1. Purpose and scope
This Privacy Policy explains how RiderScore Technologies Ltd ("RiderScore", "we", "us") handles personal data when riders use the rider portal and when institutions use the RiderScore platform and APIs.
It applies to the RiderScore website, rider portal, institution workspace and developer APIs. It does not apply to the independent practices of banks, lenders, insurers, fleet operators or other third parties that hold their own relationship with a rider.
2. Personal data we process
Rider identity and contact data: name, phone number, email address, county or area of operation, and identifiers supplied by the rider or by an authorised institution.
Work and platform data: employer or operator relationships, delivery or ride platform affiliations, tenure, vehicle details and employment history where provided.
Financial behaviour data: repayment and settlement history from operator ledgers and institution-provided records, used to produce RiderScore outputs.
Account and usage data: authentication events, workspace membership, role assignments, lookups performed, and technical logs required to operate and secure the service.
3. Sources of data
Directly from riders when they register or update their profile.
From institutions and operators that hold a lawful basis to share rider records with us, including ledger and repayment data.
Generated by the platform itself, such as score snapshots, factor explanations and audit records.
4. Why we process personal data
To create and maintain rider profiles and rider accounts.
To produce explainable RiderScore and integrity outputs for institutions with a legitimate assessment purpose.
To detect, investigate and prevent fraud, misuse and security incidents.
To meet legal, regulatory, audit and record-keeping obligations.
To operate, support, secure and improve the service.
5. Lawful bases
Depending on the processing activity, we rely on consent, performance of a contract, compliance with a legal obligation, or legitimate interests that are not overridden by the rights and freedoms of the data subject.
Where processing relies on consent, the rider may withdraw that consent at any time. Withdrawal does not affect processing already carried out.
6. Sharing and disclosure
We share rider information with an institution only where that institution has a lawful basis and a legitimate assessment purpose, and where the disclosure is permitted under our contract with that institution.
We use service providers such as cloud hosting and infrastructure vendors under written terms that restrict them to processing on our instructions.
We may disclose data where required by law, regulation, court order or a lawful request from a competent authority.
We do not sell personal data.
7. Automated processing
RiderScore produces scores and risk indicators using deterministic, versioned models. Every score is accompanied by the factors that contributed to it.
Scores are decision support. Credit, insurance, employment and other outcomes are decided by the institution, not by RiderScore.
Our Responsible AI Policy sets out excluded inputs, model governance and contestability.
8. Retention
We retain personal data for as long as needed for the purposes described in this policy, and thereafter for the period required by applicable law, contractual obligations, audit requirements and the defence of legal claims.
Audit and score-history records are retained in immutable form so that past assessments remain explainable.
9. Rider rights
Riders may request access to their personal data, correction of inaccurate data, deletion where the law allows, restriction or objection to certain processing, portability of data they provided, and withdrawal of consent.
Requests can be sent to privacy@riderscore.co.ke. We respond within the timeframe required by applicable law and may ask for information needed to verify identity.
10. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, access control, role-based permissions, tenant isolation and audit logging. See the Security & Compliance Overview for detail.
11. Cross-border transfers
Where personal data is transferred outside Kenya, we take steps required by applicable law to ensure an appropriate level of protection, including contractual safeguards with recipients.
12. Changes and contact
We publish a version number and effective date with every revision of this policy. Material changes are communicated to affected users.
Questions or data protection requests: privacy@riderscore.co.ke.
Questions about this document?
Write to privacy@riderscore.co.ke for data matters, or complaints@riderscore.co.ke to raise a complaint.