Last updated: 19 June 2026
LOKO GO HUB (PRIVATE) LIMITED ("Loko", "we", "our", or "us") operates the Loko mobile applications, websites, and related services (together, the "Service") through which users request rides, food and grocery delivery, and other on-demand services from independent third-party providers. This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have. It applies to everyone who uses Loko — customers and order recipients, driver-partners and couriers, and merchant partners. By using the Service you agree to the collection and use of information as described here. Where we process your information, we do so in accordance with the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe and other applicable laws.
LOKO GO HUB (PRIVATE) LIMITED is the data controller responsible for your personal information. We are committed to handling personal data lawfully, fairly, and transparently. The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is the data-protection authority that supervises our processing of personal data.
You can reach our privacy team and our Data Protection Officer at privacy@lokoglobal.org for any question, request, or complaint relating to your personal information.
We collect information in three ways: information you give us, information generated when you use the Service, and information we receive from other sources. The exact information collected depends on whether you use Loko as a customer, a driver-partner or courier, or a merchant.
Account and profile information such as your name, phone number, email address, profile photo, password, and saved addresses and preferences.
Identity-verification and "Know Your Customer" (KYC) information, which for driver-partners and couriers (and in some cases customers) includes a government-issued identity document, such as a national identity card, together with a "selfie" or live facial image used to confirm that the document belongs to you. For driver-partners we may also collect a driver's licence, vehicle registration and roadworthiness details, and insurance information. Some of this information — in particular biometric facial data and national identity numbers — is treated as sensitive personal information and is collected only with your explicit consent (see Section 10).
Content you submit, such as ratings, reviews, photos, in-app chat messages, and support requests.
Payment information you enter to pay for, or get paid for, services (see Section 7).
Location data. For customers, we collect location while you are using the app — for example, from the time you request a ride or place an order until the trip or delivery is completed — so we can match you with a nearby provider and show the trip on a map. For driver-partners and couriers, we collect location while you are online and available so we can route work to you and let customers track an active trip or delivery. You control location permissions through your device settings; turning location off will limit core features.
Trip, order, and fare information, including pickup and drop-off points, delivery addresses, items ordered, and — because Loko uses a price-negotiation model — the estimated, suggested, and negotiated fares or offers exchanged between customers and providers.
Delivery confirmation information, such as proof-of-delivery photos and notes, where a courier records them.
Device and technical information, such as device model, operating system, app version, language, advertising and device identifiers, push-notification tokens, IP address, and crash and diagnostic logs.
Usage information about how you interact with the Service, including searches, pages viewed, and features used.
Communications. Calls and messages between customers and providers may be routed and, where lawful and disclosed, monitored or recorded for safety, support, and fraud-prevention purposes; phone numbers are masked where possible.
We may receive information from identity-verification and background-check providers, payment processors and mobile-money operators, merchants you transact with, other users (for example, the other party to your trip or order), and from law-enforcement or government bodies where required.
We use personal information to: provide and operate the Service and connect you with providers; calculate, suggest, and process fares, prices, and payments; verify identity and eligibility; keep the platform safe and detect, prevent, and investigate fraud and abuse; provide customer support; send you operational messages about your account, trips, and orders; improve and develop our services; send you marketing where you have not opted out; and comply with our legal obligations.
Depending on the purpose, our lawful basis for processing under the Cyber and Data Protection Act is one or more of: the performance of a contract with you; your consent (including explicit written consent for sensitive data); compliance with a legal obligation; the protection of your or another person's vital interests, such as in a safety emergency; and our legitimate interests in operating, securing, and improving the Service, balanced against your rights.
Some features rely on automated processing. We use automated systems to match customers with nearby providers; to recommend a suggested fare based on factors such as distance, route, location, and time of day (the final price is the one you and the provider agree); to detect and flag suspected fraud; and to verify identity documents. Where an automated decision would significantly affect you — for example, suspending an account for suspected fraud or safety reasons — we provide a means to request human review and to appeal, in accordance with applicable law.
We do not sell your personal information. We share it only as described below.
We share only what is needed to complete the service, and we minimise it. For deliveries, a courier typically receives the recipient's first name and last initial, the delivery address, a masked telephone number, the order details, and live location during the active delivery. For rides, the driver-partner receives the customer's first name and rating, pickup and drop-off information, and live location during the trip. Providers' names, photos, ratings, and (for rides) vehicle and number-plate details are shared with the customer.
When you order from a merchant, we share the information needed to prepare and fulfil your order. Merchants are independent businesses responsible for their own use of that information.
We share information with companies that perform services on our behalf under contract and confidentiality obligations — for example, cloud hosting, mapping, payment processing and mobile-money settlement, identity verification, push-notification delivery, analytics, and customer-support tools. They may only use the information to provide services to us.
We may disclose information to comply with the law, respond to lawful requests and legal process, enforce our terms, and protect the rights, property, and safety of Loko, our users, and the public. In an emergency, we may share information such as your name, phone number, approximate location, and trip details with emergency services or your nominated emergency contacts.
If Loko is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy. We may also create and share aggregated or de-identified information that cannot reasonably be used to identify you.
Location is central to a ride and delivery service. You can grant, limit, or withdraw location permissions at any time in your device settings. Customers can generally use the app with "while in use" location; driver-partners and couriers share location while online so that work can be dispatched and active trips tracked. Limiting location will reduce the accuracy and availability of core features.
Payments are processed through third-party payment gateways and mobile-money operators (such as Paynow, EcoCash, and OneMoney) and, where offered, by cash directly between users. We receive limited transaction details — for example, the amount, status, and a masked reference or the last digits of a card — but we do not store your full card number or mobile-money PIN. Your payment provider's own terms and privacy practices also apply.
We keep personal information only for as long as necessary for the purposes described in this Policy or as required by law. Operational trip and order records are generally retained for up to 24 months; financial, tax, and accounting records are retained for longer where the law requires (in Zimbabwe, financial records are generally kept for at least six years). Identity-verification documents and images are retained while your account is active and for a limited period afterwards for fraud-prevention and legal purposes, and are then deleted or de-identified.
Subject to applicable law, you have the right to: be informed about how we use your data; access the personal information we hold about you; have inaccurate information corrected; request deletion of your information; object to or restrict certain processing; withdraw consent where processing is based on consent; and request a copy of certain information in a portable form. You can exercise these rights in the app or by contacting privacy@lokoglobal.org. We may need to verify your identity before acting on a request, and some information may be retained where we have a legal obligation or a safety, security, or fraud-prevention reason to keep it. You also have the right to lodge a complaint with POTRAZ.
Certain information we collect for identity verification — in particular national identity numbers and biometric facial/"liveness" data used to confirm your identity — is sensitive personal information under Zimbabwe law. We collect and process it only with your explicit consent, only for identity verification, safety, fraud-prevention, and regulatory-compliance purposes, and we apply additional safeguards to it. You may withdraw your consent, though doing so may mean we can no longer verify you and you may be unable to continue as a driver-partner or courier.
Some of our service providers — for example, cloud hosting, payment processing, mapping, and push-notification delivery — operate outside Zimbabwe, so your information may be transferred to and processed in other countries. Where we transfer personal information across borders, we do so only where the receiving country offers an adequate level of protection or where we have put appropriate contractual and technical safeguards in place, consistent with the Cyber and Data Protection Act.
We use appropriate technical and organisational measures to protect personal information, including encryption of data in transit and at rest, access controls, and additional protection for sensitive identity data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work continuously to safeguard your information.
The Service is intended for adults. You must be at least 18 years old to hold a Loko account. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.
If a personal-data breach occurs that is likely to present a risk to you, we will notify POTRAZ and, where required, affected individuals, in line with the timeframes set out in Zimbabwe's data-protection regulations.
You can permanently delete your account at any time from within the app — customers via Account → Manage Account → Delete Account, and driver-partners and couriers via the Delete Account option in the home menu. You must first complete or cancel any in-progress trip or order. Deletion permanently removes your profile, your login identity (including your authentication record), and any identity-verification (KYC) documents you uploaded. For legal, tax, and fraud-prevention obligations we retain certain transactional records — such as completed trips, orders, and earnings or payout history — in a de-identified form that is no longer linked to your personal identity, for the periods described in Section 8.
We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised Policy.
Questions about this policy, or want to exercise your rights? Contact our Data Protection Officer at privacy@lokoglobal.org.