Privacy Policy — Batoka Express

1. Who we are

Batoka Express is an intercity coach and parcel courier service operating in Zambia, and a member of the Batoka Group. In this policy, "we", "us", and "our" refer to Batoka Express. We are the data controller for the personal information described below.

Contact: info@batokaexpress.com · +260 974 000 000 · Lusaka, Zambia.

2. Information we collect

We only collect information needed to sell you a ticket, move your parcel, and support you afterwards.

What	When
Passenger name, email address, phone number	When you book a ticket
Trip details — route, travel date, number of passengers	When you book a ticket
Sender and recipient names and phone numbers, recipient email, parcel description	When you send a parcel
Mobile money number, payment method, transaction reference and status	When you pay
Account phone number or email, and a one-time passcode (OTP)	When you sign in to the mobile app
Your name, email, topic and message	When you use the contact form
Technical logs — IP address, browser type, pages requested, timestamps	Automatically, when you use the site

We do not store your mobile money PIN or any full card number. Payments are authorised by you inside your mobile money provider's own prompt; we receive only the transaction result.

3. Why we use it

To create, confirm and issue your booking or parcel consignment.
To take payment and to reconcile or refund transactions.
To send you booking confirmations, tickets, parcel tracking updates and OTP sign-in codes by SMS and email.
To let a recipient or sender track a parcel using its tracking number.
To answer enquiries and complaints you send us.
To keep records required by Zambian tax, transport and accounting law.
To protect the service against fraud and abuse.

We do not sell your personal information, and we do not use it for advertising or profiling.

4. Who we share it with

We share only what is necessary, and only with:

Mobile money and payment processors — to collect payment for your booking.
SMS and email providers — to deliver confirmations, tracking updates and OTP codes.
Our hosting provider — which stores the data on our behalf.
Our staff and drivers — passenger manifests and parcel details, so trips and deliveries can be operated.
Authorities — where we are required to by law, or to establish or defend a legal claim.

When you send a parcel, the recipient's name and phone number are used to notify and identify them on delivery. Please only give us recipient details you are entitled to share.

5. How long we keep it

Bookings, parcels and payment records — kept while your booking is active and afterwards for the period required by Zambian tax and accounting law.
OTP codes — short-lived; deleted or expired shortly after they are issued or used.
Contact form messages — kept only as long as needed to resolve your enquiry.
Technical logs — kept for a short period for security and troubleshooting.

6. Security

The site and mobile app are served over encrypted HTTPS connections. Access to booking and customer data is restricted to authorised staff accounts. Sign-in uses one-time passcodes rather than stored passwords, and OTP codes are stored only as irreversible hashes. No system is perfectly secure, so we ask you not to share tickets, tracking numbers or OTP codes with anyone you do not trust.

7. Cookies and similar technology

We use only the cookies needed to make the site work — a session cookie and a security (CSRF) token that protects your forms from being submitted by a third party. We do not use advertising or cross-site tracking cookies. Blocking these cookies will stop bookings and payments from working.

8. Children

Our services are intended for adults. Children travel and are booked for by a parent, guardian or another responsible adult, who provides the passenger details on their behalf.

9. Your rights

You may ask us to:

Give you a copy of the personal information we hold about you.
Correct information that is wrong or out of date.
Delete your account and personal information — see below.
Stop sending you non-essential messages.

We may need to verify your identity — usually by confirming the phone number or email on the booking — before we act on a request. Some records must be retained even after deletion where the law requires it; we will tell you if that applies.

Request data deletion

10. Changes to this policy

If we change this policy we will update the "last updated" date at the top of this page. Significant changes will be announced on the site.

11. Contact us

Questions or complaints about privacy: email info@batokaexpress.com, call +260 974 000 000, or use our contact form.