Last updated 26 August 2026

Privacy Policy

How Thuma Express collects, uses, shares and protects your information, including every permission our mobile apps request.

1. Introduction

This Privacy Policy explains how Thuma Express Holdings, Inc. and its subsidiaries Thuma Express Zimbabwe (Pvt) Limited and ThumaPay Zimbabwe (Pvt) Limited (together, "Thuma Express," "we," "us," or "our") collect, use, share, and protect information when you use any service on the Thuma Express platform — including Thuma Express, ThumaFleet, ThumaDrop, ThumaTrade, ThumaPay, ThumaCredit, ThumaShield, ThumaRescue, ThumaChauffeur, ThumaRide, ThumaIT, ThumaGlobal, and ThumaHub (together, the "Services"). Last updated: 26 August 2026.

2. Who We Are

2.1 Who publishes the apps, and who processes your data

An app store listing names a single publisher, but the day-to-day processing of your data is carried out by our operating companies. Both are set out here so it is clear who is responsible for what.

Entity	Role
Thuma Express Holdings, Inc. Delaware, USA	Publisher of the mobile applications. The Thuma Express and ThumaPay apps are published on the Apple App Store and Google Play under this entity’s developer account. It owns the platform intellectual property and acts as overall data controller for the group.
Thuma Express Zimbabwe (Pvt) Limited Harare, Zimbabwe	Operator and processor — logistics and mobility. Delivers the courier, ride-hailing, fleet and roadside services in Zimbabwe, and processes the trip, delivery, driver and location data those services generate.
ThumaPay Zimbabwe (Pvt) Limited Harare, Zimbabwe	Operator and controller — financial services. Operates the wallet, payments, ThumaCredit advances and ThumaShield cover, and is the controller for financial, identity-verification and transaction data.

If you have a question about your data and are unsure which entity to contact, write to privacy@thumaexpress.com and we will route it to the correct controller.

2.2 Corporate relationship

Thuma Express Holdings, Inc. is the parent company, incorporated in Delaware, USA, and is the controller of information collected across the platform globally. Thuma Express Zimbabwe (Pvt) Limited operates our logistics and mobility services. ThumaPay Zimbabwe (Pvt) Limited is the controller for information relating to ThumaPay, ThumaCredit, and ThumaShield.

3. Information We Collect

Information you provide: name, contact details, date of birth, national ID or passport details for identity verification (KYC), delivery and pickup addresses, and payment details.

Information collected automatically: device identifiers, IP address, app usage data, precise and approximate location (where enabled), and log data such as crash reports and access times.

Information from third parties: identity verification providers, mobile money partners (EcoCash, InnBucks, OneMoney), and credit history relevant to ThumaCredit eligibility.

4. How We Use Your Information

We use your information to: provide and operate the Services (deliveries, payments, advances, insurance cover, rides, and hub transactions); verify your identity and prevent fraud; process payments and payouts; communicate with you about bookings, transactions, and account activity; comply with legal and regulatory obligations, including anti-money-laundering requirements; and improve and develop the Services.

5. Legal Bases for Processing

Depending on your location, we process your information on one or more of the following bases: performance of a contract with you; compliance with a legal obligation; our legitimate interests in operating and securing the platform; and your consent, where required, such as for optional marketing communications.

6. How We Share Your Information

We share information with: drivers, operators, and hub staff to the extent needed to fulfil a booking; payment processors and mobile money partners to complete transactions; regulators, courts and law enforcement, where legally required; and service providers who support our infrastructure (such as cloud hosting and analytics), under contractual confidentiality obligations. We do not sell your personal information to third parties.

7. International Data Transfers

Because Thuma Express Holdings, Inc. is incorporated in the United States and our operating subsidiaries are based in Zimbabwe, your information may be transferred between these jurisdictions and processed on servers outside your home country. Where required, we put appropriate contractual and technical safeguards in place for such transfers.

8. Data Retention

We retain your information for as long as your account is active and as needed to provide the Services. Typical retention periods are: account and profile information for the lifetime of your account plus 5 years after closure; transaction, payment, and KYC records for 5 years after the transaction or account closure, in line with anti-money-laundering record-keeping standards; ThumaShield claims records for 7 years after a claim is closed; customer support communications for 3 years; and device, location, and analytics data for up to 24 months. Where a longer retention period is required by Zimbabwean, U.S., or other applicable law, we retain information for that legally mandated period.

9. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption of payment data in transit, access controls, and regular security reviews. No system is completely secure, and we encourage you to use a strong, unique password and to safeguard your login credentials.

10. Your Rights

Subject to applicable law — including Zimbabwe's Cyber and Data Protection Act — you may have the right to: access the information we hold about you; request correction of inaccurate information; request deletion of your information, subject to our legal retention obligations; object to or restrict certain processing; request a portable copy of your data; and withdraw consent where processing is based on consent. To exercise these rights, contact us using the details in Section 16.

11. Children and Teenagers

11.1 Nobody under 13

The Services are not available to anyone under 13, anywhere. This is enforced in the product, not merely stated here: an account cannot be created with a date of birth below that age, and the refusal cannot be dismissed or worked around. We do not knowingly collect personal information from a child under 13. If you believe a child has given us information, write to privacy@thumaexpress.com and we will delete it.

11.2 A 13–17 year old is a supervised member, never an independent user

A teenager between 13 and 17 cannot sign up for Thuma Express on their own. There is no path in the app that lets them try. A teen account exists only when an adult adds them to that adult's Circle — a family or household group — and the adult supplies the teen's date of birth and sets the limits the account will run under. That invitation is the parental consent, and we keep it as a permanent record: who consented, for whom, the limits they set, and when. The record cannot afterwards be edited or deleted, by them or by us.

The teenager then accepts on their own phone using a one-time code. That step proves the phone belongs to them; it never creates an account on its own.

11.3 What a teen account holds, and what it never holds

We collect	We do not
The teen's name, phone number and date of birth, given by the guardian at invitation.	No national identity document and no identity-verification (KYC) file. A teen is never asked for one, because a teen can neither drive nor hold a wallet.
Trips they book: pickup and drop-off, times, distance and fare.	No payment card, bank account or mobile-money instrument in the teen's name. Trips are paid for out of the guardian's Circle balance.
Precise location while a trip is being booked or is under way, so the driver can find them and the guardian can follow the trip.	No background location. Background location is requested only from drivers and couriers on duty, and a teen cannot be one.
Device identifiers, app usage and crash data, as for any account.	No credit history and no lending data. ThumaCredit is a driver-side product and is closed to teen accounts.

11.4 What the guardian can see and do

The adult who invited the teenager can see the trips the teen takes, including live tracking while a trip is running; can set and change a monthly spending limit and an amount above which a trip must be approved before it goes ahead; and can remove the teen from the Circle at any time, which stops the account being able to book. A guardian may also exercise the rights in Section 10 — access, correction and deletion — on the teenager's behalf, by writing to privacy@thumaexpress.com from the phone number or email on the Circle.

We show the teenager, in the app, that their guardian can see their trips. We do not operate hidden monitoring.

11.5 Turning 18

Supervision ends by itself. Age is worked out from the recorded date of birth each time the account is read, so on their eighteenth birthday the account stops being a supervised one and becomes an ordinary adult account, with no action needed from anyone. Until then, the restrictions above are not preferences that can be switched off.

11.6 No advertising

We serve no advertising in the Services, to anyone, and we do not sell personal information. There is no advertising profile built from a teenager's use of Thuma Express.

12. Cookies and Tracking Technologies

Our website and app use cookies and similar technologies as described in our Cookie Policy, including for essential functionality, analytics, and — where you consent — personalisation.

13. Marketing Communications

We may send you service-related communications (such as booking confirmations and security alerts), which you cannot opt out of while your account is active, and marketing communications, which you can opt out of at any time via account settings or the unsubscribe link provided.

14. Third-Party Links and Services

The Services may link to or integrate with third-party services, such as mobile money providers. This Policy does not cover the privacy practices of those third parties, and we encourage you to review their respective policies.

15. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated through the app, website, or email prior to taking effect. The "Last updated" date at the top of this Policy reflects the most recent revision.

16. How to Contact Us

Questions, requests, or complaints about this Policy or our data practices can be sent to privacy@thumaexpress.com or to Thuma Express Holdings, Inc., 2093 Philadelphia Pike, Suite #1252, Claymont, DE 19703, USA. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in Zimbabwe or your jurisdiction of residence.

17. Permissions and Data Collected by Our Mobile Apps

This section describes data our mobile applications collect that goes beyond what a visitor to our website provides. Each permission is optional at the operating-system level: you may decline it, and we explain below what stops working if you do. We request a permission only at the point it is first needed, never in bulk on first launch.

17.1 Location

Permission	Why we ask, and what happens if you decline
Precise location (foreground)	Used to set your pickup point, match you to the nearest available driver or vehicle, calculate fares and delivery distances, and show live tracking on the map. The driver assigned to your trip sees your location for as long as the trip runs, and on a supervised teen account the guardian who set the account up sees it too (Section 11.4). If you decline, you can still enter addresses manually, but automatic pickup detection and live tracking will not work.
Precise location in the background	Requested only from driver and courier accounts, and only while you are logged in and on duty. It is used to dispatch nearby jobs to you, to give the customer live tracking of their trip or parcel, to calculate the distance your trip actually covered for fare and payout purposes, and to support safety features such as route reconstruction after an incident. Background collection stops when you go off duty or log out. Passenger and sender accounts are never asked for background location. If a driver declines, they can still use the app but cannot receive dispatched jobs.
Approximate location	Used to show the correct city, currency and available services when precise location is unavailable or declined.

Location data is retained in association with a completed trip or delivery for the period described in Section 8. It is not sold, and it is not used to build advertising profiles.

17.2 Camera

Used to photograph proof of delivery, to capture damage or condition evidence when a ThumaShield claim is raised, to scan QR codes at a ThumaHub, to scan identity documents during account verification, and to set a profile photo. Images are uploaded only when you take an action that submits them. We do not access the camera in the background.

17.3 Microphone and voice recordings

Used only for the in-app voice note feature, where you may record a short message to a driver or to support instead of typing, and for in-app calling where that feature is enabled. Recordings are transmitted only when you choose to send them. We do not record ambient audio, and we do not access the microphone in the background or while the app is closed.

17.4 Contacts

Used only if you choose to send a parcel to, request a ride for, or transfer money to someone in your address book, so you do not have to type their details. Contact data is read on the device to populate the picker. We upload only the single contact you select for that transaction, and we do not upload, store or index your full address book.

17.5 Biometrics (Face ID, Touch ID, fingerprint)

Offered as an optional way to unlock the app and to authorise ThumaPay transactions in place of entering a PIN. Biometric matching is performed entirely by your device's own secure hardware. We never receive, transmit or store your fingerprint, face map or any biometric template. The app is told only whether the device authenticated you successfully.

17.6 Notifications

Used to tell you that a driver has been assigned, that a parcel is arriving, that a payment or payout has completed, and to send security alerts about your account. Marketing notifications are separate and off unless you opt in.

17.7 Photos and files

Accessed only when you choose to attach an existing image, for example uploading an identity document or adding a photo to a support ticket or insurance claim.

17.8 Device and diagnostic information

We collect device model, operating system version, app version, a resettable app instance identifier, crash logs and performance data. This is used for security, fraud prevention and fixing faults. Analytics collection follows the consent choice described in Section 12.

17.9 Data we do not collect

We do not collect your call history, SMS messages, browsing history from other apps, health data, or the contents of other applications on your device. We do not use the microphone or camera for advertising purposes.

17.10 Withdrawing a permission

You can withdraw any permission at any time in your device settings, under the entry for the Thuma Express or ThumaPay app. Withdrawing a permission disables the related feature but does not close your account or delete data already collected. To delete your account and data, see Delete your account.

18. Deleting Your Account and Data

You can request deletion of your account and associated personal data at any time, without installing the app and without logging in. The full procedure, what is deleted, what we are legally required to retain, and how long each step takes, is set out on a dedicated page: Delete your account.

19. If You Have Applied for a Job With Us

Applying through careers.thumaexpress.com is different from using the Services, and we treat it differently. This section covers applicants; sections 1 to 18 cover people using the Services.

What we collect: what you type into the application form, any CV or document you attach, where you are applying to work and your right to work there where a role requires it, and what happens to the application afterwards — our notes, interview feedback and the decision.

What we do not want. Please do not send us a national identity number, a bank account, a photograph of yourself, a date of birth, or anything about your health, religion, politics or trade union membership. If one of those arrives in a document anyway we remove it. Identity and banking details are asked for only after an offer has been accepted.

Why we may hold it: because you asked us to consider you, and considering you is not possible without it; because we have a legitimate interest in filling roles and in being able to show how a decision was reached; and, where a role requires a check the law obliges us to run, because the law obliges us to run it.

Who reads it: the people hiring for that role, the people who interview you, and whoever handles employment paperwork in that market. Our email and hosting providers carry it as they carry everything else. We do not sell applications, share them with other employers, or join them to a customer account.

How long we keep it: twelve months from the decision if you are not offered the role, then it is deleted. If you ask us to delete it sooner we do, and that ends your application. If you join us it becomes part of your employment record.

No hiring decision at Thuma is made by an automated system. Software sorts and searches applications; a person decides.

Write to careers@thumaexpress.com for a copy of what we hold, a correction, or deletion. The company that would employ you is named on the advert and is not always the same one across markets.

20. If You Subscribe to the Status Page

status.thumaexpress.com lets you ask to be told when something breaks. We keep the email address or webhook address you give us, the components you asked about, and the messages we sent you.

That address is used for incident notices and for nothing else. Every notice carries a link that unsubscribes you, and unsubscribing deletes the subscription. You do not need an account to subscribe, and subscribing does not create one.