Legal

Privacy Policy

Effective date: July 27, 2026

This Privacy Policy explains how Creuse collects, uses, shares, stores, and protects personal data when people use our websites, apps, rider services, driver services, and support channels in Kenya.

Creuse is the data controller for personal data processed to operate the Creuse platform, except where another organisation is identified as an independent controller. This Policy should be read with our Terms of Service and any feature-specific notice shown in the app.

1. Who this Policy covers

This Policy applies to:

• passengers and people for whom a ride is requested;
• drivers, prospective drivers, vehicle owners, and authorised fleet representatives;
• website visitors, support contacts, and other people who communicate with Creuse; and
• people whose information is provided in connection with a trip, safety report, complaint, insurance matter, or legal request.

2. Personal data we collect

Account and contact data

This may include your name, phone number, email address, profile photo, account credentials, language, preferences, emergency contact information where enabled, and communications preferences.

Identity, driver, and vehicle data

For drivers, owners, and authorised representatives, this may include national identity or passport details, date of birth, tax information, driving licence, Public Service Vehicle badge, profile photo or verification image, police clearance or screening status, vehicle logbook or authority to use the vehicle, registration number, make and model, inspection and roadworthiness records, insurance details, and document expiry dates.

Trip and location data

This may include pickup and destination information, precise or approximate device location, driver location while online or completing a trip, route and journey progress, date and time, distance, estimated and final fare, cancellations, waiting time, and trip status. Collection depends on your role, app state, device permissions, and the feature you use.

Payment, subscription, and earnings data

This may include your selected payment method, mobile-money phone number and transaction reference, payment tokens supplied by a payment provider, fare and receipt records, refunds, adjustments, driver subscription purchases, completed trip earnings, and related tax or accounting information. Creuse generally receives transaction details rather than full card credentials.

Device, app, and website data

This may include IP address, device identifiers, operating system, app version, browser type, language, mobile network, pages or features used, access times, crashes, diagnostics, security events, and cookie or similar technology data.

Communications, support, and safety data

This may include in-app messages, support tickets, call or message metadata, complaint details, ratings or feedback where available, lost-property reports, safety reports, photographs, documents, recordings you choose to submit, and information relating to accidents, disputes, insurance claims, or suspected fraud.

3. Where data comes from

Creuse collects data:

• directly from you when you create an account, request or provide a trip, buy a subscription, contact support, or submit documents;
• automatically from your device and use of the app or website;
• from passengers, drivers, vehicle owners, fleet representatives, or another person who requests a ride for you;
• from payment, identity-verification, screening, mapping, communications, insurance, and support providers; and
• from public records, the NTSA, law enforcement, courts, regulators, and other lawful sources where necessary and permitted.

4. Why we use personal data

Creuse uses personal data to:

• create and maintain accounts and verify identity, eligibility, drivers, owners, and vehicles;
• match passengers and drivers, enable pickups and destinations, calculate routes and fares, show journey progress, and provide receipts;
• process payments, subscriptions, refunds, adjustments, and driver earnings records;
• enable communications between passengers and drivers and provide customer support;
• provide safety features, respond to incidents, investigate complaints, prevent fraud, and enforce our Terms;
• maintain, troubleshoot, analyse, and improve the reliability and accessibility of Creuse;
• send service, security, legal, account, and policy notices;
• send promotions where permitted, with a way to opt out of direct marketing; and
• comply with transport, tax, data-protection, insurance, court, law-enforcement, and other legal obligations.

5. Our lawful bases

Depending on the processing, Creuse relies on one or more lawful grounds recognised under Kenyan law:

• Contract: processing needed to provide requested platform, trip, payment, subscription, and support services.
• Legal obligation: processing required by transport, tax, safety, insurance, data-protection, or other applicable law.
• Legitimate interests: operating and improving Creuse, protecting users, preventing fraud, resolving disputes, and maintaining platform security, where those interests do not override your rights.
• Consent: where Creuse asks for permission, including certain device permissions, optional features, or marketing. You may withdraw consent, but this does not affect earlier lawful processing.
• Protection of vital interests or public interest: where necessary to respond to an emergency, serious safety event, or lawful public-authority request.

6. Location data

Location is central to matching, pickup, navigation, journey visibility, fare calculation, safety, and fraud prevention. Riders may provide a location by typing it or, where permission is granted, through device location. Driver location may be collected while the driver app is open, while the driver is online and available for requests, and during an active trip, according to the app permissions and operating-system settings.

You can control device permissions in your settings. Some Creuse features cannot work correctly without the location information needed for that service.

7. Automated processes

Creuse may use automated processes for matching, route suggestions, fare calculation, fraud and security checks, document validation, service quality, and account risk signals. Where a decision is based solely on automated processing and produces legal or similarly significant effects, you may request information about the decision and human review where Kenyan law provides that right.

8. When we share personal data

Creuse shares only the data reasonably needed for the relevant purpose. Recipients may include:

• Passengers and drivers: names, profile details, ratings where available, pickup and destination information, vehicle details, location and trip information needed to arrange and complete a ride.
• Vehicle owners and fleet representatives: driver, vehicle, trip, subscription, safety, and earnings information needed to manage an authorised vehicle or driver relationship.
• Service providers: cloud hosting, maps, communications, payment processing, mobile money, identity checks, document review, fraud prevention, analytics, customer support, and security providers acting under appropriate obligations.
• Insurers and professional advisers: where needed for insurance, accidents, claims, legal advice, audit, or dispute resolution.
• Authorities and legal recipients: the NTSA, ODPC, Kenya Revenue Authority, police, emergency services, courts, and other authorities where disclosure is required or lawfully requested.
• Business transaction recipients: a prospective or completed buyer, investor, lender, or successor involved in a merger, financing, restructuring, or sale, subject to confidentiality and applicable law.

9. International transfers

Some technology or support providers may process data outside Kenya. Before transferring personal data internationally, Creuse will use a lawful transfer basis and appropriate safeguards required by the Data Protection Act and its Regulations. These may include adequate protections in the destination, contractual safeguards, another legally recognised mechanism, or consent where required.

10. How long we keep data

Creuse keeps personal data only for as long as reasonably necessary for the purpose collected, unless a longer period is required or permitted by law. Retention depends on the type of data, account status, safety and fraud risks, limitation periods, and tax, insurance, regulatory, and dispute requirements.

Kenyan transport-network regulations require Creuse to retain specified trip records for three years, including vehicle and driver identifiers, passenger identification details, pickup and drop-off date, time and location, payment method, and pricing details. Other information may be kept longer where needed for an active complaint, legal claim, safety investigation, fraud prevention, tax obligation, or court or authority requirement.

When data is no longer needed, Creuse will delete, anonymise, or securely isolate it in line with its retention schedule. Deleting the app does not delete your account or the information Creuse is required to retain.

11. Security and data breaches

Creuse uses reasonable administrative, technical, and organisational safeguards designed to protect personal data from loss, misuse, unauthorised access, alteration, or disclosure. Measures may include access controls, encryption in transit or at rest where appropriate, logging, staff and supplier controls, backups, and incident-response procedures.

No system can be guaranteed completely secure. Where a personal-data breach creates a real risk of harm, Creuse will notify the Office of the Data Protection Commissioner without delay and within the period required by law, and will communicate with affected people where required.

12. Your rights

Subject to the Data Protection Act, 2019 and applicable limitations, you may have the right to:

• be informed about how your personal data is used;
• request access to personal data Creuse holds about you;
• object to all or part of certain processing;
• request correction of false, inaccurate, or misleading data;
• request deletion of data that is false, misleading, unlawfully processed, or no longer needed;
• withdraw consent where processing is based on consent;
• opt out of direct marketing; and
• request review of a qualifying solely automated decision.

Creuse may need to verify your identity before acting on a request. A request may be limited or refused where data must be retained for transport records, legal claims, safety, fraud prevention, another person's rights, or another lawful reason. Creuse will explain the applicable reason where permitted.

13. Children

Creuse accounts are intended for people aged 18 or older. A minor may only travel where lawfully accompanied or where a product specifically permits it under additional safeguards and terms. If Creuse learns that a child created an account or provided data contrary to this Policy, Creuse will take appropriate steps to close the account and handle the data lawfully.

14. Cookies and website analytics

The Creuse website may use essential storage or cookies needed for security and basic operation, and limited analytics to understand site performance. Where non-essential cookies or advertising technologies are introduced, Creuse will provide appropriate notice and choices required by law.

15. Third-party links and services

Creuse may link to third-party websites, app stores, payment services, or other services with their own privacy practices. Review their policies before providing personal data directly to them.

16. Changes to this Policy

Creuse may update this Policy as the service, technology, or law changes. The effective date will be updated and material changes will be communicated through the app, website, email, or another reasonable channel before they take effect where required.

17. Contact and complaints

For a privacy question, rights request, or complaint, use in-app support or email privacy@creuse.africa. Please describe your request and the account details needed to locate your information, but do not email passwords, verification codes, or unnecessary identity documents.

You may also lodge a complaint with the Office of the Data Protection Commissioner of Kenya.