NaviaRide - Smart Carpooling

1. Introduction & Scope

At NaviaRide Tech Limited ("NaviaRide", "we", "us", or "our"), we value your trust and are dedicated to protecting your privacy. This Privacy Policy outlines our practices regarding the collection, use, and disclosure of your information when you use our mobile application, website, and related services (collectively, the "Platform").

This Policy applies to all users of our services, including passengers, drivers, and visitors. By using the Platform, you agree to the collection and use of information in accordance with this Policy. We have designed this document to be transparent and compliant with the Nigeria Data Protection Act (NDPA) 2023 and other applicable data protection regulations.

Under the NDPA 2023, NaviaRide acts as the Data Controller for the personal information processed through our platform.

2. Definitions

Personal Data: Any information relating to an identified or identifiable natural person.

Data Subject: Any living individual who is the subject of personal data and who is using our Platform.

Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or erasure.

Data Controller: The legal person which determines the purposes and means of processing personal data — NaviaRide Tech Limited.

3. Information We Collect

A. Personal Identification Information

Registration Data: Full name, date of birth, gender, nationality, and profile photograph.
Contact Data: Email address and verified mobile phone number.
Government Identifiers: National Identification Number (NIN) and driver's licence details (for Drivers), collected via our identity verification partner QoreID. We do not routinely collect Bank Verification Numbers (BVN).
Emergency Contacts: Name and phone number of individuals you designate for safety purposes.

B. Vehicle & Professional Data (Drivers Only)

Vehicle Details: Make, model, year, colour, licence plate number, and vehicle inspection photos.
Compliance Documents: Insurance, roadworthiness, and licence expiry dates; digital copies submitted for admin review.
Bank Details: Account information for driver payouts, processed via Paystack.

C. Automated & Technical Data

Geolocation: Real-time GPS coordinates during active trips and driver en-route phases (see Section 14).
Log Data: IP addresses, browser types, pages visited, and timestamps.
Device Info: Device identifiers, hardware model, operating system version, and app version.
Crash Reports: Error and diagnostic data via Sentry (mobile app).

D. Transactional & Financial Data

Payment Metadata: Transaction IDs, amounts, currency, and payment method types via Paystack. We do not store full card numbers.
Driver Wallet: Balances, commission deductions, withdrawal history, fees, and payout records.
Trip History: Pickup/drop-off locations, distance, duration, fares, and booking status.

4. Purposes of Processing

Operational Excellence

Matching drivers and passengers, route display, fare calculation, live trip tracking, and in-app communication.

Safety & Integrity

Identity verification, vehicle inspection review, fraud prevention, emergency features, and trip sharing.

Regulatory Compliance

KYC obligations, tax record-keeping for FIRS, and lawful requests from authorities.

Platform Enhancement

Bug fixes, performance monitoring, and feature improvement using aggregated or anonymized data where possible.

5. Cookies & Website Analytics

Our website uses cookies and similar technologies for essential operation and performance measurement.

Essential Cookies

Required for page navigation, authentication, and session management on our website.

Analytics

We use Vercel Analytics on our website to understand page usage. The mobile app does not use advertising or marketing trackers.

6. Data Sharing & Third-Party Disclosures

User Interoperability: When you book or accept a ride, we share your first name, rating, vehicle details (for drivers), and live location with the matched party.
Service Providers: We use trusted processors including QoreID (identity), Paystack (payments), Resend (email/OTP), Sentry (crash reporting), Google Maps (routing), and cloud hosting providers. Each is bound by confidentiality obligations.
Law Enforcement: We disclose data when required by valid legal process or in cases of imminent public safety.
Regulatory Bodies: Transactional records may be shared with FIRS as required by law.
Corporate Restructuring: Data may transfer in a merger or acquisition, with prior notice where required.

We do not sell your personal data.

7. Data Retention

Active Accounts

Data retained while your account is active and as needed to provide the service.

Financial Records

Transactional data retained up to 7 years for tax and audit compliance.

Deleted Accounts

PII is anonymized on deletion; trip and financial records may be retained in anonymized form (see Section 19).

Technical Logs

Server and diagnostic logs are typically purged or anonymized within 180 days.

8. Data Security

Encryption: Data in transit is protected via TLS/SSL. Sensitive data at rest (such as NIN) is encrypted.
Access Control: Role-based access limits employee access to user data on a need-to-know basis.
Incident Response: We will notify affected users and regulators of data breaches as required by the NDPA 2023.

9. Your Rights

Under the NDPA 2023, you have the right to access, rectify, erase, restrict, object to, and port your personal data.

You may delete your account in the NaviaRide app or on our account deletion page. To exercise other rights, email privacy@naviaride.space with subject "Data Rights Request".

10. International Data Transfers

Some processors (e.g., QoreID, Paystack, Sentry, Vercel) may process data outside Nigeria. We ensure appropriate safeguards, including contractual protections, are in place.

11. Children's Privacy

The Platform is intended for individuals aged 18 years and older. We do not knowingly collect data from minors.

12. Changes to this Policy

We may update this Policy periodically. Material changes will be posted on this page with an updated "Last updated" date.

13. Contact & Complaints

Contact us at privacy@naviaride.space. You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC).

NaviaRide Tech Limited, Kuje, Abuja, Nigeria

14. Location Data

Drivers: Foreground GPS is collected during en-route, pickup, and active trip phases to display live position to passengers and compute ETAs.
Background location: Collected only while a trip is in progress (trip started) and only for drivers. Collection stops when the trip completes, is cancelled, or the driver ends tracking.
Passengers: See driver location only for matched or active trips, not outside those contexts.
Disabling location permissions limits core Platform features including booking and navigation.

15. Identity Verification (QoreID)

We use QoreID as a data processor for identity verification. Depending on your role, this may include NIN verification, biometric liveness checks, driver's licence validation, and vehicle plate registry lookups.

Driver vehicle inspection photos and documents are also reviewed by NaviaRide administrators. QoreID's own privacy policy governs their direct processing activities.

16. Communications & Device Features

In-app chat: Booking-related messages between matched users and support conversations.
VoIP calls: In-app voice calls between matched users via device telephony APIs. NaviaRide does not record call audio.
Push notifications: Trip updates, OTP codes, and safety alerts.
Profile photo sharing: Optional setting to show your profile photo to co-passengers on shared trips.

17. Trip Sharing

Users may generate share links so trusted third parties can view live trip progress (route, ETA, vehicle information). Recipients must have the link. Do not share links with untrusted parties. Shared views expose limited trip data, not your full account profile.

18. Driver Wallet & Payments

Passenger payments and driver bank payouts are processed by Paystack.
Driver wallets track earnings, platform commission deductions, and withdrawal history.
Withdrawals are subject to minimum amounts, tiered fees, and cooldown periods displayed in the app.
NaviaRide stores transaction metadata only; full payment card numbers are not stored on our servers.

19. Account Deletion & Anonymization

You may request account deletion via the app or our account deletion page. Before deletion, you must withdraw or spend any wallet balance and resolve pending withdrawals.

On deletion, personal identifiers are anonymized (e.g., name replaced with "Deleted User"). Trip records, payment history, and safety logs may be retained in anonymized form for up to 7 years for tax compliance, dispute resolution, and legal obligations.

20. Processors & Sub-processors

Processor	Purpose
QoreID	Identity / KYC verification
Paystack	Payments and driver payouts
Resend	Transactional email and OTP
Sentry	Crash and error reporting (mobile)
Google Maps	Maps, routing, and geocoding
Google / Apple	Optional OAuth sign-in
Vercel	Website hosting and analytics

21. Legal Bases for Processing (NDPA)

Contract performance: Providing the carpooling service you signed up for.
Legal obligation: KYC, tax record-keeping, and lawful government requests.
Legitimate interests: Fraud prevention, platform safety, and service improvement.
Consent: Optional features such as profile photo sharing to co-passengers, and any future marketing communications if introduced.