submitted first to the DRYVE247 Data Protection Officer. If unresolved within thirty (30) days, the Data Subject may lodge a formal complaint with the Data Protection Commission of Ghana under Section 75 of Act 843 or pursue judicial remedies before the High Court of Ghana.
17. Enforcement
Adherence to this Policy is enforced by the DRYVE247 Data Protection Officer, internal compliance audits, and third-party penetration testing.
18. Account Suspension and Erasure Limitations
Closing or deleting a DRYVE247 account does not result in the instantaneous destruction of all data. Regulatory compliance, tax records, telematics dispute holds, and anti-fraud profiles must be retained for the mandatory statutory periods defined in Document 29.
19. Applicable Law
This Policy is governed by the laws of the Republic of Ghana, specifically Article 18(2) of the 1992 Constitution, the Data Protection Act, 2012 (Act 843), the Cybersecurity Act, 2020 (Act 1038), and the Electronic Transactions Act, 2008 (Act 772).
20. International Users
International users residing in the European Union, United Kingdom, or United States are entitled to the supplementary protections and disclosures set forth in the Governing Law and International Users Addendum (Document 60).
21. Amendments
DRYVE247 may update this Policy periodically. Material modifications will be notified via email, SMS, or in-app push notification at least fourteen (14) days prior to taking effect.
22. Severability
If any provision of this Policy is found invalid by a court or regulator, the remaining provisions shall remain fully operative.
23. Contact Information
Data Protection Officer (DPO)
DRYVE247 LTD
DPC Registration Number: [TO BE CONFIRMED BEFORE PUBLICATION]
Address: [TO BE CONFIRMED BEFORE PUBLICATION, Accra, Ghana]
Official Privacy Email: dpo@dryve247.com
Telephone: [TO BE CONFIRMED BEFORE PUBLICATION]