Privacy Policy

Zitran Mobility Limited is a technology-powered transit company registered in Accra, Ghana, and a subsidiary of ZinFIn Group Limited. We operate subscription-based bus transit, accessible paratransit (Zitran Access), and partner programmes for drivers, fleet owners, and service providers.

Depending on how you interact with our Platform, we may collect:

• Rider Waitlist: Full name, phone number, email (optional), preferred area.
• Corporate Enquiries: Company name, contact person, work email, phone, employee count, route requirements, notes.
• Captain (Driver) Applications: Full name, phone, email (optional), driving experience, licence type, vehicle ownership, preferred employment type, preferred operating area.
• Fleet Partner Inquiries: Full name, phone, email (optional), fleet size, vehicle types, current usage, depot location, notes.
• Service Partner Registrations: Full name, phone, email (optional), company/business name, service type (healthcare, catering, other), partnership description.
• Zitran Access Bookings: Rider name, contact details, pick-up and drop-off addresses, appointment times, mobility device type and dimensions, special mobility requirements, and — where a third party books on behalf of a rider — the booker's name and contact details.

We do not collect payment card data, national ID numbers, biometric data, or sensitive personal data as defined under Act 843.

We process your data under the following lawful bases recognised by Act 843:

• Consent: You voluntarily submit your data when joining a waitlist, applying, or making a booking.
• Contractual necessity: Processing required to fulfil a service booking, partnership, or employment-related application.
• Legitimate interest: Improving our services, planning routes, preventing fraud, and communicating service updates.

Specifically, we use your data to:

• Notify you when Zitran launches or expands to your area.
• Process and respond to partnership, corporate, and driver enquiries.
• Plan and dispatch Zitran Access trips safely.
• Coordinate with Service Partners to deliver healthcare transport or onboard catering.
• Improve service offerings, route planning, and fleet allocation.
• Prevent duplicate submissions, spam, and fraud.

• Supabase — hosted on AWS af-south-1 (Cape Town, South Africa). Protected by row-level security policies. Only authenticated server-side processes can read lead and booking data.
• HubSpot CRM — EU-based data centres. Used to manage contact pipelines and partner communications.

All data in transit is encrypted via TLS 1.2+/HTTPS. We store a one-way SHA-256 hash of IP addresses for deduplication only — we never store raw IP addresses. Zitran Access mobility information is stored in a restricted data partition accessible only to dispatch and operations personnel.

• HubSpot Inc — CRM, contact management, and pipeline tracking.
• Resend Inc — Transactional email delivery (confirmations, notifications).
• Cloudflare Inc — Bot protection (Turnstile) and CDN security.
• Assigned Captains — Receive only the information necessary for a specific trip (name, pick-up/drop-off, mobility requirements). Captains do not have access to your full profile or historical data.
• Service Partners — Healthcare or catering partners may receive limited rider information (name, vehicle, timing) only where necessary to coordinate a specific service, and only with your prior consent.

We do not sell your data. We do not share data with advertisers, data brokers, or third-party marketers. We will disclose data if required to do so by law, regulation, or a valid court order.

Given the sensitive nature of accessible transport, we apply additional safeguards to Zitran Access data:

• Minimisation: We collect only the mobility and accessibility information strictly necessary to plan and deliver a safe trip. We never ask for or store medical diagnoses.
• Purpose limitation: Mobility information is used solely for trip planning and Captain briefing. It is never used for marketing, profiling, or analytics.
• Access restriction: Only dispatch operators and the assigned Captain can view a rider's mobility information for a specific trip.
• Retention: Trip-specific mobility details are retained for 90 days after the trip for service quality and safety review, then anonymised or deleted.
• Third-party bookings: Where a healthcare facility or caregiver books on behalf of a rider, both the booker's and rider's information are stored. The booker is responsible for having obtained the rider's consent.

• Waitlist data: Up to 12 months after full commercial launch, or until deletion is requested.
• Corporate and partner data: Up to 3 years from last contact.
• Captain applications: Up to 2 years, or until no longer relevant.
• Service Partner data: Duration of the partnership plus 2 years.
• Zitran Access trip data: 90 days for mobility details; 2 years for booking records (anonymised where possible).
• Financial records: As required by Ghana Revenue Authority regulations.

Under Act 843 and applicable data protection frameworks, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data (subject to legal retention requirements).
• Objection — object to processing of your data for specific purposes.
• Withdraw consent — withdraw previously given consent at any time.

To exercise any right, email: privacy@zitran.net. We will respond within 30 days.

Your data may be processed outside Ghana:

• Supabase / AWS af-south-1 — South Africa, governed by the Protection of Personal Information Act (POPIA).
• HubSpot — EU data centres, governed by GDPR and standard contractual clauses.
• Resend / Cloudflare — US-based, with data processing agreements in place.

All cross-border transfers are subject to appropriate safeguards as required by Act 843.

This site does not use tracking, advertising, or analytics cookies. Cloudflare Turnstile may set a strictly necessary first-party cookie for bot protection only. No data is shared with advertisers or analytics platforms.

Our Platform is not directed at children under the age of 13. We do not knowingly collect personal data from children. Where a Zitran Access booking is made for a minor, a parent or legal guardian must make the booking and accept responsibility. If you believe we have inadvertently collected data from a child, please contact us immediately.

Zitran Mobility Limited is registering with the Data Protection Commission of Ghana at app.dataprotection.org.gh. Our registration number will be published here once confirmed.

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be communicated via the Platform or email where possible. Continued use after an update constitutes acceptance of the revised policy.