Privacy notice

Who is responsible

Umurabyo Smart Delivery, Kigali, Rwanda, operates this platform. For your company’s own records — your customers, your drivers — your company decides what is collected and why, and we process it on your instructions. For your account itself, and for the platform’s security and billing, we decide, and this notice covers that.

What we collect

From the people who use the portal

• Name, email address, phone number, and the company and role you belong to.
• A password, stored only as an irreversible hash, and your two-factor secret if you enrol one.
• Sign-in records: when, from which address, and which device label you gave — kept so that you and we can both see unexpected access.

From drivers

• Identity and licence details your company records, and the documents it uploads to support them.
• Position, while on duty. The app reports location when a driver has gone on duty, and stops when they go off duty. It is not collected when the driver is off duty, and the app says which state it is in.
• Which deliveries were offered, accepted, and how each one ended.

From customers of a delivery

• Name and phone number of the sender and recipient, and the two addresses.
• Proof of delivery: the PIN that was verified, or the photo taken at the door, with the time and the position it was taken at.

From fitted GPS devices

Position, speed and heading of the vehicle, with the device’s identifier. This is data about a vehicle, but while a known driver is assigned to it, it is data about a person too, and we treat it that way.

Why we need it

To run a delivery

Addresses, phone numbers and position are what makes dispatch, tracking and handover possible at all. Without them there is no service.

To keep the platform secure

Sign-in records, audit entries and rate-limit counters exist to detect and investigate misuse — including misuse of your company’s account by someone inside it.

To bill

Usage counts against your plan, and the invoices that follow.

To meet obligations

Accounting records, and responses to a lawful request from an authority with the standing to make it.

Who can see it

• Your company sees its own deliveries, drivers and vehicles — and only its own. Separation is enforced in the database, not only in the screens; see Security.
• A customer tracking a parcel sees the assigned driver’s name, vehicle and current position for the duration of that delivery, and nothing after it ends.
• Our platform staff can see that your company exists, its registration documents, its subscription and its devices. They cannot browse your delivery history, and every administrative action they take is recorded in a sealed audit log.
• Service providers — hosting, email and SMS delivery, map tiles, payments — process only what their function requires.

We do not sell personal data, and we do not use it to train models.

Where it is kept

On servers we control, with encrypted backups. Some providers we rely on operate outside Rwanda; where that is so, the transfer is limited to what the provider’s function needs. The reviewed version of this notice will list the providers and the countries by name.

How long we keep it

Retention is set per kind of record rather than as one blanket period, with a floor below which nothing is deleted early:

• Delivery records and proof of delivery — kept while they may be disputed, then deleted.
• Position history — the full track is kept for a limited window and then reduced to the summary a delivery record needs. A driver’s minute-by-minute movement is not kept indefinitely.
• Audit and security records — kept longer, because their value is in being there when an old question is asked.
• Invoices and accounting records — kept for the period the law requires.

When an account closes we keep what the above requires and delete the rest. The exact periods are part of what the review will settle.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct it, to delete it where we have no remaining obligation to keep it, or to object to a particular use. If the data belongs to your company’s records, ask your company first — it is their system to administer and they can act faster than we can.

A driver who wants to know what was recorded about their duty hours and movements is entitled to ask, and we will answer directly if their company does not.

Children

The platform is for businesses and their customers. We do not knowingly collect data about children, and a driver account requires a valid licence.

Changes

We will date every version and notify account owners of material changes before they take effect.

Asking us something

Through the contact page. If you are not satisfied with how we handle a request, you can complain to Rwanda’s data protection authority.