Law Enforcement & Data Disclosure Policy

1. Position

Glydr cooperates with the Ghana Police Service, the Driver and Vehicle Licensing Authority, the National Insurance Commission, the Data Protection Commission, the Cyber Security Authority, the Ghana Revenue Authority, the Bank of Ghana, and any other Ghanaian authority making a lawful request for user data or Trip records. We will not volunteer user data outside that framework, and we will push back on requests we believe to be unlawful or overbroad.

2. The kinds of requests we expect

• Emergency request — police acting on a live incident where lives or serious injury are at risk (e.g. after an SOS, after a missed check-in, after a road accident). We respond quickly.
• Court order or warrant — a written order from a Ghana court directing disclosure of specific data.
• Statutory regulator request — a written request from a Ghana regulator citing the statute under which it acts (e.g. DPC under DPA 2012, NIC under the Motor Vehicles (Third Party Insurance) Act 1958, BoG under Act 987).
• Informal police request — a phone call or letter from an officer without a court order. We will respond but the response we can give without an order is generally limited to confirming whether an account exists and pointing to the formal-request process.

3. Where to send requests

Send legal requests to legal@glydr.africa with the following content:

• identity of the requesting authority and officer in charge;
• legal basis cited (statute, section, court order, warrant number);
• scope of data requested (specific user account, specific Trip, date range);
• delivery channel for the response.

For emergency requests where lives are at risk and waiting on email is unsafe, call our operator line (forwarded from the in-app SOS flow). We will act on a verbal request from an identifiable officer of the Ghana Police Service in an emergency, with written follow-up.

4. Our review

Before disclosing, we review:

1. Is the request from a recognised authority?
2. Is the legal basis valid? Does the cited statute or order actually authorise the request?
3. Is the scope proportionate? We push back on fishing expeditions and bulk requests.
4. Is there a data-minimisation path? We disclose the minimum data that answers the question.
5. Does the request require notice to the data subject under DPA 2012, and can we give it?

Where Ghana law permits, we notify affected users of disclosure before we make it. Where law prohibits notice (a gag order, active criminal investigation, ongoing safety threat), we comply with that prohibition and notify the user as soon as we can.

5. What we typically have

See the Privacy Policy for the full data inventory. The categories most often relevant to a law- enforcement request:

• Account: name (Ghana-Card-verified), phone number, email, KYC verdict.
• Driver vehicles: plate, make/model, insurance status, document photos.
• Trip metadata: origin/destination, scheduled times, who travelled with whom.
• Trip live-location stream: GPS samples from the Driver’s phone while the Trip was active.
• Payment metadata: amount, method label, Flutterwave transaction reference. No card or PIN data.
• In-app chat messages tied to a booking.
• Incident reports, ratings, and audit-log entries.

6. What we do not have

• The contents of a Driver’s in-vehicle conversations.
• The Driver’s GPS location outside of active Trips.
• Card numbers, card PINs, or mobile-money wallet PINs.
• Raw Ghana Card images (Smile Identity holds those on the standard verification path; see Identity Verification Notice).

7. Cross-border law-enforcement requests

Requests from authorities outside Ghana are evaluated under Ghana law. We will generally only respond to non-Ghana requests made through a Mutual Legal Assistance Treaty (MLAT) or an equivalent recognised legal channel. We do not respond to informal foreign-police requests.

8. Transparency

We aim to publish an annual transparency report listing — at a summarised, non-identifying level — the number of law- enforcement requests received, the categories of data requested, and the rate at which we complied versus declined. The first report will cover the year following public launch.