Privacy Policy

Draft document pending legal review. Not authoritative until reviewed and approved by legal counsel.

Last updated: [TO BE COMPLETED: publication date]

This policy describes what personal data VAKOM collects through its platform (mobile apps, merchant interface, vakom.net website), why, and what your rights are.

1. Data controller

Personal data is processed by [TO BE COMPLETED: legal name], registered with the RCCM under number [TO BE COMPLETED: RCCM], with its registered office at [TO BE COMPLETED: address, Togo]. This processing is governed by Togolese law No. 2019-014 of 29 October 2019 on the protection of personal data, under the supervision of the Instance de Protection des Données à Caractère Personnel (IPDCP). Contact: [TO BE COMPLETED: dedicated email].

2. Data collected

We only collect the data needed to run the service, depending on your role. All users: identity (first and last name, optional photo), phone number verified by SMS code (OTP), connection and usage data. Customers: pickup and drop-off addresses, position during an ongoing ride or delivery, ride and order history (including ordered items), payment data needed for the transaction [TO BE COMPLETED: depending on the payment methods used]. Drivers and couriers: verification documents (ID, licence, insurance, vehicle), real-time position during activity periods, service and payout history. Merchants: business verification documents, catalogue, order and payout history. Location is only collected during a ride or delivery (or, for drivers/couriers, during their activity periods) — never outside the service.

3. Purposes and legal bases

Your data is used to: create and manage your account and verify your number (performance of the contract); match, perform, and track rides, deliveries, and orders (performance of the contract); process payments and payouts (performance of the contract and accounting obligation); verify drivers, couriers, and merchants before activation (performance of the contract and legal obligation); ensure user safety and prevent fraud (legitimate interest); send service-related notifications (performance of the contract); improve the app through usage statistics (legitimate interest); and, where applicable, send commercial communications (consent, withdrawable at any time). We do not sell your personal data.

4. Recipients and processors

Your data is accessible: to other users, strictly to the extent needed for the service (e.g. the driver sees the customer's first name and pickup point; the customer sees the driver's first name, photo, vehicle, and position); to authorized VAKOM staff, on a least-access basis; to our technical processors [TO BE COMPLETED: hosting provider, SMS provider, payment provider(s), others]; and to competent authorities where required by law. If a processor is located outside Togo, the transfer is governed in accordance with law No. 2019-014 [TO BE COMPLETED: applicable safeguards].

5. Retention periods

Active account: data is kept as long as the account exists. Partial deletion: the name and photo are removed immediately and the account is deactivated; the ride and payment history is retained to meet accounting obligations [TO BE COMPLETED: statutory period]. Total deletion: the account is erased after a 30-day period (the request can be cancelled during that period); only data whose retention is legally required is kept, isolated, for the required period. Ride location data: kept with the corresponding ride history. OTP codes: valid for a few minutes, not kept beyond verification.

6. Your rights

Under law No. 2019-014, you have the rights of access, rectification, deletion, objection, and restriction of processing. For account deletion: directly from the app, or from the vakom.net/account page (verified by SMS code, no app needed). For any other request: by email to [TO BE COMPLETED: dedicated email] or by post to the registered office. We respond within [TO BE COMPLETED: period]. You may also lodge a complaint with the IPDCP if you believe your rights are not being respected.

7. Security

We implement appropriate technical and organizational measures: encrypted communications, role-based access control, OTP verification, access logging, and collection limited to what is strictly necessary. No system is infallible, so protect your phone and never share your codes. In the event of a data breach likely to create a risk to your rights, we will notify the IPDCP and, where applicable, the affected individuals, as required by law.

8. Minors

The Platform is restricted to persons aged 18 or over. We do not knowingly collect data about minors; any account identified as belonging to a minor will be deleted.

9. Changes to this policy

We may amend this policy to reflect changes in the service or in regulations. Any substantial change will be notified to you through an appropriate channel (app, SMS, or email) before it takes effect. The last-updated date appears at the top of the document.

10. Contact

Email: [TO BE COMPLETED] Phone: [TO BE COMPLETED] Address: [TO BE COMPLETED] Supervisory authority: Instance de Protection des Données à Caractère Personnel (IPDCP), Togo.