Privacy & Personal Data Protection Framework

1. Overview & Commitment to Your Privacy

EzyTravels Ghana Limited (“EzyTravels”, “we”, “our”, or “us”) is designed to protect passenger personal information in alignment with the Ghana Data Protection Act, 2012 (Act 843).

This policy explains how passenger data will be collected, stored, processed, and safeguarded when reserving intercity bus tickets, creating an account, booking through station agents, or using our mobile clients.

2. Information We Collect

To deliver transport booking and passenger manifest services, we collect:

• Passenger Identity Data: Full legal name, Ghana Card (NIA number) or passport number (where required by carriers), gender, and date of birth.
• Contact Information: Active Ghanaian mobile phone number (for SMS ticket dispatch and USSD Mobile Money prompts) and email address.
• Journey & Itinerary Details: Departure city, destination city, travel date, seat selection, bus operator (STC, VIP, OA), and digital boarding barcode.
• Financial Transaction Records: Mobile Money network provider (MTN, Telecel, AT), masked account identifier, transaction reference, and double-entry ledger entries. Note: EzyTravels never stores Mobile Money PINs or full bank payment card CVVs.

3. Purpose & Legal Basis for Processing

Under Act 843, we process your personal data under the following legal bases:

4. Data Sharing & Third-Party Processors

We only share passenger data strictly as required to fulfill travel services:

• Licensed Bus Operators (STC, VIP Jeoun, OA Travel, VVIP): Provided with official departure manifests containing passenger names, phone numbers, and assigned seat numbers for conductor boarding.
• Payment Processors & Gateways (Hubtel Ghana / Mobile Money): Provided with telephone numbers, payment amounts, and order references to process automated USSD billing.
• SMS & Email Gateways: Provided with recipient phone numbers and emails solely for instant delivery of digital tickets and schedule alerts.

5. Technical & Organizational Security Measures

EzyTravels employs enterprise-grade defensive architecture to protect personal data:

• Encryption in Transit: All web and mobile communications enforce TLS 1.3 with strict HTTP Strict Transport Security (HSTS).
• Encryption at Rest: Supabase PostgreSQL databases and backup snapshots are encrypted with AES-256.
• Cryptographic Digital Signatures: Boarding barcodes use Ed25519 asymmetric cryptography with managed key IDs to prevent ticket forgery.
• Zero-Trust Cloudflare Hyperdrive: Database queries route over private encrypted connections with prepared parameterized SQL queries to prevent SQL injection.

6. Your Rights Under Ghana Act 843

As a data subject under Ghanaian law, you possess enforceable rights:

• Right of Access: You may request a copy of all personal records and travel bookings associated with your account.
• Right to Rectification: You may update or correct inaccurate passenger or contact details via your Customer Account Portal.
• Right to Erasure: You may request the deletion of your account and saved passenger profiles, subject to statutory financial retention requirements.
• Right to Object: You may opt out of marketing communications at any time.

7. Data Protection & Privacy Point of Contact

To exercise data protection rights, request profile erasure, or raise inquiries regarding personal data processing, please contact the platform data privacy desk: