Privacy Policy

Introduction & who we are

This Privacy Policy explains how QuickLyft Ghana Ltd. ("QuickLyft", "we", "us", "our") collects, uses, shares and protects personal data when you use our website at quicklyft.app, our iOS and Android applications, and any related services (together, the "Platform").

QuickLyft is the data controller for personal data processed through the Platform. We are committed to handling your data in line with Ghana's Data Protection Act, 2012 (Act 843).

Our details

• Registered name: QuickLyft Ghana Ltd.
• Registered office: Accra, Ghana — [INSERT FULL REGISTERED ADDRESS BEFORE LAUNCH]
• Company registration number: [INSERT RGD NUMBER BEFORE LAUNCH]
• Data Protection Commission registration: [INSERT DPC REGISTRATION NUMBER BEFORE LAUNCH]
• Data Protection Officer: privacy@quicklyft.app

If anything in this policy is unclear, email our DPO at privacy@quicklyft.app — we reply within 24 hours.

Data we collect

The data we hold depends on whether you are a waitlist visitor, a rider, or a partner driver. The categories below cover the Platform once apps are live; today's pre-launch waitlist captures the smaller subset noted in section 2.1.

2.1 Waitlist data (today)

When you join the waitlist via the homepage, Ride, Drive or Waitlist pages, we collect:

• Name (first and last)
• Email address
• Phone number (Ghana format)
• Administrative region and city or town
• Role (rider or driver) and, for drivers, commute route, vehicle make/model and preferred departure window
• Date and time of signup, plus a page source tag (so we know which form you used)

2.2 Rider data (from launch)

2.3 Driver data (from launch)

We do not knowingly collect any data we don't need to run the Platform. If you can use a feature without giving us a piece of data, we won't ask for it.

How we use your data & lawful basis

Every use we put your data to is tied to a lawful basis under Act 843.

We do not sell your personal data. We do not use your data to train third-party AI models. We do not share your trip history with advertisers.

Who we share data with

We share the minimum amount of personal data needed for each of the following parties to do the job we ask them to do.

We require every processor we use to handle your data with at least the same standard of care set out in this policy.

International transfers

Some of the systems that run the Platform — in particular Google Cloud Firestore, Firebase, Google Maps and Google Analytics — store and process data on servers outside Ghana, including in the European Union and the United States.

We rely on these providers' contractual safeguards (including Google's Standard Contractual Clauses) to protect your data when it leaves Ghana, in line with section 47 of the Data Protection Act, 2012 (Act 843).

By using the Platform you acknowledge that your data may be transferred to and processed in those countries for the purposes set out in section 3.

How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it, plus any period required by Ghanaian law.

You can ask us to delete your data sooner — see section 7.

Your rights under Ghana law

Under sections 35 to 43 of the Data Protection Act, 2012 (Act 843), you have the following rights over your personal data. We respond to every request within 30 days.

• Right of access — ask for a copy of the personal data we hold about you.
• Right to rectification — ask us to correct data that is inaccurate or out of date.
• Right to erasure — ask us to delete your data, subject to records we are legally required to keep (for example, tax records).
• Right to object — object to processing based on our legitimate interest, including profiling.
• Right to portability — receive a machine-readable copy of the data you provided to us.
• Right to withdraw consent — where we rely on consent (for example, marketing), withdraw it at any time without affecting past lawful processing.
• Right to lodge a complaint — complain to Ghana's Data Protection Commission if you believe we have not handled your data lawfully (see section 13).

To exercise any of these rights, email privacy@quicklyft.app. We may need to verify your identity before we act, to protect your data from impersonation.

Security & breach notification

We take security seriously. Our measures include:

• Encryption in transit (HTTPS/TLS) for all traffic between your device and our servers.
• Encryption at rest for production databases.
• Strict role-based access controls; only authorised QuickLyft staff can access production data, and access is logged.
• Multi-factor authentication on all administrative accounts.
• Regular security reviews and dependency patching.
• Separation of payment data — we do not store full card details; MoMo transactions are processed by the licensed mobile money operators.

Cookies & analytics

Our website uses a small number of cookies and similar technologies to keep the site working and to understand how visitors use it.

What we use

• Strictly necessary cookies — remember your launch-banner preferences and keep your session secure. The site does not work properly without these.
• Analytics cookies — Google Analytics (measurement ID G-73Q6TVSH9C) records page views, button clicks, and basic device and country information so we can see which corridors and pages people care about. IP addresses are anonymised.

How to control them

You can block or delete cookies through your browser settings. You can opt out of Google Analytics on any site using Google's opt-out browser add-on. Once we add a cookie banner you will also be able to control non-essential cookies directly from this site.

Marketing communications

We send two kinds of message:

• Service messages (booking confirmations, payout receipts, security alerts, driver no-show notifications, refund updates) — you cannot opt out of these while you have an active account, because they are needed to operate your bookings.
• Marketing messages (new corridor launches, founding-member promotions, product news) — you can opt out at any time.

Marketing emails include an unsubscribe link. Marketing SMS and WhatsApp messages include a STOP keyword. You can also email privacy@quicklyft.app to opt out of all marketing channels at once.

This is in line with the Electronic Communications Act, 2008 (Act 775).

Children

The Platform is not intended for anyone under 18. We do not knowingly collect personal data from children. If we find that we have collected data from a child, we will delete it without delay. If you believe a child has provided us with data, contact privacy@quicklyft.app.

Changes to this policy

We may update this policy as the Platform changes. The "Last updated" date at the top of the page always reflects the current version.

For material changes — for example, a new category of data or a new processor — we will notify registered users by email or in-app message at least 14 days before the new policy takes effect.

Contact & complaints

For any privacy question, request, or complaint:

• Email our DPO: privacy@quicklyft.app — we reply within 24 hours, and resolve formal data-subject requests within 30 days.
• General support: hello@quicklyft.app
• Postal address: QuickLyft Ghana Ltd., Accra, Ghana — [INSERT FULL REGISTERED ADDRESS BEFORE LAUNCH]

If you are not satisfied with our response, you can complain to Ghana's Data Protection Commission:

• Web: dataprotection.org.gh
• Phone: +233 (0) 302 222 929