Privacy Policy

1 · Who we are

1.1 Eazzier Transpay LTD, a company incorporated under the laws of the Republic of Ghana whose principal office is at Accra, Ghana ("the Company"), operates the EazzierTransport platform: the operator dashboard, the counter and station software, each Operator's branded online booking site, and the associated services (together, "the Platform").

1.2 Enquiries and requests under this Policy may be addressed to support@eazzier.com or to +233 55 749 4701.

2 · The two capacities in which data is processed

2.1 The Company as controller. In respect of the account data of Operators and their staff, records of visits to the Company's own websites, and the records the Company keeps for the billing of its fees, the Company determines the purposes and manner of processing and is the data controller.

2.2 The Company as processor for the Operator. The Platform is a system that transport companies ("Operators") use to run their own operations. The passenger, customer, parcel and staff records created in an Operator's workspace belong to that Operator's business: the Operator decides what information its booking and parcel forms collect, from whom, and for what purpose, and the Operator is the data controller of that data. The Company processes it on the Operator's behalf and instructions, as described in this Policy.

2.3 A passenger, parcel sender or parcel recipient whose data is held in an Operator's workspace should accordingly direct questions and requests concerning that data to the Operator they dealt with, in the first instance. Clause 8 describes how the Company assists.

3 · Definitions

3.1 "Personal data" means data about an individual who can be identified from that data or from that data together with other information. "Processing" means any operation performed upon personal data, including collection, recording, storage, use, disclosure and erasure. "Data subject" means the individual to whom personal data relates. "Passenger Data" means the personal data described in clauses 4.3 to 4.6, held in an Operator's workspace.

4 · Categories of personal data

4.1 Operator and staff account data

The name, telephone number, electronic mail address and employee code of each staff member; the roles, stations, routes and permissions assigned to them; whether the telephone number has been verified; and the password and the counter sign-in PIN, each stored in hashed form and not recoverable by the Company.

4.2 Session and security data

In respect of each sign-in: the device description, the browser identification string, the internet protocol address, and the times of sign-in and of last use. Failed sign-in attempts are also recorded, with the internet protocol address from which they were made.

4.3 Booking and passenger data

Where a ticket is sold at a station, by an agent or through an Operator's online booking site: the passenger's name and telephone number; the journey, seat, fare and currency; the method of payment; check-in and boarding records; any refund or correction; and any further information the Operator's own booking form is configured to collect. What that form asks for is determined by the Operator, not by the Company.

4.4 Customer records and loyalty

Where an Operator keeps a record of its customers: a record keyed to the telephone number, comprising the name, the details the Operator has chosen to remember for future bookings, the history of completed trips, loyalty progress and rewards, and any store credit held with that Operator.

4.5 Parcel and luggage data

In respect of each parcel: the sender's and the recipient's names and telephone numbers; the description, weight, declared particulars and fees; the record of scans from drop-off to collection; and the collection PIN by which handover to the recipient is confirmed, the entry of which is limited against repeated wrong attempts. In respect of luggage: its weight, fee and the booking to which it belongs.

4.6 Staff, finance and commission records

Records an Operator keeps of its own business through the Platform, so far as they identify individuals: expenses and who submitted them; staff compensation records; cash handovers between staff; and agents' commission balances and payouts.

4.7 Payment data

In respect of payments made through payment providers: the fact, amount, currency, date and status of the payment and the reference assigned by the provider. Card numbers, mobile money personal identification numbers and comparable authentication credentials are not transmitted to, processed by or stored upon the Company's systems; they are submitted directly to the payment provider concerned.

4.8 Messages and notifications

The content and delivery records of tickets, booking confirmations, parcel updates, collection PINs and comparable messages despatched to passengers and parcel customers on the Operator's behalf, and of feedback submitted by passengers where the Operator uses that facility.

5 · Purposes of processing and lawful basis

5.1 Personal data is processed for the following purposes:

• the creation and administration of Operator workspaces and staff accounts, and the enforcement of the access each staff member has been given;
• the sale and issue of tickets, the management of seats and journeys, and the operation of check-in and boarding;
• the registration, tracking and handover of parcels and luggage, and the despatch of the related messages;
• the administration of customer records, loyalty, discounts and refunds on the Operator's instructions;
• the keeping of the finance, commission and staff records the Operator maintains through the Platform;
• the billing of the Company's fees and the keeping of accounting records;
• the security of the Platform, including the detection of unauthorised access and fraud;
• the maintenance and improvement of the Platform; and
• compliance with legal obligations to which the Company or the Operator is subject.

5.2 Where the Company acts as processor, the lawful basis of the processing is a matter for the Operator as controller, and the Company acts on the Operator's instructions. Where the Company acts as controller, it processes personal data for the performance of its agreement with the Operator, for compliance with legal obligations, and, in respect of security, for the legitimate interests of the Company and of Operators and their customers.

6 · Disclosure of personal data

6.1 Disclosure to the Operator. Passenger Data is, by design, available to the Operator in whose workspace it was created, and to those of the Operator's staff and agents to whom the Operator has given access.

6.2 Disclosure to processors. The Company discloses personal data to the following categories of service provider, each of which processes it upon instructions and for no other purpose: providers of messaging services, for the despatch of tickets, notifications and verification codes; payment services providers, for the taking of payments; and providers of hosting and storage infrastructure.

6.3 Disclosure required by law. The Company may disclose personal data where required to do so by law, by an order of a court, or by a competent authority, and where disclosure is necessary to protect any person from harm or to investigate suspected fraud.

6.4 The Company does not sell personal data, and does not disclose it to advertisers, data brokers or any other third party for the purposes of marketing.

7 · Transfer outside Ghana

7.1 The Platform is hosted upon cloud infrastructure, and personal data processed through it may accordingly be stored or processed outside the Republic of Ghana for the purposes described in clause 5.

7.2 The Company employs providers which afford appropriate technical and organisational safeguards in respect of data so transferred, and requires each of them to process personal data only upon instructions.

8 · Rights of data subjects

8.1 A data subject may request access to the personal data held about them; request correction of data which is inaccurate or incomplete; request erasure, subject to clause 9.2; object to processing for a specified purpose, or withdraw a consent previously given; and request that processing be restricted pending the determination of such a request.

8.2 Where the data concerned is Passenger Data, the request should be made to the Operator with whom the data subject dealt, that Operator being its controller. The Company shall assist the Operator in giving effect to such requests, and a data subject who is unable to reach the Operator may write to the Company at support@eazzier.com, which shall pass the request to the Operator and assist in its resolution.

8.3 Where the data concerned is operator or staff account data, the request shall be made in writing to support@eazzier.com from the telephone number or electronic mail address recorded upon the account. The Company shall respond within a reasonable period and shall not charge a fee. The Company may require satisfactory verification of the identity of the person making the request before acting upon it, disclosure to a person falsely claiming to be the data subject being itself a breach of this Policy.

9 · Retention

9.1 Account data is retained for so long as the account remains open. Passenger Data is retained for so long as the Operator, as controller, requires it for the operation of its business. Records relating to payments and to the Company's fees are retained for the period required by law for accounting and taxation purposes.

9.2 Upon a duly made request for erasure, the relevant personal data shall be deleted or irreversibly anonymised, save that there may be retained: records which the Company or the Operator is required by law to keep; and anonymised records of completed transactions from which the data subject cannot be identified.

10 · Security

10.1 The Company employs technical and organisational measures appropriate to the risk, including: the hashing of passwords and sign-in PINs; the encryption of data in transit; the restriction of each staff member's access to the stations, routes and actions assigned by the Operator; the recording of sign-ins and the facility to terminate sessions; and the limitation of repeated wrong attempts at a parcel collection PIN.

10.2 No system of transmission or storage is entirely secure. Where a breach of security occurs which is likely to affect the personal data of a data subject, the Company shall notify the Operator concerned and, where the Company is the controller, the data subject, and shall take such further steps as the law requires.

11 · Children

11.1 Accounts on the Platform may be held only by persons aged eighteen (18) years or over. Passenger Data may relate to a minor where an adult books travel or sends a parcel on a minor's behalf, or where an Operator's form so provides; such data is processed on the Operator's instructions as described in clause 2.2.

12 · Cookies and similar technologies

12.1 The Platform places upon the device a limited number of cookies which are necessary for its operation, being those which maintain a session, record that a user is signed in, and record the language chosen.

12.2 The Company does not operate third-party advertising or cross-site tracking technologies upon the Platform.

13 · Amendment of this Policy

13.1 The Company may amend this Policy from time to time. The version in force is that published upon the Platform and identified by the version date appearing above. Where an amendment is material, notice shall be given upon the Platform.

14 · Contact

Enquiries and requests concerning this Policy may be addressed to Eazzier Transpay LTD at support@eazzier.com or on +233 55 749 4701, or by post to Accra, Ghana.