Privacy Policy

1. Introduction

Zane Services Limited ("Zane", "we", "our" or "us") is committed to protecting the privacy, personal information and digital security of individuals who use our platforms, applications, websites and services.

This Privacy Policy explains how we collect, use, store, process, disclose and protect personal information when individuals interact with the Zane ecosystem.

The Zane ecosystem includes, but is not limited to:

• Zane Ride: Ride-hailing, passenger transportation and driver services.

• ZanePay: Digital payments, payment processing, merchant services, agent services and financial technology solutions.

• Zane Delivery: Parcel, food and goods delivery services.

• Zane Commerce: Merchant platforms, marketplace services and digital commerce.

• Zane Business: Business management, merchant tools and enterprise services.

• Zane Wallet: Digital wallet and related payment services, where available.

• Other current and future products, applications and services developed or operated by Zane.

This policy applies to passengers, drivers, delivery partners, merchants, agents, business customers, website visitors and other individuals whose personal information is processed through our services.

By using Zane services, you acknowledge that you have been informed about the data practices described in this policy. Where applicable law requires consent, we will obtain your consent separately through an appropriate affirmative action.

We process personal information in accordance with applicable laws, including the Malawi Data Protection Act, 2024, and other relevant financial, consumer protection, transport and electronic transactions regulations.

2. Information We Collect

The information we collect depends on the services you use, your relationship with Zane and the permissions you grant.

2.1 Personal identification information

We may collect:

• Full name.

• Phone number.

• Email address.

• Date of birth.

• Residential or business address.

• National identification number or other government-issued identification.

• Profile photograph.

• Emergency contact details, where voluntarily provided.

• Account registration and verification information.

For services requiring identity verification, we may request additional information to comply with applicable legal and regulatory obligations.

2.2 Location information

Location information is essential to certain Zane services, particularly ride-hailing, delivery and location-based financial services.

Depending on the service and permissions granted, we may collect:

• GPS coordinates.

• Current or approximate device location.

• Pickup and drop-off locations.

• Trip routes and journey history.

• Driver location during active service periods.

• Merchant or agent locations.

• Delivery addresses.

• Location information associated with transactions or service requests.

Location information may be collected directly from your device, entered manually by you or provided through third-party mapping services.

We do not use location permissions solely for advertising purposes.

2.3 Financial and payment information

For ZanePay and other financial services, we may collect:

• Transaction amounts.

• Payment references and transaction identifiers.

• Wallet balances and transaction histories.

• Merchant payment records.

• Bank account details where required.

• Mobile money transaction information.

• Payment method information.

• Refund and reversal records.

• Settlement information.

• Financial transaction verification records.

Where payment processing is handled by third-party providers, sensitive payment credentials may be collected and processed directly by those providers in accordance with their respective privacy policies.

Zane will only collect and retain payment credentials to the extent necessary for the services provided and permitted by applicable law.

2.4 Know Your Customer (KYC) and verification information

Where required for financial services, regulatory compliance, fraud prevention or account verification, we may collect:

• National identification documents.

• Passport or other accepted identification documents.

• Proof of address.

• Business registration documents.

• Tax identification information.

• Beneficial ownership information.

• Source-of-funds information where legally required.

• Verification photographs or other identity confirmation data.

• Records of verification checks.

Such information will be processed for legitimate compliance purposes and protected through appropriate security measures.

2.5 Device and technical information

When you use our applications or websites, we may automatically collect:

• Device type and model.

• Operating system and version.

• Application version.

• IP address.

• Device identifiers permitted by applicable policy.

• Network connection information.

• Language and regional settings.

• Crash reports and diagnostic information.

• Application performance data.

• Login timestamps and session information.

• Security logs.

This information helps us maintain service reliability, detect technical problems and protect our platforms against misuse.

2.6 Communications and support information

When you communicate with Zane, we may collect:

• Customer support messages.

• Emails and correspondence.

• In-app communications.

• Complaints and dispute records.

• Feedback and survey responses.

• Call records or recordings, where applicable and subject to appropriate notice.

• Communications between passengers, drivers, merchants and delivery partners through Zane platforms.

2.7 Information from third parties

We may receive information from:

• Banks and financial institutions.

• Mobile network operators and mobile money providers.

• Payment processors.

• Identity verification providers.

• Mapping and navigation service providers.

• Merchants and business partners.

• Regulatory authorities, where legally permitted.

• Fraud prevention and security service providers.

We will process third-party information only for disclosed, lawful and legitimate purposes.

3. How We Use Your Information

Zane processes personal information for the following purposes:

3.1 Account creation and management

• Registering and maintaining user accounts.

• Verifying identity.

• Managing user profiles.

• Authenticating users.

• Providing access to services.

• Maintaining account security.

3.2 Ride-hailing and mobility

For Zane Ride, we use information to:

• Identify nearby available drivers.

• Match passengers with drivers.

• Calculate estimated fares and journey distances.

• Facilitate pickup and drop-off.

• Provide navigation and route assistance.

• Monitor active trips for safety and operational purposes.

• Calculate driver earnings and commissions.

• Process payments and refunds.

• Investigate complaints and disputes.

• Support emergency response where necessary.

3.3 Financial services and payments

For ZanePay and related financial services, we use information to:

• Process payments and transfers.

• Facilitate merchant collections.

• Manage wallets and payment accounts.

• Reconcile transactions.

• Process settlements.

• Conduct KYC and verification checks.

• Detect and prevent fraud.

• Meet anti-money laundering and counter-terrorist financing obligations where applicable.

• Maintain financial records.

• Resolve payment disputes.

• Comply with regulatory reporting requirements.

3.4 Delivery and commerce

We use information to:

• Process orders.

• Connect customers with merchants and delivery partners.

• Coordinate deliveries.

• Provide order tracking.

• Calculate delivery charges.

• Manage refunds and complaints.

• Facilitate merchant settlements.

3.5 Security and fraud prevention

We may process personal information to:

• Detect suspicious activities.

• Prevent unauthorised account access.

• Identify fraudulent transactions.

• Investigate abuse of our platforms.

• Protect passengers, drivers, merchants and agents.

• Enforce our terms and conditions.

• Comply with lawful requests from competent authorities.

3.6 Service improvement

We may use aggregated or appropriately de-identified information to:

• Improve application performance.

• Understand service usage patterns.

• Optimise routes and dispatch systems.

• Improve customer experience.

• Develop new features.

• Conduct operational and business analysis.

We will not use personal information for unrelated purposes without an appropriate lawful basis or additional consent where required.

3.7 Marketing and communications

With appropriate consent where required, we may send:

• Service announcements.

• Promotional offers.

• Product updates.

• Loyalty programme communications.

• Relevant business information.

Users may opt out of marketing communications at any time. Opting out of marketing will not prevent essential service notifications, security alerts or legally required communications.

4. Location Data and GPS Tracking

4.1 Passenger location

When a passenger uses Zane Ride, the application may request access to the device's location to:

• Identify the passenger's pickup point.

• Suggest nearby pickup locations.

• Calculate estimated fares.

• Match the passenger with available drivers.

• Facilitate navigation.

• Support trip monitoring and safety.

Passengers may manually enter pickup and destination locations where supported.

Location access will be requested through the relevant device permission system, and users may manage permissions through their device settings.

4.2 Driver location

Drivers using Zane Ride may be required to enable location services while actively providing transportation services.

Driver location may be collected to:

• Display availability to nearby passengers.

• Facilitate ride matching.

• Provide navigation.

• Monitor active journeys.

• Calculate trip distances.

• Support passenger safety.

• Resolve complaints and disputes.

• Verify service completion.

Where continuous or background location access is technically necessary, it will be limited to the relevant driver-service functionality and subject to appropriate disclosure, permission and applicable platform requirements.

Drivers should be able to go offline or end their active service session, after which continuous operational tracking will cease, except where limited processing is necessary for an ongoing trip, a security incident or a lawful recordkeeping obligation.

4.3 Location sharing between passengers and drivers

During an accepted trip, relevant location information may be shared between the passenger and assigned driver to facilitate pickup, navigation and journey completion.

Such information may include:

• Pickup location.

• Destination.

• Current trip progress.

• Estimated arrival time.

• Relevant route information.

We do not disclose a passenger's complete location history to drivers or unrelated third parties.

4.4 Location data retention

Location data is retained only for as long as necessary for the purposes described in this policy, including trip records, safety investigations, dispute resolution, legal compliance and legitimate operational requirements.

Access to historical location information is restricted to authorised personnel and systems.

4.5 Location and advertising

Zane does not sell personal location data or use background location permissions solely to serve advertisements or conduct advertising analytics.

Any future location-based promotional functionality will be subject to appropriate disclosures, consent and applicable law.

5. How We Share Your Information

Zane does not sell personal information to third parties.

However, we may share information in the following circumstances.

5.1 Service providers

We may share information with trusted third-party service providers that support our operations, including:

• Cloud hosting providers.

• Payment processors.

• Identity verification providers.

• Mapping and navigation providers.

• SMS and communication providers.

• Customer support platforms.

• Cybersecurity providers.

• Analytics and technical service providers.

These providers are permitted to process information only for authorised purposes and subject to appropriate contractual and security obligations.

5.2 Passengers and drivers

To facilitate a ride, relevant information may be shared between passengers and drivers, including names or display names, pickup and destination details, trip information and contact functionality.

Where possible, communication features may use masked contact details to reduce unnecessary exposure of personal phone numbers.

5.3 Merchants and delivery partners

For commerce and delivery services, we may share the information necessary to fulfil orders, including customer contact details, delivery addresses, order information and payment status.

5.4 Financial institutions and payment networks

We may share transaction and verification information with banks, mobile money operators, payment processors, settlement partners and payment networks to facilitate transactions, resolve disputes and meet regulatory obligations.

5.5 Regulators and law enforcement

We may disclose information where required or authorised by law, court order, regulatory direction or other lawful process.

Such disclosures will be limited to the information reasonably necessary to meet the applicable obligation.

5.6 Corporate transactions

If Zane undergoes a merger, acquisition, restructuring or sale of business assets, personal information may be transferred as part of the transaction, subject to applicable privacy laws and appropriate safeguards.

5.7 With your consent

We may share information with other parties where you have expressly authorised the disclosure or requested a service that requires it.

6. Financial Data and Regulatory Compliance

Zane recognises that financial information requires enhanced protection.

Where Zane operates regulated payment or financial services, information may be processed to satisfy applicable requirements relating to:

• Customer identification.

• Transaction monitoring.

• Fraud prevention.

• Anti-money laundering.

• Counter-terrorist financing.

• Financial recordkeeping.

• Consumer protection.

• Regulatory reporting.

• Dispute resolution.

Certain financial records may be retained after account closure where required by applicable law or regulatory obligations.

Zane will not use financial information for unrelated commercial purposes without an appropriate lawful basis.

Where financial services are provided through licensed third-party institutions, the relevant institution may independently process personal information under its own legal and regulatory obligations.

7. Data Protection and Security

Zane implements appropriate technical, organisational and administrative safeguards designed to protect personal information against:

• Unauthorised access.

• Accidental loss.

• Destruction.

• Alteration.

• Unauthorised disclosure.

• Misuse.

• Cyberattacks.

Our security measures may include:

1. Encryption of information in transit and, where appropriate, at rest.

2. Role-based access controls.

3. Secure authentication mechanisms.

4. Access logging and monitoring.

5. Regular security assessments.

6. Secure software development practices.

7. Backup and recovery procedures.

8. Restricted access to sensitive financial and identity records.

9. Employee confidentiality obligations.

10. Third-party security assessments where appropriate.

Access to personal information is restricted to personnel and service providers who require it for authorised business purposes.

Although we take reasonable measures to protect information, no electronic system or internet transmission can be guaranteed to be completely secure.

Where a personal data breach occurs, Zane will investigate, take appropriate remedial action and notify affected individuals and relevant authorities as required by applicable law.

8. Data Retention

Zane retains personal information only for as long as necessary to fulfil the purposes for which it was collected, subject to legal, regulatory, operational and security requirements.

Retention periods may vary depending on the type of information and service involved.

Where information is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with applicable law and our internal retention procedures.

Information contained in backups may remain temporarily until overwritten or securely deleted through our normal backup lifecycle.

9. Your Privacy Rights

Subject to applicable law, individuals may have the right to:

• Request access to personal information held about them.

• Request correction of inaccurate or incomplete information.

• Request deletion of personal information.

• Withdraw consent where processing is based on consent.

• Object to certain processing activities.

• Request restriction of processing where applicable.

• Request information about how their personal information is used.

• Raise complaints concerning the handling of their information.

• Exercise other rights available under applicable data protection legislation.

Some requests may be limited where information must be retained to comply with legal, financial or regulatory obligations, protect the rights of others or establish, exercise or defend legal claims.

To exercise your rights, contact us using the details in Section 18.

We may request reasonable identity verification before acting on a request to protect against unauthorised disclosure.

10. Account Deletion

Users may request deletion of their Zane accounts through the account settings available within the application or by contacting our support team.

Where an account deletion request is received:

1. We will verify the identity of the requester where reasonably necessary.

2. We will initiate the deletion process within a reasonable period.

3. Personal information that is no longer required will be permanently deleted or anonymised.

4. Information subject to mandatory legal or regulatory retention will be retained only for the required period and protected against unrelated use.

5. The user will be informed where certain records cannot be deleted immediately due to legal obligations.

Deleting an account may result in the loss of access to services, transaction histories, loyalty benefits or other account-related functionality.

Account deletion does not automatically cancel outstanding financial obligations or remove records that must legally be retained.

Where an application supports account creation, Zane will also provide the required account-deletion functionality and an accessible web-based deletion request mechanism in accordance with applicable Google Play requirements.

11. International Data Transfers

Zane may use service providers or technology infrastructure located outside Malawi.

Where personal information is transferred internationally, Zane will take appropriate steps to ensure that the transfer is lawful and that the information receives an appropriate level of protection in accordance with applicable data protection requirements.

Such safeguards may include contractual protections, security controls and other legally recognised transfer mechanisms.

Users may contact Zane for further information about international transfers relevant to their personal information.

12. Cookies and Tracking Technologies

Our websites and applications may use cookies, software development kits (SDKs), analytics tools and similar technologies to:

• Maintain sessions.

• Improve performance.

• Understand service usage.

• Detect technical errors.

• Protect against fraud.

• Remember user preferences.

• Improve functionality.

Where required, we will obtain consent before using non-essential cookies or similar tracking technologies.

Third-party SDKs integrated into Zane applications will be reviewed to ensure that their data practices are consistent with this policy and applicable platform requirements.

We will not permit third-party SDKs to process personal or sensitive user information in ways that are inconsistent with our disclosures, applicable law or relevant app-store policies.

13. Children's Privacy

Zane services are not intended for children who are below the minimum age permitted under applicable law or the requirements of the relevant service.

We do not knowingly collect personal information from children in circumstances where such collection is prohibited.

Where age verification or parental consent is required by law, we will implement appropriate measures.

If we become aware that personal information has been collected from a child in violation of applicable requirements, we will take appropriate steps to delete the information or otherwise address the issue in accordance with the law.

14. Third-Party Websites and Services

Zane platforms may contain links to third-party websites, applications or services.

Such services are governed by their own privacy policies and terms of use.

Zane is not responsible for the independent privacy practices of third parties outside our control.

Users are encouraged to review the relevant privacy policies before providing information to external services.

15. Automated Decision-Making

Zane may use automated systems to support:

• Ride matching.

• Fare calculations.

• Fraud detection.

• Transaction monitoring.

• Account security.

• Service availability.

• Operational risk assessment.

Where automated processing produces decisions that significantly affect an individual, Zane will comply with applicable legal requirements concerning transparency, review and individual rights.

Users may contact us to raise concerns about decisions made through our systems.

16. Changes to This Privacy Policy

Zane may update this Privacy Policy from time to time to reflect:

• New products and services.

• Changes in technology.

• Changes in applicable legislation.

• Regulatory requirements.

• Changes in our data processing practices.

• Improvements to privacy and security measures.

Where changes are material, we will take reasonable steps to notify users through the application, website, email or other appropriate communication channels.

The updated policy will be published with a revised effective date.

Continued use of Zane services following an update will be subject to the revised policy, without affecting any consent requirements imposed by applicable law.

17. Complaints and Regulatory Oversight

Zane encourages users to contact us first so that we can investigate and address privacy concerns.

Individuals may also exercise their rights or lodge complaints with the relevant data protection authority in accordance with applicable law.

In Malawi, the designated Data Protection Authority is the Malawi Communications Regulatory Authority (MACRA), operating through the Data Protection Authority framework established under the Data Protection Act, 2024.

Users may contact the Authority through its official website: https://www.dpa.mw/

18. Contact Information

For questions, requests, complaints or concerns regarding this Privacy Policy or the processing of personal information, please contact:

We will review and respond to enquiries within the timeframes required by applicable law.

END OF PRIVACY POLICY

© 2026 Zane Services Limited. All rights reserved.