Privacy Policy

Deleco — a product of Orvvan
Effective date: May 1, 2023
Last updated: May 1, 2023

1. Introduction

This Privacy Policy explains how Orvvan ("Orvvan," "we," "us," or "our"), the parent company of Deleco, collects, uses, discloses, and protects information when you use:

• The Deleco customer mobile application (delivery and ride-hailing requests);
• The Deleco Rider mobile application (for independent riders fulfilling deliveries and rides);
• The Deleco Business web dashboard (for merchants and businesses placing delivery orders); and
• Any related websites, APIs, or services we operate that link to this Policy

(together, the "Services").

By creating an account, registering as a rider, placing an order, or otherwise using the Services, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Services.

This Policy is written to comply with Ghana's Data Protection Act, 2012 (Act 843) and reflects generally accepted international data protection principles. If you are located outside Ghana, additional local laws may also apply to you.

2. Who This Policy Applies To

This Policy applies to three categories of users, and certain sections apply only to specific categories:

User type	Applies to
Customers	Anyone who creates an account on the Deleco app to request deliveries or rides
Riders	Anyone who registers as a rider/driver on the Deleco Rider app to fulfil delivery and ride requests
Businesses	Any business or merchant that registers on the Deleco Business dashboard to place delivery orders on behalf of itself or its customers

Where a section applies only to one group, it is labeled accordingly.

3. Information We Collect

3.1 Information you provide directly

All users

• Phone number — required to create an account and used for one-time password (OTP) verification via SMS.
• Name and profile information — full name, and for business accounts, business name, trading name, industry/category, and contact details.
• Email address — for business accounts (login) and, where provided, for customers and riders (e.g., payment receipts).
• Photograph/profile picture — optional, if you choose to add one.

Riders only

• Identity documents — a valid Ghana Card or other accepted government-issued identification, submitted during registration.
• Driver's license (where applicable to the vehicle type).
• Vehicle information and photographs — vehicle type, registration details, and photographs of the vehicle.
• Selfie/verification photograph — to confirm the identity documents match the registering individual.
• Bank/Mobile Money payout details — collected to process weekly earnings payouts (processed through our payment partner, Paystack; see Section 5).

Customers and Businesses

• Delivery and pickup addresses, recipient names and phone numbers, and delivery instructions/notes you enter for each order.
• Payment information — processed directly by our payment partner, Paystack. We do not collect or store your full card or Mobile Money credentials; see Section 5.

All users

• Communications — messages sent through the in-app chat feature between a matched customer and rider, and any communications with our customer support.

3.2 Information collected automatically

• Precise and approximate location data — collected from your device (with your permission) to: find nearby riders, calculate routes and fares, display live tracking during an active order, and (for riders) determine availability and proximity to delivery requests. Riders' location is shared with the customer during an active delivery/ride; customers' pickup/drop-off locations are shared with the matched rider.
• Device and technical information — device model, operating system and version, unique device identifiers, IP address, mobile network information, app version, and crash/error diagnostic data.
• Usage data — how you interact with the Services, screens viewed, features used, and timestamps of activity, collected through analytics tools.
• Push notification tokens — used to deliver order updates, chat messages, and other alerts to your device.

3.3 Information from third parties

• Payment confirmation data from Paystack (e.g., whether a transaction succeeded, transaction reference), but not your full payment credentials.
• Mapping and address data from Google Maps/Places services, used to convert addresses you enter into map coordinates and routes.

4. How We Use Your Information

We use the information we collect to:

1. Create and manage your account, and verify your identity via OTP.
2. Match customers with available riders, calculate routes, distances, and fares.
3. Facilitate and track deliveries and rides in real time.
4. Process payments and rider payouts through Paystack.
5. Enable in-app communication (chat) between a matched customer and rider for the duration of an order.
6. Send order-related notifications (e.g., rider matched, arriving, delivered) and, where you have not opted out, service updates.
7. Verify rider identity, documents, and vehicle eligibility before approving a rider account.
8. Detect, investigate, and prevent fraud, abuse, and violations of our terms.
9. Analyze usage of the Services to fix bugs, improve performance, and develop new features.
10. Comply with legal obligations, including tax, accounting, and regulatory record-keeping requirements applicable in Ghana.
11. Respond to customer support requests and communicate with you about your account.

We do not sell your personal information to third parties.

5. How We Share Your Information

We share information only as necessary to operate the Services:

• Between matched customers and riders: When a rider accepts an order, we share the customer's name, delivery/pickup address, and phone number with the rider, and the rider's name, phone number, live location, and vehicle details with the customer. This sharing is limited to the duration necessary to complete the order.
• Payment processing: Payment and payout details are shared with Paystack, our licensed third-party payment processor, to process Mobile Money and card transactions. Paystack's own privacy policy governs its handling of your payment data.
• Infrastructure and service providers: We use Google Firebase (authentication, database, cloud functions, storage, analytics, crash reporting, and push notifications) and Google Maps Platform (mapping, address autocomplete, and route calculation) to operate the Services. These providers process data on our behalf under their own data processing terms.
• Legal and safety reasons: We may disclose information if required by law, legal process, or governmental request, or where we believe disclosure is necessary to protect the safety of our users, the public, or Orvvan.
• Business transfers: If Orvvan is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy or a policy at least as protective.

We do not share rider identity documents (e.g., Ghana Card, driver's license) with customers or other users. These are used solely for our internal verification process.

6. Data Retention

We retain personal information for as long as your account is active and as necessary to provide the Services. After account closure, we may retain certain information:

• Transaction and order records — retained for accounting, tax, and dispute-resolution purposes, consistent with applicable legal requirements in Ghana.
• Rider verification documents — retained for the duration of the rider's active status with Deleco and for a limited period afterward, to comply with regulatory and safety obligations.
• Chat messages — retained for the duration relevant to the order and a limited period afterward for dispute resolution, after which they may be deleted.

Where information is no longer needed, we take reasonable steps to delete or anonymize it.

7. Data Security

We implement technical and organizational measures designed to protect your information, including encrypted data transmission, access-controlled databases, and server-side validation of sensitive operations (e.g., order status changes and payments are only ever modified through authenticated, access-controlled backend systems, never directly by client applications).

However, no method of transmission or storage is completely secure. We cannot guarantee absolute security, and you share information with us at your own risk.

8. Your Rights

Under Ghana's Data Protection Act, 2012 (Act 843), and consistent with international best practice, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information, subject to our legal and legitimate business retention needs (e.g., completed transaction records).
• Object to or restrict certain processing of your information.
• Withdraw consent at any time where processing is based on consent (e.g., location access), though this may limit or disable certain features of the Services.
• Lodge a complaint with Ghana's Data Protection Commission if you believe your rights under Act 843 have been violated.

To exercise any of these rights, contact us using the details in Section 13. We may need to verify your identity before actioning a request.

9. Location Data

Location data is core to how Deleco functions. Specifically:

• We collect precise location from customers to set pickup points and from riders continuously while online and during an active delivery, to enable matching, routing, and live tracking.
• You can disable location permissions through your device settings at any time, but doing so will prevent core features (requesting deliveries, receiving delivery requests) from working correctly.
• Riders' location while offline (not actively available for deliveries) is not collected.

10. Push Notifications

We use push notifications to alert you to order status changes, new delivery requests (riders), chat messages, and account-related updates. You can disable push notifications at any time through your device settings. Disabling notifications may delay your awareness of time-sensitive order updates.

11. Children's Privacy

The Services are not directed to, and are not intended for use by, individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a person under 18, we will take steps to delete it.

12. International Data Transfers

Our infrastructure providers (Google Firebase and Google Maps Platform) may process and store data in data centers located outside Ghana. Where this occurs, we take steps to ensure such transfers are subject to appropriate safeguards consistent with Ghana's Data Protection Act and applicable international standards.

13. Third-Party Services

The Services integrate with the following third parties, each with their own privacy practices:

• Google Firebase (Google LLC) — authentication, database, hosting, analytics, and crash reporting.
• Google Maps Platform (Google LLC) — mapping, geocoding, and route calculation.
• Paystack (a subsidiary of Stripe, Inc.) — payment processing and rider payouts.

We encourage you to review these providers' own privacy policies. We are not responsible for the privacy practices of third-party services beyond our use of them as described in this Policy.

14. Cookies and Similar Technologies (Deleco Business Web Dashboard)

The Deleco Business web dashboard may use cookies and similar technologies to keep you signed in, remember preferences, and understand usage of the dashboard. You can control cookies through your browser settings, though disabling them may affect dashboard functionality.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will update the "Last updated" date at the top of this Policy, and where changes are material, we will provide additional notice (such as an in-app notification) before the changes take effect.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at:

Orvvan
Accra, Greater Accra Region, Ghana

If you are not satisfied with our response, you may lodge a complaint with:

Ghana Data Protection Commission
www.dataprotection.org.gh