Last updated: 15 July 2026
1. Who we are
Changa Smart Commute ("Changa", "we") is the data controller for personal data processed through www.changa.ke and the Changa mobile app. We are registered in Kenya and comply with the Data Protection Act, 2019.
2. Data we collect
- Account data: name, phone number, email, National ID number (for verification), profile photo.
- Driver data: driving licence, vehicle registration, insurance certificate, NTSA/PSV details.
- Trip data: pickup and drop-off points, GPS location during active trips, ratings and messages.
- Payment data: M-Pesa phone number, transaction references, wallet balance. Card PANs are never stored by Changa.
- Device data: IP address, device type, browser, cookies and analytics events.
3. How we use your data
- To create and verify your account, and match Riders with Drivers.
- To process payments, wallet top-ups and withdrawals.
- To enrol verified users in Birdview Personal Accident insurance during trips.
- To operate safety features — panic alerts, trip trails, OTP handovers for cargo.
- To detect fraud, enforce our Terms and comply with Kenyan law (KRA, DCI, NTSA requests where legally required).
- To send you transactional emails and, with your consent, product updates.
4. Legal basis
We rely on: (a) performance of the contract to provide you rides, wallet and cargo services; (b) your consent for marketing communications and precise location outside active trips; (c) legal obligations under Kenyan tax, transport and anti-money-laundering law; and (d) legitimate interests in fraud prevention and product improvement.
5. Sharing your data
We share data only where necessary:
- With the counterparty on a trip (Rider ↔ Driver: name, rating, vehicle, live location).
- With Safaricom M-Pesa and KCB Buni for payments.
- With Birdview Microinsurance for insurance enrolment and claims.
- With our cloud hosting and email providers under strict data-processing terms.
- With Kenyan authorities where lawfully compelled.
We do not sell your personal data.
6. International transfers
Some processors (hosting, analytics) may process data outside Kenya. We only use providers offering equivalent protection to the Data Protection Act, 2019 through contractual safeguards.
7. Retention
We keep trip, payment and safety records for at least 7 years to comply with Kenyan tax and insurance requirements. Marketing preferences are kept until you unsubscribe. Verification documents are deleted 90 days after your account is closed unless retention is required by law.
8. Your rights
Under the Data Protection Act, 2019 you have the right to access, correct, delete, restrict or object to processing of your personal data, and to data portability. Email info@changa.ke to exercise any right. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC).
9. Cookies
We use strictly necessary cookies to keep you signed in and, with your consent, analytics cookies to understand how the Platform is used. You can clear or block cookies in your browser at any time.
10. Children
Changa is not directed at anyone under 18. We do not knowingly collect data from children.
11. Security
We use TLS in transit, encryption at rest, role-based access controls and row-level security on our database. No system is 100% secure — report suspected incidents to info@changa.ke.
12. Changes
We will notify material changes to this Policy in-app or by email at least 14 days before they take effect.
13. Contact
Data Protection Officer, Changa Smart Commute — info@changa.ke · WhatsApp +254 790 624 208 · Nairobi, Kenya.