Privacy notice

Caravel Rentals Zambia operates Kito and is the data controller for the personal data described here, as defined in the Data Protection Act No. 3 of 2021 ("the Act"). Caravel will register with the Office of the Data Protection Commissioner as the Act requires.

• Account data: name, email, phone number and app preferences.
• Identity data: NRC or passport number and images, and a live facial photo for matching.
• Driving licence: licence number, class, expiry and images.
• Location data: delivery and collection pins and addresses you enter, and airport or hotel choices. We do not track your phone's location in the background.
• Mobile money and transaction records: network, paying number, amounts, escrow status and payout details. We never collect your PIN.
• Trip records: bookings, handover checklists, vehicle photos, signatures and support messages.
• Hosts: vehicle details, registration and RTSA document dates, and payout account details.

• Performing our contract with you — creating your account, pricing and managing bookings, delivering cars and paying hosts.
• Legal obligations — confirming drivers are licensed under the Road Traffic Act, keeping tax records for the Zambia Revenue Authority, and anti-fraud and anti-money-laundering record keeping.
• Legitimate interests — preventing fraud and theft of vehicles, resolving disputes and keeping the platform secure, balanced against your rights.
• Consent — for your facial photo and identity images used for verification, and for optional push notifications. You may withdraw consent, but we then cannot verify you to hire.

Identity documents and facial images are treated as sensitive personal data and processed only for verification and fraud prevention.

An AI tool may flag unreadable or mismatched documents for staff. It never approves or rejects you: every verification decision is made by a person, and you can ask for a decision to be reviewed.

Only people who need it: verification staff, the host and driver for your booking (first name, delivery details and contact needed for the trip), and finance staff for payments. We share data with mobile money providers to process payments, with our hosting and messaging providers under written agreements, and with the Zambia Police, RTSA, ZRA or courts when the law requires. We do not sell your data.

Identity documents and vehicle photos are kept in private storage and shown only through short-lived links. Access is role-limited and staff actions are logged in a tamper-evident audit trail. Some of our service providers may store data outside Zambia; where this happens we will transfer data only as the Act allows, with appropriate safeguards and, where required, your consent or the Commissioner's authorisation.

If a personal data breach is likely to harm you, we will notify the Data Protection Commissioner and affected users as the Act requires.

• Identity and licence images: while your account is active and for up to 2 years after your last trip, unless needed for an open dispute or legal claim.
• Transaction, escrow and payout records: for the period required by Zambian tax and anti-money-laundering law.
• Location pins and handover photos: up to 2 years after the trip, or longer if part of a dispute.

Under the Act you may ask to access your data, correct it, have it deleted where we no longer need it, restrict or object to processing, withdraw consent, receive a copy in a portable form, and not be subject to decisions made solely by automated means. We aim to reply within 30 days. If you are unhappy with our response you may complain to the Office of the Data Protection Commissioner of Zambia.

We will post any update to this notice here and tell you in the app if the change is significant.