Privacy Policy

Drift is a ride-hailing platform operated by Akcessible Technologies Limited (“Akcessible”, “we”, “us”), a company registered in Tanzania. Drift connects riders with independent, licensed transport operators. We act as the data controller for the personal data described in this Policy. We are registered with the Personal Data Protection Commission (PDPC) and process personal data in accordance with the Personal Data Protection Act No. 11 of 2022 (the “PDPA”) and its Regulations.

Depending on how you use Drift, we may collect:

• Account and identity data: name, phone number, email, and, for drivers, NIDA/identification, driving licence, LATRA authorisation, and profile photograph.
• Trip data: pickup and drop-off locations, route, GPS location during trips, and timestamps.
• Payment data: transaction details, processed through licensed payment providers; we do not store full card or mobile-money credentials.
• Device and usage data: device identifiers, app version, and technical logs.
• Communications and safety data: in-app messages, support requests, reports, and incident records.

We process personal data to:

• Provide the service: create your account, match trips, enable navigation and tracking, and process payments.
• Keep the platform safe: verify drivers, prevent fraud, investigate incidents, and support emergencies.
• Communicate with you: send trip, account, and service messages.
• Comply with the law: meet our obligations to LATRA, tax authorities, and other regulators.
• Improve Drift: understand usage and improve reliability and safety.

We rely on one or more lawful bases under the PDPA: performance of our contract with you; your consent (which you may withdraw); compliance with a legal obligation; protection of vital interests in an emergency; and our legitimate interest in running a safe, fraud-free platform. Where we process sensitive personal data, such as biometric data used for identity verification, we do so only with your explicit consent or another basis permitted by the PDPA.

We share personal data only as needed to operate Drift, and never sell it. Recipients may include:

• The other party to your trip: limited details so a rider and driver can complete the trip (for example, first name, vehicle details, and approximate location).
• Service providers: hosting, payment, mapping, identity-verification, and communications providers acting on our instructions.
• Authorities: LATRA, law enforcement, or courts, where required by law or to protect safety, with each disclosure recorded.
• Emergency contacts: where you enable this feature and a serious incident occurs.

Some of our providers may store or process data outside Tanzania. Where this happens, we transfer data only where the PDPA allows: where the recipient country offers adequate protection, where appropriate safeguards are in place, and where any permit required by the PDPC under the PDPA has been obtained.

We keep personal data only as long as necessary for the purposes described in this Policy and to meet our legal, tax, and regulatory obligations. The table below sets out how long we typically keep each category of data.

Once a retention period lapses, we delete or anonymise the data, unless a longer period is required to establish, exercise, or defend a legal claim, or where an investigation is ongoing.

Subject to the PDPA, you have the right to access your data; to object to or restrict certain processing; to opt out of direct marketing; to rights regarding automated decisions; and to ask us to correct, block, delete, or destroy inaccurate data. You can also delete your account directly in the app: see our step-by-step guide to deleting your account. Under the PDPA, some correction and erasure requests are made through the PDPC, which forwards them to us; we will cooperate fully. To exercise your rights, contact us using the details in the Contact section below.

We use technical and organisational measures, including access controls, encryption in transit, and least-privilege access, to protect your data. If a data breach occurs that is likely to affect your rights, we will act in line with our breach-response procedure and notify the PDPC and affected users where the PDPA requires.

Drift is not directed at children. Accounts are intended for adults; where the law treats a user as a minor, additional protections under the PDPA apply, and we will handle any such data accordingly.

For privacy questions or to exercise your rights, contact our Data Protection Officer at privacy@nowdrift.com. If you are not satisfied with our response, you may complain to the Personal Data Protection Commission (PDPC) of Tanzania.

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, where appropriate, notify you in the app. Your continued use of Drift is also governed by our Terms of Service.