Privacy Policy

Customers: name, phone number, email address, delivery addresses and access instructions, order and bottle-deposit history, delivery PIN records, ratings you leave, support messages, and device/technical data such as IP address and browser type.

Drivers: the above plus date of birth, home address, parish, emergency contact, driving licence and insurance references, vehicle details, background and document checks, availability, route history, earnings, and location while you are online or on an active route.

Hub operators and supplier staff: name, business contact details, role, hub membership, inventory and route actions carried out under your login.

Payments: card details are entered directly into Stripe. We receive only a payment reference, the amount, the outcome, and the card's last four digits and brand. We never receive or store your full card number.

To perform our contract with you: creating your account, taking payment, allocating your order to a hub, planning routes, letting a driver find you, verifying handover by PIN, tracking bottle deposits, and handling refunds and support.

For our legitimate interests: fraud prevention, safety of drivers and customers, service quality and ratings, demand forecasting and capacity planning, product improvement and security monitoring — balanced so as not to override your rights.

To meet legal obligations: tax and accounting records, responding to lawful requests, and payment-industry requirements.

With your consent: optional marketing messages and non-essential cookies. You can withdraw consent at any time without affecting the service you receive.

Driver location is collected only while a driver is online or running an active route, and it stops when they go offline or the route is closed. It is used for offering nearby routes, navigation, live tracking of your order and proof of delivery.

Customers see an approximate driver position for their own active delivery only. Drivers see a customer address only for the stops on their current route, and access ends when the route closes.

We do not sell location data and we do not use it to profile people outside the delivery service.

The supplier or hub filling your order sees the items, the delivery zone and the order reference. The assigned driver sees your name, delivery address, access instructions and contact number for the duration of that delivery only.

Service providers acting on our instructions: Stripe (payments), our cloud hosting and database provider, mapping and routing providers, and messaging providers. Where an overflow delivery partner is used at times of peak demand, that partner receives only the pickup and drop-off details needed to complete the delivery.

Authorities, insurers or advisers where we are legally required to disclose, or to establish, exercise or defend legal claims.

We never sell your personal information.

Some of our providers process data outside Jamaica. Where that happens we rely on providers offering an appropriate level of protection and contractual safeguards covering security, confidentiality and onward transfer.

Account and profile data: for as long as your account is open, then up to 12 months after closure to handle disputes and prevent re-registration by suspended users.

Order, payment, bottle-deposit and settlement records: 7 years, to meet accounting and tax requirements.

Driver location and route event logs: 12 months, for safety, pay disputes and delivery evidence.

Support tickets and messages: 3 years. Marketing consents: until withdrawn.

Access is enforced at the database level by row-level security, so customers, drivers, hub operators and staff can only reach the records their role requires. Staff access to the control centre is invite-only and role-based, and sensitive actions are written to an audit log.

Traffic is encrypted in transit, delivery handovers use short-lived one-time codes, and payment credentials are held by Stripe rather than by us.

No system is perfectly secure. If a breach is likely to affect your rights, we will notify you and the relevant authority without undue delay.

You may request access to your data, correction of inaccurate data, deletion, restriction of processing, objection to processing based on legitimate interests, and a portable copy of the data you gave us. You may also withdraw marketing consent at any time.

Make a request through in-app support or by emailing privacy@watadash.com. We respond within 30 days and may ask you to verify your identity first.

Some data cannot be deleted immediately where we must keep it for legal, tax or fraud-prevention reasons; in that case we restrict its use instead.

If you are unhappy with our response you may complain to the Information Commissioner in Jamaica.

WataDash is not intended for anyone under 18. We do not knowingly collect data from children, and we delete it if we discover we have.

We will post any change to this policy here and update the date at the top. Material changes are notified in the app or by email.

Data protection contact: privacy@watadash.com. Postal address: Wata Dash Ltd, Kingston, Jamaica.