Operator Data Processing Addendum

Version 3.0. Effective 2 November 2026.

In short

• When you receive guest data through Pickup, you control it, and the law holds you responsible for it.
• Use it only to deliver the trip and meet your own legal duties. Never for marketing.
• You see a guest's phone number from confirmation, to coordinate the booking. Your crew see it only from 1 hour before to 1 hour after the trip. Live location works only in that same window. Don't save them.
• Only the crew and staff who need the data for that trip may see it, each with their own login.
• Jet manifests are sensitive. Keep them locked down and delete them when the law no longer needs them.
• A breach? Tell us within 24 hours. You indemnify Pickup for your breaches of this Addendum.

This summary is for convenience only. The numbered clauses below are the binding terms and govern if there is any difference.

---

1. Status

1.1 This Addendum is issued by Pickup Technology Limited, RC 9548096, Lekki Phase 1, Lagos State, Nigeria ("Pickup", "we"). It forms part of the Operator Agreement, and binds every Operator ("you") and, through you, your Assigned Crew and staff.

1.2 This Addendum is a controller to controller data sharing agreement, with processor terms (clause 2.2) for any task you carry out for Pickup. On personal data, it prevails over the Operator Agreement and the other operator documents. If a separate agreement you have signed with Pickup contains a data protection clause that gives Guests more protection, that clause applies as well.

1.3 Capitalised words have the meaning given in the Operator Agreement and the Privacy Policy. In addition:

2. Roles

2.1 Independent controllers. You and Pickup are each an independent controller of the Guest Data you hold. From the moment you receive Guest Data through the Platform, you decide how it is used within the limits of this Addendum and the law, and you are responsible for your own compliance with the NDPA, the GAID and any other data protection law that applies to you. You are not Pickup's processor for that data, and Pickup is not yours. For Manifest Data, you are an independent controller from the moment the Booker submits it, for the flight and for aviation security and passenger reporting. Pickup is a controller only of its own copy, which it keeps for as long as Nigeria Civil Aviation Authority (NCAA) rules require.

2.2 Where you act for us. If Pickup asks you in writing to process personal data on its behalf (for example to collect a document at boarding for a regulator's request made to Pickup), you act as Pickup's processor for that task only: you process the data only on Pickup's documented instructions, keep it confidential, apply the security in clause 6, use no sub processor without Pickup's written consent, help Pickup meet its duties to data subjects and the NDPC, and delete or return the data when the task ends.

2.3 Registration. Where the NDPA or the GAID requires you to register with the NDPC as a data controller of major importance, appoint a data protection officer, file a compliance audit return or carry out a data protection impact assessment, you must do so. Pickup may ask for evidence.

2.4 Pickup's side. Pickup has a Data Protection Officer (privacy@pickupltd.com) and handles Guest Data as the Privacy Policy describes, with the providers listed in Sub-processors. Pickup does not train machine learning models on identity images, selfies, face templates, message content or precise location.

3. What you receive

3.1 Pickup gives you only the Guest Data needed to deliver the Booking:

3.2 What you never receive. Pickup never gives you a Guest's identity document, selfie, face template, verification record or payment details. You must not ask a Guest to send you any of them, by message or outside the Platform. For a jet, the only identity details you receive are the Manifest Data, and physical document checks happen at the terminal.

3.3 Guest reviews and reports. Reviews are two way, under the Reviews & Ratings Policy. You may review a Guest after a completed trip, and other Operators who deal with that Guest can see the Guest's average rating and comments. A report you make about a Guest with Report a guest is seen only by Pickup and is not shown to other Operators. You must keep reviews and reports factual and must not record special category data in them unless it is needed for safety.

4. Purpose limitation

4.1 You may use Guest Data only to:

(a) perform the Booking, including planning, assignment, pickup, the trip itself and closing it; (b) handle a problem, complaint, damage claim, lost item, insurance claim or dispute about that Booking; (c) meet your own legal duties, such as aviation security and passenger reporting rules for jets, maritime passenger records for boats, road transport and Ministry reporting for cars, tax and accounting records, and a lawful request from an authority; and (d) establish, exercise or defend a legal claim.

4.2 You must never:

(a) use Guest Data for marketing, advertising, newsletters, loyalty schemes or any message the Booking does not need, by any channel; (b) contact a Guest outside the Platform, or by phone for anything except coordinating the Booking, except where clause 4.1(b) to (d) requires and then only through Pickup support or as the law allows; (c) sell or disclose Guest Data to anyone except your Authorised Users, your insurer, your professional advisers under a duty of confidence, or an authority where the law requires; (d) combine Guest Data with other data to build a profile of a Guest, or use it to make an automated decision about them; or (e) copy Guest Data into a personal phone, a personal messaging app, a spreadsheet or any system outside the Platform, except the records clause 4.1(c) requires you to keep.

4.3 Phone numbers and location. A Guest's phone number may be used only to coordinate and complete the Booking, and your crew may use it only inside the Trip Window. You and your crew must not save it to a contact list or messaging app, and must delete any call log or message history outside the Platform that holds it once the Booking ends, unless it is evidence of an incident you have reported. Live location may be viewed only by the Assigned Crew and the Authorised Users handling the trip, and may not be recorded, shared or used after the trip ends.

5. Crew and staff access

5.1 Need to know. Give access to Guest Data only to people who need it for the Booking concerned, and only to the data they need.

5.2 Individual logins. Every Authorised User must use their own account in the app. Never share a login, a device that stays signed in, or a one time code. Admin access to your operator account is given only to your directors, officers and staff authorised to act for you.

5.3 Removal. Remove access at once when a person leaves your business, is suspended, or no longer needs it, and in any event within 24 hours.

5.4 Training and confidentiality. Before giving access, make sure each Authorised User is bound by a duty of confidentiality, knows the rules in this Addendum and the Operator Standards, and knows how to report a breach.

5.5 No screenshots. Authorised Users must not photograph, screenshot, print or forward Guest Data or the passenger manifest, except where your legal duties under clause 4.1(c) require a record, and then only to your secure records.

5.6 Responsibility. You are responsible for everything your Authorised Users do with Guest Data as if you had done it yourself.

6. Security

6.1 You must apply appropriate technical and organisational measures to protect Guest Data, taking account of its nature and the risk, as the NDPA requires. At a minimum:

(a) devices used for the app have a screen lock, current software and, where available, remote wipe; (b) any record of Guest Data you keep outside the Platform under clause 4.1(c) is encrypted or kept in a locked, access controlled system, with access limited to named staff; (c) Manifest Data is held with the strongest controls you apply to any data, kept separate from general business files, and never sent by unencrypted email or messaging app; (d) lost or stolen devices are reported and signed out of the Platform at once; and (e) you test and review these measures at least once a year.

6.2 Pickup may set further minimum security steps in the app on 30 days' notice, or sooner where a security risk requires.

7. Retention and deletion

7.1 You must keep Guest Data no longer than you need it for the purposes in clause 4.1.

7.2 Unless the law requires you to keep it longer:

7.3 Where you keep Guest Data because the law requires it, you must keep only what the law requires, restrict access to it and use it only for that legal purpose.

7.4 When your admission to the Platform ends, you must delete Guest Data within 30 days, or return it to Pickup if we ask, keeping only what clause 7.3 allows, and confirm in writing that you have done so.

8. Personal Data Breaches

8.1 You must tell Pickup of any Personal Data Breach, or any reasonable suspicion of one, within 24 hours of becoming aware of it, through operator support and by email to privacy@pickupltd.com.

8.2 Your notice must describe what happened, the data and people affected (or an estimate), the likely consequences, and the steps you have taken or propose. If you do not have all of this at first, give what you have and send the rest as soon as you can.

8.3 You must take immediate steps to contain the breach, preserve evidence, cooperate with Pickup's investigation and follow Pickup's reasonable directions.

8.4 Each of you is responsible for its own duty to notify the NDPC within 72 hours of becoming aware of a Personal Data Breach, and affected people without undue delay where the risk to them is high. You must agree the content and timing of any notice that mentions Pickup with Pickup first, unless the law requires you to notify before that is possible.

9. Data subject rights and authority requests

9.1 Guests and Travellers may exercise their rights under the NDPA directly with you for Guest Data you hold. You must answer within the time the law allows.

9.2 You must tell Pickup within 2 business days of any request that concerns Pickup's own records, or that you cannot answer without Pickup's help, and Pickup will do the same for any request that concerns you.

9.3 If an authority asks you for Guest Data, you must check that the request is lawful, disclose only what it lawfully requires, keep a record of the disclosure and, unless the law forbids it, tell Pickup. The Law Enforcement Requests page explains how Pickup handles requests made to it.

10. Sub processors and transfers

10.1 You may use a service provider to process Guest Data for you (for example a secure records system) only under a written contract that gives at least the protection in this Addendum. You remain responsible for it.

10.2 You must not transfer Guest Data outside Nigeria, or allow access to it from outside Nigeria, unless the transfer meets the NDPA and GAID rules on cross border transfers: adequacy where the NDPC recognises it, otherwise standard contractual clauses, or a transfer necessary to perform the Booking (such as passenger reporting for an international flight). You must record the basis for each kind of transfer. Pickup stores data outside Nigeria with Supabase and Vercel, and transfers it only on a basis the NDPA allows. Its providers and the countries are listed in Sub-processors.

11. Children and special category data

11.1 A jet manifest may include a child. Treat a child's data with extra care, use it only for the flight and passenger reporting, and never contact a child.

11.2 Assistance needs, health information or anything revealing religion or ethnicity that a Guest records is special category data. Use it only to provide the assistance requested, show it only to the Assigned Crew who need it, and never record it in a review, report or note unless it is needed for safety.

12. Audit, liability and breach of this Addendum

12.1 On reasonable notice, you must give Pickup the information it reasonably needs to confirm your compliance with this Addendum, and allow an audit of your handling of Guest Data no more than once a year, or at any time after a Personal Data Breach or a credible complaint.

12.2 A breach of this Addendum is a breach of the Operator Agreement. Misuse of Guest Data for marketing, sale or contact outside the Platform, or a failure to report a Personal Data Breach, is a material breach and may lead to suspension or removal.

12.3 You indemnify Pickup against any loss, fine, penalty, claim or reasonable cost arising from your breach of this Addendum or of data protection law, as the indemnity clause of the Operator Agreement provides. Each party's liability is otherwise governed by the Operator Agreement.

13. Changes, governing law and contact

13.1 We may change this Addendum on at least 30 days' notice in the app and by email to your account email address. You accept a material change in the app, as the Operator Agreement provides, or you may close your operator account instead. A change required by law or the NDPC may take effect sooner, and we tell you why.

13.2 This Addendum survives the end of your admission for as long as you hold any Guest Data.

13.3 This Addendum is governed by the laws of the Federal Republic of Nigeria. Disputes are resolved under the Disputes and governing law clause of the Operator Agreement. Nothing in it limits a Guest's or Traveller's right to complain to the NDPC. Notices under this Addendum are given by email: to Pickup at privacy@pickupltd.com (legal notices: legal@pickupltd.com), effective on receipt; to you in the app or at your account email. Formal court process is served as the rules of court require, at Pickup's registered office, whose address is on the Corporate Affairs Commission public register.

13.4 Data protection questions and breach reports: privacy@pickupltd.com, for the attention of the Data Protection Officer. Legal notices: legal@pickupltd.com.