Privacy Notice
Your data should have a reason to be here.
Effective 25 September 2026 · Version 2026-09-25
1. Controller and contact
Rospop Labs Ltd operates KW3LA and determines the purposes and means of the personal-information processing described here. Company number 14542843; registered office 5 Brayford Square, London, England, E1 0SG. Privacy enquiries and rights requests: support@rospoplabs.ai.
For Zimbabwe users we process information with regard to the Cyber and Data Protection Act [Chapter 12:07] and applicable regulations/guidance. Where another privacy law mandatorily applies, we will also respect those rights.
2. Information we collect
| Category | Examples | Why |
|---|---|---|
| Account identity | Google subject identifier, verified email, name, profile picture where supplied | Authentication, account linking, fraud prevention |
| Rider profile | Name, phone, city, contact preference, selected pilot market | Booking, communication, support and market separation |
| Driver and vehicle | Name, phone, email, city, vehicle make/model/colour/year, licence plate, approval status | Onboarding, matching, rider identification, safety and compliance review |
| Ride information | Pickup, destination, fare, status, timestamps, cancellation reason, matched identities | Provide the ride-matching service, support, disputes, accounting and safety |
| Location | Rider pickup coordinates when permitted; driver live location; periodic assigned-ride GPS points; one-shot driver location when the driver asks to find a nearby authorised cash agent | Nearby matching, pickup navigation, active-ride safety, incident review and optional nearby cash-agent discovery |
| Communications | In-app ride messages, support requests, SMS/WhatsApp preferences | Ride coordination, customer support and safety records |
| Driver financial records | Commission debits/credits, amount, currency, provider, transaction reference, review status | Platform-fee accounting, reconciliation and dispute handling |
| Technical/security | Session cookies, IP/rate-limit data, timestamps, browser/device-related request data, hashed short-lived cash QR-pass identifiers and agent scan/use timestamps | Security, authentication, safe cash-driver identification, replay prevention, abuse prevention and troubleshooting |
Do not put unnecessary sensitive personal information into free-text trip notes or messages. If an accessibility or safety need must be communicated, provide only what is reasonably necessary.
3. Purposes and legal grounds
We process information to provide requested platform/ride-matching services, administer accounts, match riders and drivers, maintain safety records, respond to support, detect abuse/fraud, reconcile driver fees, comply with law, establish or defend legal claims, and improve reliability of the pilot.
Depending on the context, processing is based on your request/contract, consent where required, compliance with legal obligations, protection of vital interests, and legitimate operational or security interests where those interests are not overridden by your rights. Optional WhatsApp or similar channel choices can be withdrawn at any time. Necessary service communications are not treated as marketing consent.
4. Location data
Rider pickup GPS is requested as a one-shot location when available and permitted. Drivers who choose to go online share live location so they can be matched. During an assigned ride, periodic driver location samples may be stored with the ride safety record. Pre-match rider views use approximate driver locations; precise matched-driver location is shared only with the rider assigned to that ride while operationally relevant.
When a driver presses “Find a cash agent near me”, the browser may request a one-shot current location so KW3LA can sort published cash-agent locations by distance. That search location is used for the response and is not written to the cash-agent directory or retained by that feature as a new location record. If permission is declined, KW3LA can fall back to a recent driver location already held for the service, or show the published directory without distance sorting.
You can control browser/device location permissions, but some live matching, navigation or nearby-agent functions may not work without them.
5. Who receives information
- Matched rider/driver: only information reasonably needed for identity, pickup, vehicle recognition, trip coordination and safety.
- Rospop/KW3LA authorised staff: support, Pilot Ops, safety, compliance and technical administration on a need-to-know basis.
- Service providers: hosting/cloud infrastructure, Google identity, communications and other processors needed to operate the service.
- Professional advisers, insurers, auditors and payment/settlement providers: where reasonably necessary.
- Authorities/courts: where disclosure is legally required or lawfully necessary for serious safety, fraud or legal claims.
We do not sell personal information and we do not use KW3LA pilot data for third-party advertising.
6. International processing and transfers
Rospop Labs Ltd is established in the United Kingdom and KW3LA uses cloud and technology providers that may process data outside Zimbabwe. Where Zimbabwean cross-border-transfer rules or other applicable law require safeguards or a permitted transfer basis, we will take the legally required steps before or when making those transfers. Transfers may also be necessary to perform the service you request or to establish, exercise or defend legal claims where law permits.
7. Retention
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including account operation, safety, accounting, fraud prevention, dispute handling and legal obligations.
During the launch pilot, account/profile and ride records may be retained for the duration of the pilot and a reasonable post-pilot review period. Safety incidents, accounting/commission records, complaints and records needed for legal claims may be retained longer where necessary. We will reduce, anonymise or delete records when they are no longer reasonably required. We are implementing a formal retention schedule as the pilot matures.
8. Security
We use measures intended to protect information, including HTTPS, signed secure sessions, access controls, rate limiting, separation of public and administrative functions, restrictions on pre-match location exposure, and short-lived single-use cash QR passes whose plaintext tokens are not stored in the database. No online system can guarantee absolute security. If we become aware of a personal-data breach, we will assess and handle notifications in accordance with applicable law.
9. Your rights
Subject to applicable law and exceptions, you may ask us to confirm whether we process your data, provide access, correct inaccurate data, delete data that is no longer lawfully required, object to certain processing, restrict processing, withdraw consent where processing relies on consent, or raise a complaint.
Send a request from the email associated with your KW3LA account to support@rospoplabs.ai. We may need to verify identity before acting. Zimbabwe data-protection complaints may also be raised with the competent Data Protection Authority (POTRAZ).
10. Children
KW3LA accounts are not intended for people under 18. A minor passenger should travel only in accordance with applicable law and under the responsibility of an appropriate adult. Do not create an account for a child or submit unnecessary child data.
11. Cookies and external services
See the Cookie Notice. We use an essential KW3LA session cookie and local browser storage for limited service preferences. Google Identity Services is loaded for sign-in and may process information under Google's own privacy terms.
12. Changes
We may update this notice as the pilot, providers or legal requirements change. Material changes will be shown by a new version/effective date and, where appropriate, brought to your attention in the app.