← Back to sign in

Privacy Policy

Last updated: 30 May 2026

GoBus250 (“we”, “us”) operates a bus-ticketing and mobility platform for the Rwandan market. This policy explains what personal data we collect, why, how we protect it, and the rights you have. It aligns with Rwanda’s Law Nº 058/2021 relating to the protection of personal data and privacy, and with the data-protection expectations of the Rwanda Utilities Regulatory Authority (RURA).

1. Who is responsible

GoBus250 is the data controller for account and platform data. Bus operators (agencies) are independent controllers for the booking data of their own trips. Support: support@gobus250.rw.

2. What we collect

  • Account data — name, phone, optional email, password (stored only as a bcrypt hash), optional profile photo.
  • Booking & travel data — trips searched and booked, seat, boarding/drop-off stops, ticket numbers and QR tickets, boarding scans.
  • Payment data — payment method (MTN MoMo, Airtel Money, cash), the mobile-money phone used, amount and references. We do not store card numbers.
  • Support data — messages, complaints and fare disputes you send.
  • Technical data — IP address, device/user-agent and timestamps, kept in security and audit logs.

3. Why we use it

  • To create and secure your account and authenticate you.
  • To process bookings, issue QR tickets and validate boarding.
  • To process payments and handle refunds and disputes.
  • To send service notifications.
  • To meet legal, regulatory, accounting and audit obligations.
  • To monitor performance, prevent fraud and keep the service reliable.

4. Who we share it with

Bus operators see the booking and boarding data for their own trips only (never other agencies’ data). Payment providers (MTN, Airtel) process the payment you initiate. An SMS provider delivers notifications/OTP where enabled. We disclose data to authorities only where required by law or by RURA. We do not sell your personal data.

5. How we protect it

Encryption in transit (HTTPS/TLS); passwords hashed with bcrypt; QR tickets cryptographically signed; role-based access control with strict per-agency isolation; an append-only audit log of state-changing actions; and continuous performance/availability monitoring.

6. How long we keep it

We keep account and transaction data while your account is active and afterwards only as long as needed for legal, regulatory, accounting and dispute-resolution purposes.

7. Your rights

You may access, correct, or request deletion of your data, object to or restrict certain processing, and lodge a complaint with the national supervisory authority or RURA. Contact support@gobus250.rw, or use the Help & support screen in the app.

8. Children

The service is intended for adults able to enter a transport contract. We do not knowingly collect children’s data without a guardian.

9. Changes

We may update this policy; the “last updated” date reflects the latest version and material changes are surfaced in the app.

10. Contact

Questions or requests: support@gobus250.rw.