Law Enforcement Requests

Version 3.0. Effective 2 November 2026.

In short

• We help the police and other authorities investigate incidents on trips booked through Pickup Charter.
• We do not disclose personal location, messages or passport details without a court order or warrant. A letter on letterhead alone is not enough. We never hand over data informally or in bulk.
• The only exceptions: an immediate, verifiable risk to life, or where a statute compels us to disclose.
• Each request logs the officer's identity and badge number, the legal instrument, the justification and two approving staff.
• Foreign authorities should go through the Nigerian government's formal channels.
• We tell users about requests unless the law or the investigation prevents it.

This summary is for convenience only. The numbered clauses below govern.

---

1. Scope

1.1 This policy explains how Pickup Technology Limited, RC 9548096 ("Pickup"), responds to requests for user data from law enforcement, regulators and other public authorities ("Authorities"). It supplements clause 9.6 of our Privacy Policy and forms part of the Terms of Use.

1.2 It is guidance for Authorities. It does not create rights for any third party.

2. What data we may hold

2.1 Account and identity data, trip records (Operator, asset, Assigned Crew, times, start and end points), payment records, in app messages and support records, as described in the Privacy Policy.

2.2 We do not hold full card numbers. Payment data held by our payment providers must be requested from them.

2.3 We keep data only for the periods in the Privacy Policy. We may not have what you ask for. In particular:

(a) we collect trip location only from 1 hour before a trip starts until 1 hour after it ends, and we delete the raw location points 30 days after the trip, unless a case, incident or legal hold is open; (b) in app messages are kept for 2 years from the date of each message, unless they form part of a case; (c) identity check selfies and face templates are deleted 30 days after the identity decision, or 7 days after consent is withdrawn; jet passport and manifest records are kept as long as Nigeria Civil Aviation Authority (NCAA) rules require; (d) Pickup does not hold camera footage from vehicles or vessels; Operators keep their own for 30 days, and requests for it go to the Operator; (e) we have no record of phone calls between Guests and crew, and we do not record support calls; (f) we do not hold Face ID or fingerprint data, which never leaves the user's device.

2.4 A preservation request under clause 4.9 stops these periods running for the records it specifies. Send it as early as you can.

3. Principles

3.1 Lawful basis. We disclose personal data only where the Nigeria Data Protection Act 2023 and other applicable law allow it.

3.2 Specific. Requests must identify the Account, Booking or person concerned and the data sought. We do not respond to bulk or open ended requests.

3.3 Proportionate. We disclose the minimum data needed.

3.4 Recorded. Every request and disclosure is logged with the officer's identity and badge number, the legal instrument, the justification, the two staff who approved it, the data disclosed and the Authority receiving it. Our Data Protection Officer is told of every disclosure.

3.5 Reviewed. Each request is reviewed by our legal function before we respond, and two staff must approve any disclosure.

3.6 Verified. Before disclosing, we confirm that a request is genuine by contacting the requesting agency through its published official channels. We do not act on requests that cannot be verified.

3.7 Secure delivery. We send disclosed data only to an official agency address, through an encrypted or otherwise secure channel, and we record what was sent.

4. Nigerian Authorities

4.1 Incidents on a Booking. Where an investigation concerns an incident arising from a Booking on the Platform, we assist promptly once we receive a court order or warrant valid under Nigerian law. We do not disclose personal location, messages or passport details without one. A written request on official letterhead, whatever the rank of the officer signing it, is not enough on its own, although we will preserve the relevant records under clause 4.9 while the Authority obtains the necessary order. The only exceptions are an immediate, verifiable risk to life under section 6, and a disclosure that a statute compels us to make, in which case we disclose the minimum data the statute requires and record the statutory provision relied on.

4.2 Other requests. For every other request, including the content of messages or data not connected to a specific incident, we likewise require a court order or warrant valid under Nigerian law, such as an order under the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024, or the Administration of Criminal Justice Act 2015.

4.3 Sensitive data. We disclose identity documents, passport details, selfies, face templates or other biometric data only under a court order that specifically covers them, or where a statute expressly compels it.

4.4 Financial crime. Reports and requests under anti money laundering law, including the Money Laundering (Prevention and Prohibition) Act 2022, from the Nigerian Financial Intelligence Unit, the Special Control Unit against Money Laundering and the Economic and Financial Crimes Commission, are handled as the relevant law requires. Card and bank data held by our payment providers must be requested from them. Our compliance staff handle these requests and any report we must make.

4.5 Regulators. The Nigeria Data Protection Commission, the Federal Competition and Consumer Protection Commission, the Lagos State Ministry of Transportation and other regulators may request information within their statutory powers.

4.6 Routine reporting to the Lagos State Ministry of Transportation. Pickup has applied for the Lagos State Service Entity Permit in the car rental (chauffeur hire) category. Any request from the Ministry for personal data follows this policy.

4.7 What to include.

(a) Name, rank, badge number, agency and official contact details of the requesting officer. (b) A copy of the court order, warrant or other legal instrument. (c) The Account email or phone number, or the Booking reference. (d) The data sought and the date range. (e) The reason the data is needed, including the offence under investigation. (f) Any request for non disclosure to the user, with its legal basis.

4.8 Where to send it. By email to legal@pickupltd.com, from an official agency address. A request takes effect when we receive it. A court order or other formal process that must be served is served as the rules of court require, at our registered office, whose address is on the Corporate Affairs Commission's public register (see Contact Legal); please also email a copy.

4.9 Preservation. On a valid written request we preserve specified records for 90 days, pending legal process. This may be extended once, by a further 90 days, on a further written request. Preserved records are not disclosed until valid legal process is received.

5. Foreign Authorities

5.1 Pickup is a Nigerian company. Foreign Authorities should make requests through the mutual legal assistance process, via the Central Authority at the Federal Ministry of Justice under the Mutual Assistance in Criminal Matters Act 2019, or another route recognised by Nigerian law.

5.2 We may accept a preservation request directly from a foreign Authority while formal process is pursued.

5.3 Where data is processed under UK GDPR or EU GDPR, we also consider the requirements of those laws before disclosing.

5.4 We transfer data to a foreign Authority only where the Nigeria Data Protection Act 2023 permits the transfer, and we record the basis.

6. Emergencies

6.1 If an Authority believes there is an immediate, verifiable risk to someone's life, it may make an emergency request to legal@pickupltd.com with "EMERGENCY" in the subject line. In-app safety features are secondary information tools and do not constitute an emergency response service. Pickup does not guarantee continuous, uninterrupted live monitoring, and automated prompts do not shift emergency response duties away from public authorities. In an emergency, call 112.

6.2 The request must explain the emergency, the people at risk, and why the data is needed urgently.

6.3 If we can verify that the risk to life is genuine and immediate, we may disclose the minimum data needed without waiting for a court order or warrant, relying on the vital interests of the person concerned. We log the request as clause 3.4 requires, and we ask for the formal request to follow.

6.4 Pickup does not run a 24 hour line. Emergency requests are handled as a priority. Every day, including at weekends and on public holidays, a designated member of our trust and safety team checks legal@pickupltd.com at least every 4 hours between 07:00 and 22:00 Lagos time for requests with "EMERGENCY" in the subject line. Where life is at immediate risk, Authorities should act on the information already available to them and not wait for our reply.

7. Notice to users

7.1 We tell the user about a request before disclosing, unless the law prohibits it, a court orders otherwise, or telling them would put someone at risk or prejudice the investigation of a serious crime.

7.2 If notice was delayed, we notify the user when the restriction ends, where the law allows.

8. Challenging requests

8.1 We may refuse or narrow a request that is unclear, overbroad, or lacks a valid legal basis, and we may challenge it in court.

9. Fees

9.1 We do not charge Authorities for responding. We may seek reasonable costs for unusually large or complex requests where the law allows.

10. Transparency

10.1 Each year we publish, by 31 March, aggregate figures for the previous calendar year (the first report covers 2027) on the requests we receive: the number of requests by type of Authority, the number we complied with in full or in part, and the number we refused or challenged. We never publish details that could identify a user or an investigation.

11. Changes, law and contact

11.1 We may update this policy by publishing a new version on this page. The version published when a request is received applies to that request.

11.2 This policy is governed by the laws of the Federal Republic of Nigeria.

11.3 Requests and questions: legal@pickupltd.com. See Contact Legal.