LyniaGo is an on-demand marketplace in Zimbabwe. You can send a parcel across town by motorbike — naming your own price, with nearby riders accepting or countering and you choosing who carries it — and you can order food from a restaurant and have a rider bring it to you. This notice explains what personal data we collect to run that service, why, how long we keep it, and how you can get it deleted.
It applies to the LyniaGo Android app (zw.co.lynia) and the Lynia service behind
it. Lynia is the data controller for the purposes of Zimbabwe's Cyber and Data
Protection Act, 2021 ("the Act"), which is enforced by the Postal and Telecommunications
Regulatory Authority of Zimbabwe (POTRAZ).
Three different people use LyniaGo, and we hold different data about each. Read the row that applies to you — one person can be more than one.
The Act requires us to have a lawful basis for each use of your data, so we state it per category rather than in the abstract.
| Category | What | Why | Legal basis | How long |
|---|---|---|---|---|
| Name and contact details | Your first and last name, mobile phone number, and (optionally) email address. | To create and secure your account, sign you in by one-time code, and let the other party to an order identify who they are meeting. | Performance of your contract with us; your consent for the optional email address. | Kept for the life of your account; anonymised when you delete it. |
| Government ID and vehicle details (riders only) | Your national ID number, a photo of your ID and of your face, and your motorbike's registration and vehicle details — collected only if you register as a rider. | Identity verification (KYC) — a legal and safety requirement before anyone may carry another person's parcel or food — the signal used to stop a banned rider re-registering, and the vehicle record shown to the customer whose order you are carrying. | Your explicit consent, given when you start rider verification. Your national ID number and the photograph of your face are SENSITIVE personal information under the Cyber and Data Protection Act, so we ask for them only for verification and never use them for anything else. You can withdraw consent by deleting your rider account. | The ID number is encrypted at rest and cleared when you delete your account, along with your vehicle details. ID and face images are held for the legal minimum after a rider account goes inactive or is rejected, then deleted automatically. |
| Precise location | Your device's GPS position: the pickup and drop-off points you set, your saved addresses, and — for riders only, while an order is in progress — a live position trail. Rider location continues to update while the app is in the background so the customer can follow the delivery; this is shown by a persistent Android notification and stops when the delivery ends or you go offline. | To match an order to nearby riders, show you restaurants near you, show the customer where their order is, price a trip by distance, and support safety and dispute investigations. | Performance of your contract with us — a delivery cannot be matched, priced or tracked without it. As a customer you may type an address instead of sharing GPS. | Coordinates on delivery events and SOS alerts are erased 90 days after the event. A rider's live position is cleared as soon as they go offline or delete their account. Saved addresses are deleted with your account. |
| Food and shop orders | What you ordered from a restaurant or shop, any note you attached to a dish, and — if you tell us you paid the restaurant by another method — the mobile-money transaction reference you enter. | To send your order to the restaurant's kitchen board, let them prepare it correctly, let them confirm they were paid, and resolve disputes about what was ordered or paid. | Performance of your contract with us and with the restaurant you ordered from. | Order contents are retained as a financial and dispute record. Your per-dish notes and the mobile-money reference are scrubbed when you delete your account — the reference is a handle into your own mobile-money history, so it is removed rather than kept. |
| Photos | Photos you choose to attach — an item photo on a delivery request, a pickup or proof-of-delivery photo, and a rider profile photo. | To describe the parcel, evidence hand-over, and resolve disputes about what was delivered. | Performance of your contract with us; you choose whether to attach one. | Held for the life of the order; the stored images are deleted when you delete your account. |
| App activity and order history | Your orders, prices offered and accepted, ratings and free-text comments, support issues and reports you file. | To run the marketplace, show your history, calculate earnings, and keep a record for disputes, fraud investigation and financial compliance. | Performance of your contract with us; our legitimate interest in preventing fraud and abuse; and our legal obligation to keep financial records. | Order, rating and audit records are retained as a financial and dispute record. Free text you wrote (rating comments, cancellation reasons, order notes, issue descriptions, reports) is scrubbed when you delete your account, and the records that remain no longer identify you. |
| Financial information | For riders: the mobile-money number used to top up the prepaid commission wallet, and that wallet's transaction ledger. Lynia never takes payment for the goods being delivered — customers pay riders, or restaurants, directly. | To credit wallet top-ups and charge the per-delivery commission. | Performance of your contract with us, and our legal obligation to keep accurate financial records. | The ledger is retained as a financial record; the stored mobile-money number is cleared when you delete your account. |
| Device identifiers and diagnostics | A push-notification token for your device, your sign-in sessions, and crash/performance diagnostics (which may include the app version, device model and OS version). | To deliver notifications about your orders, keep you signed in securely, and detect and fix crashes and slow screens. | Performance of your contract with us for notifications and sessions; our legitimate interest in a working, secure app for diagnostics. | The push token and your sessions are deleted when you sign out or delete your account. Diagnostic records are held by our processors on their standard retention schedules. |
Location is the most sensitive thing we handle routinely, so it is worth being precise:
When you order from a restaurant, the restaurant needs enough to cook and hand over your order, and no more. Their kitchen board shows the dishes, your per-dish notes, and the delivery point. If you use "I paid another way" and enter a mobile-money reference, the restaurant sees that reference so they can match it against their own statement. They never see your national ID, your saved addresses, or any order you placed with anyone else.
We are not the payment processor. Money for your food, and money for the goods in a parcel, moves directly between you and the restaurant or the rider. Lynia's only charge is a commission it takes from riders through their prepaid wallet.
LyniaGo runs on Microsoft Azure in the South Africa North (Johannesburg) region. That means your personal data — the database, uploaded images, and backups — is stored in South Africa, not in Zimbabwe. We use that region because it is the closest to Harare, which makes the app faster and cheaper to use on a mobile connection.
Some of our providers (for push notifications, crash reporting and analytics) also process data outside Zimbabwe. This is a cross-border transfer of personal data under the Act. It is necessary to provide the service you asked us for, our providers are bound by contract to protect your data and to process it only on our instructions, and everything is encrypted in transit. If you would rather your data were not transferred, you cannot use LyniaGo — we have no local-only mode, and we would rather say so than imply otherwise.
Under the Act you have the right to:
Write to support@lyniafinance.com to exercise any of these. We answer within 30 days. We may ask you to confirm your identity first, so that nobody else can obtain or delete your data by pretending to be you.
If you are not satisfied with how we handle your request, you may complain to POTRAZ, Zimbabwe's data protection authority.
LyniaGo is not intended for anyone under 18, and riders must pass identity verification. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.
If we change what we collect or why, we update this page and change the date at the top. Material changes are announced in the app before they take effect.
Questions, complaints, or a data request: support@lyniafinance.com.
This notice is governed by the laws of Zimbabwe, and in particular the Cyber and Data Protection Act, 2021.