Privacy Policy

1. Scope and who we are

This Privacy Policy applies to the VroomGo website, passenger mobile application, operator dashboards, driver and crew tools, agent, cashier and controller workspaces, platform-administration services, customer support and related communications.

VroomGo operates a mobility technology platform connecting passengers with independent transport and car-hire operators. Depending on the activity, VroomGo may determine why and how personal data is processed, process data jointly with an operator, or process operational data on an operator’s instructions. Operators remain responsible for data they collect independently or use outside VroomGo.

The platform operator is VroomGo, Kampala, Uganda. Privacy enquiries and rights requests may be sent to support@vroomgo.co or made through the in-app support centre. Telephone: +256 782 246 798.

2. Personal data we collect

We collect only data reasonably required to provide, secure and improve the relevant service. This may include:

• Account data: name, email address, telephone number, password authentication records, preferred language, profile image and account category.
• Identity and eligibility data: nationality, date of birth, masked National ID or passport details, document issue and expiry information, verification status, driver’s licence and operator staff credentials where required.
• Passenger and traveler data: passenger names, passenger type, accessibility needs, seat choices, pickup and drop-off points, saved travelers and emergency contacts.
• Booking and rental data: routes, dates, trip and vehicle selections, booking references, rental locations, driver option, booking status, requests, cancellations, refunds and operator notes.
• Cargo and recipient data: sender and recipient names and telephone numbers, pickup and delivery addresses, pickup windows, goods descriptions, categories, quantities, weight, dimensions, volume, declared value, handling requirements and prohibited-goods declarations.
• Cargo evidence and custody data: operator quotes, vehicle capacity checks, delivery estimates, shipment status, branch and driver handovers, timestamps, delivery attempts, hashed delivery codes, signatures, photographs, location events and loss, damage, shortage or delay claims.
• Luggage data: type, description, quantity, weight, dimensions, declared special items, fees and approval status.
• Payment data: method, provider, amount, currency, masked mobile-money or card information, reusable provider token where supported, transaction reference, payment events, refund and dispute status. VroomGo does not intentionally store full card numbers, card security codes, Mobile Money PINs or one-time passwords.
• Location and safety data: vehicle coordinates, speed, heading, accuracy, journey location-sharing preferences, SOS or incident location, safety reports and timestamps.
• Operator data: company identity, registration and tax information, licences, insurance, branches, fleet, schedules, staff memberships, role permissions, compliance records and financial settlement information.
• Communications: support tickets, feedback, complaints, ratings, notification preferences and messages sent through VroomGo.
• Technical and security data: IP address, device and browser information, session records, timestamps, diagnostics, audit events, failed login or payment attempts and cookie or local-storage identifiers.

3. Where data comes from

We receive information directly from you, from a person booking for another traveler, from participating operators and their authorized staff, from payment and identity-verification providers, and automatically from devices used to access the service.

If you provide another person’s details—for example a saved traveler or emergency contact—you must have authority to do so and should tell that person how VroomGo will use the information.

4. Why we process personal data

• Create and authenticate accounts and route each person to the correct workspace.
• Search services, reserve inventory, prevent double booking, calculate fares and luggage charges, issue tickets and manage boarding.
• Create, review and administer car-rental requests, deposits, availability and collection or return workflows.
• Request and compare cargo quotations, reserve payload and volume, coordinate collection and delivery, maintain chain-of-custody evidence, verify delivery and administer claims.
• Initiate payments, verify provider responses, reconcile transactions and administer refunds, commissions, settlements and disputes.
• Verify passengers, operators, drivers, agents and staff where identity or eligibility checks are required.
• Provide notifications, journey updates, support, safety assistance, lost-and-found and complaint handling.
• Provide live vehicle tracking where an authorized crew member shares location and a passenger has an eligible journey.
• Detect fraud, abuse, security incidents, unauthorized access and violations of platform rules.
• Maintain audit, accounting, tax, regulatory, insurance and legal records.
• Measure reliability and improve platform performance, accessibility, routing and demand planning.
• Send marketing only where permitted and consistent with your preferences. Operational booking and security messages are not marketing.

5. Legal grounds

Depending on the processing and applicable law, we rely on one or more of the following grounds:

• Performance of a contract or steps requested before entering a contract, including account, booking, payment, ticket and rental workflows.
• Compliance with legal and regulatory obligations, including accounting, tax, transport, safety, anti-fraud and lawful disclosure duties.
• Consent, including optional marketing, certain location sharing and other choices clearly presented as optional. Consent may be withdrawn prospectively.
• Legitimate operational and security interests, balanced against the rights of affected people, including platform security, audit, fraud prevention, service improvement and dispute handling.
• Protection of vital interests or emergency response where necessary to address a serious safety concern.

6. Who receives personal data

We do not sell personal data. We share only what is reasonably required for the relevant purpose.

• The selected transport or car-hire operator, including authorized booking, dispatch, driver, conductor, cashier, controller and customer-care staff.
• Cargo operators and authorized dispatch, branch, warehouse, driver, claims and delivery personnel. Recipient contact and shipment details are disclosed only as needed to collect, transport and deliver the goods.
• Payment providers, banks, Mobile Money operators and card processors needed to initiate, verify, reconcile or refund a payment.
• Identity, fraud-prevention, communications, mapping, hosting, storage, monitoring and customer-support service providers working under appropriate obligations.
• Emergency services, insurers, regulators, courts, law-enforcement authorities or other recipients where disclosure is legally required or reasonably necessary for safety, legal claims or fraud prevention.
• A successor or transaction adviser in connection with a proposed merger, financing, restructuring or transfer, subject to confidentiality and lawful processing requirements.

Passenger manifests expose only the information authorized for legitimate trip operation and safety. Operators must not reuse passenger data for unrelated marketing or unauthorized purposes.

7. International processing

Some infrastructure, communications, mapping or payment providers may process information outside Uganda. Where personal data is transferred internationally, VroomGo uses measures required by applicable law, such as contractual safeguards, access restrictions, transfer assessments or consent where appropriate.

You may contact us for information about the safeguards relevant to your data.

8. Retention

We keep personal data only while it is reasonably needed for the purposes described above, an active account or transaction, a dispute, fraud prevention, safety investigation, or a legal, tax, audit, insurance or regulatory obligation.

Booking, shipment, quotation, payment, refund, settlement, delivery-proof and material audit records may be retained for up to seven years after the transaction or longer where a dispute or law requires it. Active account and profile data is generally retained while the account remains open. Support and complaint records are normally retained for up to three years after closure. Routine security logs and precise journey or cargo-location records are normally retained for up to twelve months unless connected to an incident, claim, dispute or legal obligation.

Identity records are limited, masked where practical and retained only while verification or a legal requirement makes them necessary. Provider tokens may remain until you remove the saved method, the token expires, or the provider reports that it is invalid.

Deletion requests do not require removal of records VroomGo must retain for lawful financial, security, safety or dispute purposes. When retention ends, information is deleted, anonymized or securely isolated.

9. Your choices and rights

You can manage many preferences in your profile. For other requests, contact support@vroomgo.co. We may verify your identity before acting, and may decline or limit a request where the law permits. We will explain the reason where appropriate.

• Ask whether we process your personal data and request access to it.
• Ask us to correct inaccurate or incomplete information.
• Request deletion or restriction where legally available.
• Object to processing based on legitimate interests and opt out of direct marketing.
• Withdraw consent without affecting processing that occurred before withdrawal.
• Request a portable copy where applicable and technically feasible.
• Ask for information about significant automated processing and request human review where a decision produces a material effect.
• Complain to VroomGo or Uganda’s Personal Data Protection Office.

10. Analytics and automated tools

VroomGo may use rules or analytical models for availability, occupancy prediction, demand forecasting, fraud signals, route optimization and dynamic pricing support. Material prices and booking conditions are displayed before you submit a transaction. Operators remain responsible for lawful pricing decisions made in their workspace.

We do not use solely automated processing to make a legal or similarly significant decision about you without an appropriate lawful basis, safeguards and a way to request review where required.

11. Cookies and device storage

VroomGo uses essential cookies or device storage for authentication, security, workspace selection, preferences and core functionality. Optional analytics or marketing technologies should operate only where permitted and according to the choice shown in the cookie interface.

Blocking essential storage may prevent sign-in, payment continuation or other secured features. Browser and device controls can remove stored information, although doing so may sign you out.

12. Security and incidents

VroomGo uses role-based authorization, tenant isolation, database row-level security, restricted service credentials, audit records, provider-side payment verification and technical monitoring appropriate to the service. No system can guarantee absolute security.

Keep passwords and verification codes confidential. VroomGo staff and operators should never ask for your Mobile Money PIN, card security code or one-time password.

Where a personal-data breach creates a notification obligation, VroomGo will notify the appropriate authority and affected people in accordance with applicable law.

13. Children and other travelers

A person creating an account must have legal capacity to accept the applicable terms. An adult may book for a child or dependent traveler and is responsible for providing accurate details and any required consent. Car-hire drivers must meet the operator’s age, licence and eligibility requirements.

If you believe a child’s information was submitted without proper authority, contact us promptly.

14. Changes and contact

We may update this policy when services, providers or legal requirements change. Material changes will be communicated through the platform, email or another appropriate channel before they take effect where required.

Effective date: 27 July 2026. Last updated: 27 July 2026.

Privacy contact: support@vroomgo.co · +256 782 246 798 · Kampala, Uganda. You may also contact Uganda’s Personal Data Protection Office through its official complaint channels.