Last updated 24 July 2026

Privacy Policy

How Thuma Express collects, uses, shares and protects your information, including every permission our mobile apps request.

1. Introduction

This Privacy Policy explains how Thuma Express Holdings, Inc. and its subsidiaries Thuma Express Zimbabwe (Pvt) Limited and ThumaPay Zimbabwe (Pvt) Limited (together, "Thuma Express," "we," "us," or "our") collect, use, share, and protect information when you use any service on the Thuma Express platform — including Thuma Express, ThumaFleet, ThumaDrop, ThumaPay, ThumaCredit, ThumaShield, ThumaRescue, Thuma Chauffeur, ThumaRide, Thuma It, Thuma Global, and Thuma Hub (together, the "Services"). Last updated: July 2, 2026.

2. Who We Are

2.1 Who publishes the apps, and who processes your data

An app store listing names a single publisher, but the day-to-day processing of your data is carried out by our operating companies. Both are set out here so it is clear who is responsible for what.

Entity	Role
Thuma Express Holdings, Inc. Delaware, USA	Publisher of the mobile applications. The Thuma Express and ThumaPay apps are published on the Apple App Store and Google Play under this entity’s developer account. It owns the platform intellectual property and acts as overall data controller for the group.
Thuma Express Zimbabwe (Pvt) Limited Harare, Zimbabwe	Operator and processor — logistics and mobility. Delivers the courier, ride-hailing, fleet and roadside services in Zimbabwe, and processes the trip, delivery, driver and location data those services generate.
ThumaPay Zimbabwe (Pvt) Limited Harare, Zimbabwe	Operator and controller — financial services. Will operate the wallet, payments, ThumaCredit advances and ThumaShield insurance distribution, and is the controller for financial, identity-verification and transaction data. Its licence applications with the Reserve Bank of Zimbabwe and IPEC are in progress; it does not yet process regulated financial data.

If you have a question about your data and are unsure which entity to contact, write to privacy@thumaexpress.com and we will route it to the correct controller.

2.2 Corporate relationship

Thuma Express Holdings, Inc. is the parent company, incorporated in Delaware, USA, and is the controller of information collected across the platform globally. Thuma Express Zimbabwe (Pvt) Limited operates our logistics and mobility services. ThumaPay Zimbabwe (Pvt) Limited has applications in progress with the Reserve Bank of Zimbabwe and IPEC, and will act as controller for information relating to ThumaPay, ThumaCredit, and ThumaShield.

3. Information We Collect

Information you provide: name, contact details, date of birth, national ID or passport details for identity verification (KYC), delivery and pickup addresses, and payment details.

Information collected automatically: device identifiers, IP address, app usage data, precise and approximate location (where enabled), and log data such as crash reports and access times.

Information from third parties: identity verification providers, mobile money partners (EcoCash, InnBucks, OneMoney), credit history relevant to ThumaCredit eligibility, and insurance underwriting partners for ThumaShield.

4. How We Use Your Information

We use your information to: provide and operate the Services (deliveries, payments, advances, insurance cover, rides, and hub transactions); verify your identity and prevent fraud; process payments and payouts; communicate with you about bookings, transactions, and account activity; comply with legal and regulatory obligations, including anti-money-laundering requirements; and improve and develop the Services.

5. Legal Bases for Processing

Depending on your location, we process your information on one or more of the following bases: performance of a contract with you; compliance with a legal obligation (including regulatory requirements under the Reserve Bank of Zimbabwe and IPEC); our legitimate interests in operating and securing the platform; and your consent, where required, such as for optional marketing communications.

6. How We Share Your Information

We share information with: drivers, operators, and hub staff to the extent needed to fulfil a booking; payment processors and mobile money partners to complete transactions; insurance underwriting partners for ThumaShield claims; regulators and authorities including the Reserve Bank of Zimbabwe, IPEC, and law enforcement, where legally required; and service providers who support our infrastructure (such as cloud hosting and analytics), under contractual confidentiality obligations. We do not sell your personal information to third parties.

7. International Data Transfers

Because Thuma Express Holdings, Inc. is incorporated in the United States and our operating subsidiaries are based in Zimbabwe, your information may be transferred between these jurisdictions and processed on servers outside your home country. Where required, we put appropriate contractual and technical safeguards in place for such transfers.

8. Data Retention

We retain your information for as long as your account is active and as needed to provide the Services. Typical retention periods are: account and profile information for the lifetime of your account plus 5 years after closure; transaction, payment, and KYC records for 5 years after the transaction or account closure, in line with anti-money-laundering record-keeping standards; ThumaShield claims records for 7 years after a claim is closed; customer support communications for 3 years; and device, location, and analytics data for up to 24 months. Where a longer retention period is required by Zimbabwean, U.S., or other applicable law, we retain information for that legally mandated period.

9. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption of payment data in transit, access controls, and regular security reviews. No system is completely secure, and we encourage you to use a strong, unique password and to safeguard your login credentials.

10. Your Rights

Subject to applicable law — including Zimbabwe's Cyber and Data Protection Act — you may have the right to: access the information we hold about you; request correction of inaccurate information; request deletion of your information, subject to our legal retention obligations; object to or restrict certain processing; request a portable copy of your data; and withdraw consent where processing is based on consent. To exercise these rights, contact us using the details in Section 16.

11. Children's Privacy

The Services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us so we can take appropriate action.

12. Cookies and Tracking Technologies

Our website and app use cookies and similar technologies as described in our Cookie Policy, including for essential functionality, analytics, and — where you consent — personalisation.

13. Marketing Communications

We may send you service-related communications (such as booking confirmations and security alerts), which you cannot opt out of while your account is active, and marketing communications, which you can opt out of at any time via account settings or the unsubscribe link provided.

14. Third-Party Links and Services

The Services may link to or integrate with third-party services, such as mobile money providers. This Policy does not cover the privacy practices of those third parties, and we encourage you to review their respective policies.

15. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated through the app, website, or email prior to taking effect. The "Last updated" date at the top of this Policy reflects the most recent revision.

16. How to Contact Us

Questions, requests, or complaints about this Policy or our data practices can be sent to privacy@thumaexpress.com or to Thuma Express Holdings, Inc., 2093 Philadelphia Pike, Suite #1252, Claymont, DE 19703, USA. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in Zimbabwe or your jurisdiction of residence.

17. Permissions and Data Collected by Our Mobile Apps

This section describes data our mobile applications collect that goes beyond what a visitor to our website provides. Each permission is optional at the operating-system level: you may decline it, and we explain below what stops working if you do. We request a permission only at the point it is first needed, never in bulk on first launch.

17.1 Location

Permission	Why we ask, and what happens if you decline
Precise location (foreground)	Used to set your pickup point, match you to the nearest available driver or vehicle, calculate fares and delivery distances, and show live tracking on the map. If you decline, you can still enter addresses manually, but automatic pickup detection and live tracking will not work.
Precise location in the background	Requested only from driver and courier accounts, and only while you are logged in and on duty. It is used to dispatch nearby jobs to you, to give the customer live tracking of their trip or parcel, to calculate the distance your trip actually covered for fare and payout purposes, and to support safety features such as route reconstruction after an incident. Background collection stops when you go off duty or log out. Passenger and sender accounts are never asked for background location. If a driver declines, they can still use the app but cannot receive dispatched jobs.
Approximate location	Used to show the correct city, currency and available services when precise location is unavailable or declined.

Location data is retained in association with a completed trip or delivery for the period described in Section 8. It is not sold, and it is not used to build advertising profiles.

17.2 Camera

Used to photograph proof of delivery, to capture damage or condition evidence when a ThumaShield claim is raised, to scan QR codes at a Thuma Hub, to scan identity documents during account verification, and to set a profile photo. Images are uploaded only when you take an action that submits them. We do not access the camera in the background.

17.3 Microphone and voice recordings

Used only for the in-app voice note feature, where you may record a short message to a driver or to support instead of typing, and for in-app calling where that feature is enabled. Recordings are transmitted only when you choose to send them. We do not record ambient audio, and we do not access the microphone in the background or while the app is closed.

17.4 Contacts

Used only if you choose to send a parcel to, request a ride for, or transfer money to someone in your address book, so you do not have to type their details. Contact data is read on the device to populate the picker. We upload only the single contact you select for that transaction, and we do not upload, store or index your full address book.

17.5 Biometrics (Face ID, Touch ID, fingerprint)

Offered as an optional way to unlock the app and to authorise ThumaPay transactions in place of entering a PIN. Biometric matching is performed entirely by your device's own secure hardware. We never receive, transmit or store your fingerprint, face map or any biometric template. The app is told only whether the device authenticated you successfully.

17.6 Notifications

Used to tell you that a driver has been assigned, that a parcel is arriving, that a payment or payout has completed, and to send security alerts about your account. Marketing notifications are separate and off unless you opt in.

17.7 Photos and files

Accessed only when you choose to attach an existing image, for example uploading an identity document or adding a photo to a support ticket or insurance claim.

17.8 Device and diagnostic information

We collect device model, operating system version, app version, a resettable app instance identifier, crash logs and performance data. This is used for security, fraud prevention and fixing faults. Analytics collection follows the consent choice described in Section 12.

17.9 Data we do not collect

We do not collect your call history, SMS messages, browsing history from other apps, health data, or the contents of other applications on your device. We do not use the microphone or camera for advertising purposes.

17.10 Withdrawing a permission

You can withdraw any permission at any time in your device settings, under the entry for the Thuma Express or ThumaPay app. Withdrawing a permission disables the related feature but does not close your account or delete data already collected. To delete your account and data, see Delete your account.

18. Deleting Your Account and Data

You can request deletion of your account and associated personal data at any time, without installing the app and without logging in. The full procedure, what is deleted, what we are legally required to retain, and how long each step takes, is set out on a dedicated page: Delete your account.