Privacy Policy

Komiut Systems operates 2Safiri. For platform accounts, security and service management, Komiut Systems decides why and how personal data is used. For records that a SACCO enters and manages—such as its members, crews and fleet—the SACCO may be the data controller and we process that information on its instructions.

Komiut and 2Safiri use shared platform infrastructure. Brand, SACCO and role-based controls are used to separate operational access, while authorised platform administrators may access records across the platform for support, security and compliance.

• Account detailsName, phone number, email address, profile information, role, SACCO membership and sign-in data.
• Transport recordsVehicle and crew assignments, number plates, routes, termini, queues, bookings, seats, fares and operational activity.
• PaymentsM-Pesa references, payer number, amount, time, till or paybill, payment status and the booking or vehicle used to reconcile the payment.
• LocationPrecise device or vehicle coordinates when a location-dependent feature is enabled, together with route, trip and timestamp information.
• Bank referralsIf a driver chooses a banking service: identity number, contact details, preferred branch, account details where supplied, and a record of consent.
• Device & securityIP address, browser or device type, authentication activity, audit events, error details and necessary cookie or local-storage preferences.
• CommunicationsMessages, support requests and information you provide when contacting us or your SACCO.

We receive this information from you, your SACCO, authorised field agents, service activity and partners involved in a transaction. Please provide another person's data only when you are authorised to do so.

• create and secure accounts, apply permissions and provide support;
• operate bookings, dispatch, queues, routes, vehicle tracking and passenger information;
• initiate, match and reconcile M-Pesa, cash and QR payments;
• produce SACCO reports, expenses, loyalty balances and operational summaries;
• detect misuse, investigate incidents, maintain audit trails and protect the service;
• meet legal, accounting, regulatory and dispute-resolution obligations; and
• improve reliability and understand how product features perform.

Depending on the activity, we rely on performance of a contract, consent, compliance with law, protection of legitimate interests, or another lawful basis available under Kenyan law. You may withdraw consent where processing depends on it, without affecting earlier lawful processing.

Some matching, reconciliation and security checks are automated. Material account or fraud decisions can be reviewed by an authorised person rather than being left solely to an automated result.

Drivers may share a vehicle's current position while operating an active trip. Authorised SACCO personnel may use it to follow the fleet, and passengers connected to the relevant trip may use it to follow the approaching vehicle. Passengers may also share their current position to search for nearby vehicles.

Location permission can be controlled in device settings. Disabling it will stop location-dependent features. The live-tracking service is designed around the latest vehicle position rather than a permanent journey history, although limited technical logs and records required for security or a dispute may be retained.

We share only what is reasonably necessary with:

• the SACCO and authorised employees responsible for its operations;
• drivers, crew and passengers where information is needed for a booking or active trip;
• Safaricom, M-Pesa and payment providers involved in processing or reconciling a payment;
• a named banking partner when a driver expressly agrees to a referral;
• hosting, storage, communications, mapping, security and support providers working for us; and
• regulators, courts or law-enforcement bodies where disclosure is lawfully required.

Providers must handle data for the agreed service and protect it appropriately. Where processing or storage occurs outside Kenya, we use safeguards required by the Data Protection Act or seek consent where applicable.

We keep information only for as long as it is needed for the service, an active account, accounting and legal obligations, security, or a dispute. Retention therefore varies: current operational data may change quickly, while transaction and audit records may need to be kept longer. When information is no longer needed, we delete it, anonymise it or restrict its use where deletion is not yet lawful.

We use access controls, encrypted transport, protected credentials, role separation, audit logging, backups and monitoring. No online service can promise absolute security, so please protect your password and report suspicious access promptly.

The website uses necessary cookies and local device storage for sign-in, security, theme and interface preferences. We do not use third-party advertising cookies.

Under Kenya's Data Protection Act, you may ask to be informed, access your data, object to processing, correct inaccurate information, request deletion or restriction, receive portable data where applicable, and withdraw consent.

Email support@2safiri.com with the account, phone number or SACCO involved and the right you want to exercise. We may verify your identity and may retain information where law or a valid legal claim requires it. If your SACCO controls the record, we may refer the request to that SACCO and help it respond.

You can read the official guidance on the ODPC data-subject rights page. If a concern is not resolved, you may also file a complaint with the ODPC.

You can ask us to delete your 2Safiri account and the personal information held with it. There is no in-app delete button yet, so requests are handled by our support team — the steps below are the whole process.

If you are SACCO staff, some records — crew assignments, shifts and operational activity — belong to your SACCO rather than to us. We delete your personal account and refer any request about the SACCO's own records to that SACCO, and help it respond.

Deleting your account does not cancel a trip you have already paid for. Ask about a refund before you request deletion, because we may be unable to identify your booking afterwards.

SACCO administration, driver onboarding and banking features are not intended for children. A minor may use passenger transport services where permitted, and a parent or guardian may exercise privacy rights on the minor's behalf. Tell us if you believe a child's information was collected without appropriate authority.

We may update this policy when the service, law or our partners change. The effective date above will change, and we will provide additional notice where a change materially affects how personal data is used.

Questions or requests can be sent to support@2safiri.com, or through the contact page.

This policy should be read with the Kenya Data Protection Act.