Privacy Policy

Version 3.1. Effective 3 November 2026.

In short

• We are Pickup Technology Limited, trading as Pickup Charter, and we are the data controller. Our Data Protection Officer is at privacy@pickupltd.com. We collect what a booking needs: your account details, identity check, bookings, payments, messages and trip location. We never sell personal data.
• Face matching at the ID check is biometric, so it needs your separate consent in an unticked box. You can refuse or withdraw. The alternative is a manual review: two uploaded photos, including one of you holding your ID, looked at by trained staff with no face matching software.
• Your operator sees your name, photo, review record and booking details. Your crew see your first name and the trip details. Your operator sees your phone number once the booking is confirmed. You and your crew see each other's numbers only from 1 hour before to 1 hour after the trip. Neither sees your ID document, selfie or card details.
• We delete raw trip location 30 days after the trip, and selfies and face templates 30 days after the identity decision or 7 days after you withdraw consent, unless an open case or legal hold needs them. ID, anti money laundering, financial, booking and tax records stay for 5 years. Jet passport and manifest records stay as long as NCAA rules require.
• Your data is stored outside Nigeria with Supabase and Vercel, and goes to the other providers named on our Sub-processors page, on bases the law allows. Analytics, marketing, the AI help chat and Pickup Tag discovery stay off unless you opt in.
• The app has emergency contact alerts and "Are you OK?" check-ins. They are not an emergency service and we do not guarantee continuous monitoring. In an emergency, call 112.
• You can see, correct, move or delete your data, object to how we use it, and complain to the Nigeria Data Protection Commission. Deleting your account takes effect at once, cannot be undone and loses any wallet credit. An active booking, a crew trip or an open case you opened stops it, and some records stay for 5 years.

This summary is for convenience only. The numbered clauses below set out how we use your personal data and govern if there is any difference.

---

1. Who we are and what this Policy covers

1.1 Controller. Pickup Technology Limited, a private company limited by shares incorporated in Nigeria under the Companies and Allied Matters Act 2020, registration number RC 9548096, registered office Lekki Phase 1, Lagos State, Nigeria, trading as Pickup Charter ("Pickup", "we", "us", "our"), is the data controller of the personal data described in this Policy, except where clause 9 says another person is a controller in its own right. We have no subsidiaries or other group companies that process your personal data.

1.2 Registration. Pickup is registered with the Nigeria Data Protection Commission (the "NDPC") as a data controller and processor of major importance under the Nigeria Data Protection Act 2023, registration number NDPC/DCP/14883, valid to 17 September 2027. We renew the registration before it expires and file our annual compliance audit returns with the NDPC.

1.3 Law. We process personal data under the Nigeria Data Protection Act 2023 (the "NDPA") and the NDPC's General Application and Implementation Directive 2025 (the "GAID"). Where clause 13 applies, we also comply with the UK General Data Protection Regulation and the Data Protection Act 2018 ("UK GDPR") and the EU General Data Protection Regulation 2016/679 ("EU GDPR").

1.4 Scope. This Policy applies to the Pickup Charter website at pickupcharter.com, the Pickup Charter mobile app for iOS and Android published by Pickup Technology Limited (including its guest, operator, and chauffeur and crew modes), and related services, emails and support channels (the "Platform"). It covers the people listed in clause 2.

1.5 Related documents. This Policy forms part of the Terms of Use, the Guest Terms, the Operator Agreement and the Crew Terms. If any of them conflicts with this Policy on personal data, this Policy prevails. These documents add detail and form part of this Policy:

1.6 Definitions. Capitalised words used in this Policy and not defined here have the meaning given in the Guest Terms. In particular:

2. Whose data we process

2.1 Assigned Crew accept the Crew Terms and read this Policy when they join. Each Operator is an independent controller of the data it processes about its own staff and its own customers (clause 9.2).

3. What we collect

3.1 Data you give us

(a) Account data. Full legal name, preferred name if you set one, email address, telephone number and date of birth (to confirm you are 18 or over). You may add a profile photograph, a home address and a Pickup Tag. You may save travel companions: a name, and a phone number or a link to their Pickup account.

(b) Sign in data. There is no password. You sign in with a six digit one time code sent to your email address, or with Apple or Google. Codes are sent by email only, never by SMS, WhatsApp or phone. We store only a scrambled (hashed) copy of each code, and it expires after 10 minutes. If you use Apple or Google, we receive from them your name, your email address (or, with Apple, a private relay address if you choose to hide your email) and an account identifier. We also keep a record of your signed in devices and sessions so you can see and end them.

(c) Identity data. A government issued identity document (national identity card, National Identification Number ("NIN") slip, international passport, driver's licence, voter's card, Ghana Card, Emirates ID or another national ID), the details read from it, and your NIN where you provide it. The Booker is asked for this after booking and before the trip starts. For a car or boat, a Lead Traveller who is on Pickup is asked instead. For Operator directors and payout signatories, also the Bank Verification Number ("BVN") check result. We do not ask Guests for a BVN.

(d) Biometric data. A selfie taken in the app for the automated check, and a face template made from it, compared with the photograph on your identity document or the photograph held against your NIN. This is Sensitive Personal Data. We collect it only with your separate explicit consent (clause 5). The two photos you send for a manual review are not put through face matching software, and no template is made from them (clause 5.5).

(e) Booking data. Pickup point, destination or area of operation, date, time, duration, number of passengers, vertical, extras and special requests.

(f) Assistance needs. Any accessibility or assistance need you choose to record, such as wheelchair access. Where this reveals something about your health, it is Sensitive Personal Data, and we use it only with your explicit consent, which you give by recording it, and only to deliver your trip. You can delete it at any time in Profile > Personal details.

(g) Payment data. Payments are processed by Flutterwave, a licensed payment provider. Pickup collects as the Operator's limited payment collection agent. The money stays in Pickup's balance with Flutterwave until it is paid to the Operator by transfer or refunded. Guests pay in naira. Card details are entered into Flutterwave's secure checkout and never reach Pickup's systems. We receive and keep only a token, the card brand, the last four digits, the expiry month and year, the issuing country, a fingerprint that lets us recognise the same card, and the record of each payment, bank transfer, refund and payout. For bank transfers, Flutterwave tells us the sender's name and bank so we can match and refund the payment. If you save a bank account in Profile > Wallet and payments, we keep the bank, the account name and number, and the name check result. Operators: payout bank account details and the account name check result. Payouts are made in naira to the Operator's verified business account by transfer through Flutterwave.

(h) Communications. In app messages with Operators and Assigned Crew, support conversations, reports, cases, disputes, reviews and photographs you submit. We have no support phone line and do not record support calls. If that changes, we will tell you at the start of each call.

(i) Traveller and contact details. If you book for someone else or add guests to a Booking, the name and telephone number or email of each person you add. For a private jet Booking, the passenger manifest: each passenger's full name, date of birth, nationality and passport or ID details, entered by the Booker or by each passenger through a secure link the Booker sends. We pass the manifest to the Operator, which approves it; we do not judge passports, and physical checks happen at the terminal. The names and contact details of people you share a trip with. Up to three emergency contacts you choose to save: a name, phone number, relationship and optional email address, or a link to their Pickup account if you pick them by Pickup Tag. We send your shared trips and alerts to them (clause 6.7). When you give us someone else's details you confirm that you are entitled to do so, that you have told them you are sharing their details with Pickup and the Operator, and that you have pointed them to this Policy.

(j) Preferences. Saved listings, currency and display choices, notification and marketing choices, and your privacy choices.

(k) Help chat. Questions you type into the help chat in Profile > Help (clause 8.8).

(l) Reports and lost items. What you tell us when you report a listing, a user, a message or a review, report that a chauffeur did not arrive, or report a lost item.

(m) Operator mode. One account can switch between guest mode and operator mode. If you choose Become an Operator or switch to operator mode, we collect the business and verification data described in the Operator Agreement and in clause 3.1(c). Your guest bookings and your operator business records are kept as separate records within the same account. We do not show your guest history to Guests who book your business, or your operator records to other Guests. If you sign up in a state where we are not live yet, the app tells you that your documents are held for verification ahead of our launch there.

(n) Waitlist. Website visitors can join a waitlist. We ask for an email address, whether you are joining as a guest or an operator, a consent tick and, for operators, a name or company. We also keep a one way hash of your IP address so we can limit misuse of the form. We use these details only to contact you about launch and onboarding. To stop, write to privacy@pickupltd.com.

(o) Job applications. If you apply for a role on our website, we ask for your name, email address, telephone number, where you live, your CV, an optional cover letter, whether the role's working arrangement suits you, whether you need relocation assistance and how you heard about the role. We use this only for that application.

3.2 Data we generate or observe

(a) Trip records. Reference, Operator, vehicle, vessel or aircraft, Assigned Crew, schedule, actual start and end times, trip events, stop check-ins and your answers, price and its components, payment record, status and outcome.

(b) Location data. See clause 6.

(c) Verification outcomes. The result of each check, the documents relied on, the reason for any decision, and the member of staff who made it.

(d) Risk signals and records. The fraud and risk signals in clause 8.3 and the staff record score in clause 8.9.

(e) Device and usage data. Device type, operating system, app version, language, time zone, IP address, screens and features used, searches made in the app, and crash and performance diagnostics. We do not collect the advertising identifier of your device (IDFA on iOS, advertising ID on Android).

(f) Audit records. Every administrative action in our systems, including every opening of an identity file, logged with time, named staff member, action and reason.

(g) Notifications. A push token for your device and the content of the notifications we send. You can turn them off in your device settings or in Profile > Notifications.

(h) Face ID and fingerprint unlock. If you turn on Face ID, Touch ID or another device biometric to unlock the app, the check happens entirely on your device under Apple's or Google's control. Your device tells the app only whether the check succeeded. Pickup never receives, stores or processes your Face ID or fingerprint data. This is separate from the ID check selfie in clause 5.

(i) Consent and acceptance records. Each time you accept our terms or acknowledge a policy (at sign up, or on the "We've updated our terms" screen when a new version takes effect), we record your user ID, the document and its version, the date and time, the app or website version, your IP address and the device used. Each time you give the biometric consent we record that you gave it with the check, and when. Each time you change an analytics, marketing or other privacy choice we record the choice and when you made it. We keep any arbitration opt out you send under the Guest Terms.

3.3 Data we receive from others

(a) Identity verification provider (Dojah). The result of the document and face check, a match score, the details read from the document and any fraud signals.

(b) Flutterwave. Card tokens, authorisation and 3D Secure results, settlement confirmations, refund status, chargeback notices and fraud signals.

(c) Apple and Google. The sign in details in clause 3.1(b), if you choose to sign in with them.

(d) Operators. Details of their vehicles, vessels and aircraft and of the Assigned Crew on your Booking, trip status updates, reviews and private flags about you, and, for jets, manifest approval.

(e) Someone who books for you. Your name and contact details and, for jets, manifest details, if another person books, adds you to a Booking, shares a trip with you, or saves you as an emergency contact or travel companion.

(f) Public and official records. For Operators, their directors and Assigned Crew: the Corporate Affairs Commission register, the NIN database through our verification provider, and the licence registers of the relevant transport authorities.

3.4 If you do not give us data

3.4.1 Some data is needed to make or perform our contract with you or to meet a legal duty. Without your name, contact details and identity check we cannot open an account or let a trip start, and without payment data we cannot take payment. Data marked optional in the app, such as a profile photograph, home address, saved listings, assistance needs or emergency contacts, is your choice, and leaving it out does not stop you booking. You do not have to agree to face matching: clause 5.5 offers a manual review, which still needs two photos.

3.5 What we do not collect

3.5.1 We do not ask for, and you should not send us, data about your political opinions, religious or philosophical beliefs, ethnic origin, trade union membership, sex life or sexual orientation, or health beyond an assistance need you choose to record.

3.5.2 We do not read your address book, photos or files. Emergency contacts are only those you type in yourself or pick by Pickup Tag. Where you attach a photo, you choose it through your device's picker and we receive only that photo. We do not collect trip location outside the Trip Window. We do not build a profile of your movements beyond the Bookings you make.

4. Why we use your data and our lawful basis

4.1 The NDPA requires a lawful basis for each use. This table is the complete list. We will not use personal data for a new purpose without updating this Policy first and, where the law requires, asking for your consent.

4.2 Legitimate interest. Where we rely on legitimate interest, we have carried out and recorded a balancing test that weighs our interest against your rights. You can ask for its substance, and you can object (clause 12).

4.3 Consent. Where we rely on consent, we ask for it clearly and separately, with an unticked box or an equal Yes and No choice. You can withdraw it at any time, as easily as you gave it. Withdrawal does not affect what we did before, and refusing or withdrawing consent never affects services that do not depend on it.

4.4 Marketing. We send marketing (news, offers and travel inspiration from Pickup) only with your consent. Marketing is off unless you opt in. We ask with an unticked option when you create an account, and you can opt in at News and offers from Pickup in Profile > Notifications. Personalised marketing, which uses your trips, has its own switch in Profile > Privacy and your data > Tracking, and is also off unless you turn it on. You can withdraw at any time with the unsubscribe link in any marketing email, with those switches, or by writing to privacy@pickupltd.com. Service messages about your account, Bookings, payments and safety are not marketing and continue while you hold an account. We never send marketing by SMS or WhatsApp. We never pass your details to other companies for their marketing.

4.5 Our emails. Every email from us carries the footer "Pickup Technology Limited, registered in Nigeria, RC 9548096, Lekki Phase 1, Lagos State, Nigeria." Transactional emails (sign in codes, Booking, payment, trip and account messages) do not carry an unsubscribe link, because they are needed to provide the service. Marketing emails always carry one.

5. Identity verification and biometric data

5.1 What happens. After you book and before your trip starts, the app asks you to confirm your identity. You do this once, for every trip. The Booker does it, or for a car or boat, a Lead Traveller who is on Pickup. There are two routes: the automated check and the manual review in clause 5.5. In the automated check you give your NIN or photograph your identity document, and you take a selfie in the app. Our identity verification provider, Dojah, reads the document, makes a face template from your selfie, and compares it with the document photograph or the photograph held against your NIN. A match approves you. Chauffeurs and crew go through a similar check before they can be assigned.

5.2 Sensitive Personal Data. We treat the selfie, the face template and the match result as Sensitive Personal Data under the NDPA and the GAID.

5.3 Separate explicit consent. Before the camera opens, the app shows the Biometric Data Notice with its own unticked box. You must tick it yourself. It is separate from accepting our terms, and nothing else in the app gives this consent. Changing your phone number in the app also asks for a new selfie matched to your ID by Dojah, and the same separate consent applies. If you do not want that, ask for a manual check through Profile > Help. We record the consent under clause 3.2(i). We rely on your explicit consent as the condition for processing this Sensitive Personal Data. Where we must keep the result after you withdraw consent, we do so only because it is needed to establish, exercise or defend legal claims or to meet a legal duty to prevent fraud or financial crime.

5.4 Limits. Biometric data is used only to confirm that you are the person on the document. It is never used for marketing, advertising, profiling, analytics or personalisation, never used to identify you in any other context, never shared with Operators or Assigned Crew, never sold and never used to train models, by us or by anyone else. ID files are open only to Trust and Safety and Compliance staff, and every opening is logged.

5.5 If you do not consent: manual review. You do not have to agree to face matching. On the consent screen, choose Can't use the live scan? Send photos for review, or ask through Profile > Help or at privacy@pickupltd.com. You upload two photos: a photo of your ID and a photo of you holding your ID, with your face and the ID in one picture. Trained staff in our Trust and Safety and Compliance teams look at them. No face matching software is used and no face template is made. This route still needs a photo of your face, and a person sees it. We keep the outcome, the document record and the name of the staff member. Most manual reviews finish within 24 hours. Some take up to 3 working days. Choosing manual review never affects the price or the Bookings available to you. If a manual review cannot confirm your identity, we tell you why and what else you can provide.

Deadlines. Complete your identity check as soon as you can after booking. For cars and boats, it is due 24 hours before the start. If you book less than 24 hours ahead, it is due before the trip starts. For jets, it is due by the manifest deadline: 24 hours before an international departure, 6 hours before a domestic one. If you book a jet after that deadline, you have 2 hours from booking, and never past wheels up. If you submit in time and our own review is still running, you are not treated as cancelling. Otherwise a missed deadline counts as the Guest cancelling, under the Guest Terms, and checkout warns you of this.

5.6 Automated result. The automated check can approve you. It cannot reject you. A no match counts as a try, and you get up to 3 live tries a day. After a no match you can try again, use a different ID or send photos for review. A person decides any review, and you may give further information (clause 8). A person makes every rejection.

5.7 Impact assessment. We carry out a data protection impact assessment before biometric processing begins, and we review it at least once a year and whenever the processing changes.

5.8 Who processes it. The selfie and any document photo you take go to our private identity storage with Supabase, outside Nigeria, and from there to Dojah, acting as our Processor under a written contract. Dojah compares them with your document photograph or the photograph held against your NIN in the National Identity Management Commission database, and returns the result to us. Dojah checks identity documents issued in Nigeria and abroad, including international passports. It may not use your biometric data for its own purposes, including training its own models, may not sell it, and may not share it except as needed to run the check for us. Authorised staff open ID files through our staff console, hosted by Vercel. Before any other provider handles identity or biometric data, we list it on the Sub-processors page, update the Biometric Data Notice and give the 30 days' notice in clause 10.2.

5.9 Retention. We and Dojah delete the selfie and the face template 30 days after the identity decision, unless an open fraud investigation, case or legal hold (clause 11.5) requires us to keep them longer. The photo of you holding your ID follows the same period. We keep the outcome of the check, the ID document record and the name of any reviewer for the period in clause 11.

5.10 Withdrawing consent. You can withdraw your biometric consent at any time in Profile > Security > Identity check, through Profile > Help or at privacy@pickupltd.com. We then delete your selfie and face template within 7 days, unless clause 5.9 requires us to keep them, and we stop using them for any new check. Withdrawal does not undo a check already completed, and it does not require us to delete the result and ID document record we must keep under clause 11. If a future check is needed, you can use the manual review.

6. Location data

6.1 Before a trip. We use the pickup point, destination and area you enter to price, plan and deliver the Booking.

6.2 Only inside the Trip Window. We collect trip location only inside the Trip Window: never earlier than 1 hour before the booked start time, and never later than 1 hour after the booked end time. For every trip, by car, boat or jet, we collect the location of the Assigned Crew's device to show trip progress, power trip sharing and check-ins, and keep an accurate trip record. For jets this includes altitude, where the device reports it. Jet trip status also comes from the Operator's updates and from public flight data, looked up by flight number and date only. The Booker and any Lead Traveller on Pickup see the live position once the crew is on the way, and up to 1 hour after the booked end time.

6.3 Your device. We collect your own device's location only if you grant permission in your device settings, and only while the app is open and in use, to show cars, boats and jets near you, to help set the currency prices are shown in, and to help with your pickup point. The guest app never collects your location in the background. You can withdraw permission at any time in your device settings. The app works without it: you can type your pickup point instead. Location is never a condition of a reward or credit.

6.4 Trip sharing. When you share a trip, the person you choose sees your first name, the vehicle or vessel and its plate, the Operator's name, the trip status and expected end, the latest position, and for cars the chauffeur's name (for boats and jets, crew are shown by role only). The link stops working 1 hour after the booked end time. You can have trips shared with your emergency contacts automatically in Profile > Safety > Share my trips. A crew member can share their own trip with their own contacts inside the Trip Window. Their link shows the position, status, Operator and expected end, and nothing about the Guest.

6.5 Chauffeurs, captains and crew. Assigned Crew share their device location only inside the Trip Window of a trip they are assigned to, and only while the app is open. The app asks for "while using" permission only and has no background location. Sharing stops automatically at the end of the Trip Window, and it can pause if the phone locks or loses signal. We do not track crew at any other time.

6.6 After the trip. We delete the raw location points 30 days after the trip ends, unless a report, case, incident, claim or legal hold relating to that trip is open, in which case we keep them until it closes. The trip record keeps only the start and end points and times and the distance travelled, for the period in clause 11.

6.7 Safety features and emergencies. On a live trip you can use Alert my emergency contacts, and up to 3 people you saved get your location by email, and in the app if they are on Pickup. Pickup sends no text messages, so a contact with no email address and no Pickup account gets nothing. On car and boat trips, if the trip has not moved for 15 minutes away from a planned stop, we ask "Are you OK?" in the app. You can change this in Profile > Safety > Trip check-ins. If you answer Get help, a safety report opens for our team. If you do not answer within 5 minutes, our staff can see that in our console, and your emergency contacts get an email only if you turned that on. Check-ins rely on location from the crew's phone. In-app safety features are secondary information tools and do not constitute an emergency response service. Pickup does not guarantee continuous, uninterrupted live monitoring, and automated prompts do not shift emergency response duties away from public authorities. In an emergency, call 112.

6.8 Precise location. Trip location is precise location. It is linked to the Booking and the account, used only for the purposes in clause 4, and never sold or shared with advertisers or data brokers.

7. What others see about you

7.1 A private flag an Operator or crew member raises about a Guest is seen only by Pickup staff. The Guest's rating and the reviews Operators write about them are shown to Operators the Guest books with and, once both sides have reviewed or the review window has closed, to the Guest.

8. Automated processing, risk scoring and decisions

8.1 No solely automated judgments. We do not make decisions that produce legal effects for you or affect you in a similarly significant way by solely automated means, except where a fixed rule in our terms applies. For example, a Booking is cancelled when an ID, manifest or balance deadline passes, and access is suspended when a licence or insurance document expires. You are told these rules in advance, and you can ask a person to review the result. A person makes every decision to reject verification, restrict or close an account for conduct, or decide a refund, case or claim.

8.2 Identity verification is assessed automatically, but only a person can reject you (clause 5.6).

8.3 Risk scoring. To prevent fraud and financial crime, our systems give Bookings, payments and accounts a risk score. The score uses signals such as the pattern and value of bookings, repeated cancellation after payment, a mismatch between Booker and Travellers, card and 3D Secure results and fraud signals from Flutterwave, device and network signals, the verification result, and reports and private flags. A flag sends the matter to a person, who may ask you for more information, ask for a manual identity review or hold the Booking while they check. A flagged Booking's payout waits up to 72 hours. Flutterwave runs its own fraud checks as a controller in its own right (clause 9.3). If you ask for a copy of your data, we tell you whether a score was applied to you, the main factors behind it and what a person decided.

8.4 Listing checks. Our AI provider, Anthropic, looks at listing photos, labels the area each one shows, and flags a dark photo, a plate or registration that shows, or a person in the shot. This is advice to the Operator, who can change every label and keep any photo. We also compare plates and registrations with other listings to spot duplicates. A match only holds the listing for a person to review. Nothing is rejected automatically, and the other Operator is never named.

8.5 Your rights. You can ask a person to review any automated result or score that affected you, give your point of view, and ask for an explanation of the main reasons. Write to privacy@pickupltd.com or use Profile > Help.

8.6 Search ranking uses the factors published in the Guest Terms. You can turn off Personalised suggestions in Profile > Privacy and your data.

8.7 Machine learning. We do not train models on identity document images, selfies, face templates, message content or precise location. We use de-identified and aggregated booking and trip data to improve search, the pricing suggestions we give Operators and our fraud checks. Automated scores never decide anything alone: a person reviews.

8.8 The help chat. Profile > Help includes a help chat. It is an automated AI assistant, not a person, and it says so. A person joins when you choose Talk to a person. Before your first message the app asks for your separate consent. If you do not agree, you can still reach a person through Talk to a person or by email. You can change your choice at any time in Profile > Privacy and your data > Tracking. What you type, your first name, and your recent trips, totals and refunds (for operators and crew, the matching business or crew facts) go to our AI provider, Anthropic, acting as our Processor, to generate an answer. We use Anthropic only on terms that forbid it from using your conversations to train its models and that limit how long it may keep them. We do not store the chat ourselves unless you hand over to a person, when the conversation joins your support case. Its answers are general information, not advice, and may be wrong or out of date. It cannot make decisions about refunds, disputes, claims or your account: a person does. Do not type card numbers, identity numbers or other sensitive details into it.

8.9 Staff record score. Our staff see an internal score from 0 to 100 for each Guest, Operator and crew member, worked out from their own history: for Guests, ratings from Operators, complaints, cancellations, safety reports and ID status. It is never shown to other users. A low score can lead a person to look at the record. It never decides anything alone. You can ask for it under clause 12.

9. Who we share data with

9.1 We share personal data only as set out here, only to the extent needed, and never by sale.

9.2 Operators as independent controllers. The Operator on your Booking receives the data in clause 7 so it can deliver the trip. From that point the Operator is an independent controller of that data and is responsible for its own compliance with the NDPA. Under the Operator Agreement and the Operator Data Processing Addendum each Operator must: use guest data only to deliver and account for the Booking and to meet its own legal duties; keep it secure and confidential and share it with its staff and crew only as needed for the trip; not use it for marketing, not contact Guests outside the Platform, and not sell it; keep it no longer than its own legal duties require; tell Pickup within 24 hours of becoming aware of any breach affecting it; and help Pickup answer rights requests that concern it. For jets, the Operator also uses the manifest to meet its aviation security and passenger reporting duties. You can make a rights request about an Operator's use of your data directly to the Operator, or through us and we will pass it on.

9.3 Other independent controllers. These receive data from you or us for their own legal duties, and their own privacy notices apply:

(a) Flutterwave, for its regulatory, anti money laundering, fraud, card scheme and record keeping duties, including its own checks on Operators who receive payouts; (b) Apple and Google, when you sign in with them, use their app stores, or receive push notifications through their services; (c) Banks and card issuers, which run 3D Secure checks and send their own one time codes. Pickup never sends codes by SMS; (d) Authorities under clause 9.6; (e) An Operator's insurer, under clause 9.4.

9.4 Insurance claims and professional advisers. Pickup does not provide, sell or arrange insurance, so we do not share your data with any insurer for a policy of our own. Operators hold their own commercial cover, and we check their documents. After an injury or severe property damage, we give the claimant the Operator's insurance certificate details. If you make a claim against an Operator's insurer and ask us to support it, we share the booking and trip records you ask us to share with that insurer. See Dispute Resolution. We also share data with our lawyers, accountants and auditors where needed, under duties of confidence.

9.5 Corporate transactions. A buyer, investor or successor in a merger, acquisition, financing or reorganisation, under confidentiality, with this Policy continuing to apply to the data transferred. We will tell you before your data becomes subject to a different privacy policy.

9.6 Authorities. Competent authorities where the law requires, as described in our Law Enforcement Requests policy. We do not disclose personal location, messages or passport details to the police or other authorities without a court order or warrant, unless there is an immediate, verifiable risk to life or a statute compels the disclosure. A request on letterhead alone is not enough. Pickup has applied for the Lagos State Service Entity Permit in the car rental (chauffeur hire) category. The Lagos State Ministry of Transportation receives personal data from us only as this clause allows. Any report to the Ministry holds only what the Amended Regulation for On-line Hailing Business and Taxi Cab Operation in Lagos State (2023) requires, and never a Guest's trip history. Every request logs the officer's identity and badge number, the legal instrument, the justification and the two staff who approved it.

9.7 No tracking, no advertising sale. We do not sell or lease personal data, or share it with data brokers. We do not show third party adverts in the app. We do not link data from the app with data from other companies' apps, websites or offline sources for targeted advertising or advertising measurement. Because we do not track you in this sense, the iOS app does not show the App Tracking Transparency prompt. If we ever wanted to track, we would update this Policy first and ask your permission through the App Tracking Transparency prompt on iOS and the equivalent controls on Android, and nothing would change unless you agreed. The app and the website contain no advertising, attribution or marketing measurement technology (see the Cookie Policy).

9.8 Cameras in vehicles and vessels. An Operator may use cameras inside its vehicles or vessels only if it discloses them on the listing and by a visible notice inside. It may not record audio without a separate notice. Footage is the Operator's, as an independent controller under the NDPA. It is kept for 30 days unless it is needed for a case, report, claim or legal hold, and it is never published. Pickup does not receive footage unless an Operator or a Guest shares it for a case, and then we keep it with the case record.

10. Processors and international transfers

10.1 Processors. Service providers process personal data on our instructions under written contracts that require them to: act only on our documented instructions; keep the data confidential and secure; use sub-processors only with our authorisation and on the same terms; help us meet your rights and our security and breach duties; tell us of a breach without undue delay; delete or return the data at the end of the service; and allow audits. None may use the data for its own purposes. The current list of providers, with the purpose, the data and where it is processed, is on our Sub-processors page, which forms part of this Policy.

10.2 Changes to providers. We update the Sub-processors page before a new provider starts processing personal data or an existing one changes what it does or where. If a change affects Sensitive Personal Data, or moves data to a new country, we also tell account holders in the app or by email at least 30 days before it takes effect, unless it is urgent for security or to meet the law.

10.3 Stored outside Nigeria. Your data is stored outside Nigeria. Our main database, authentication and file storage, including identity documents and selfies, are hosted by Supabase. Our website and staff console are hosted by Vercel. Payment, maps, email, push notification, monitoring, AI and other providers also process data outside Nigeria, in the countries listed on the Sub-processors page, which include the United Kingdom, the European Union and the United States.

10.4 Transfer bases. We transfer personal data out of Nigeria only on a basis the NDPA and the GAID allow, such as standard contractual clauses or adequate protection. Where the NDPC recognises the destination as giving adequate protection, we rely on that. Otherwise the recipient is bound by standard contractual clauses that give an adequate level of protection, in the form the NDPC approves where it has set one. We use the other grounds the NDPA allows, such as your explicit consent after we have told you of the risks, or a transfer needed to establish, exercise or defend legal claims, only for a single transfer that cannot be made on those bases.

10.5 Records and copies. We record the basis for each transfer in our transfer register, assess the law and practice of the destination, and add encryption and access controls where needed. You can ask for a copy or summary of the relevant safeguard at privacy@pickupltd.com.

11. How long we keep data

11.1 We keep personal data only as long as its purpose requires, then delete it or make it anonymous. Where a period runs "from closure", it runs from the date the account is deleted.

11.2 Deleting your account. You can delete your account at any time:

(a) Guests: Profile > Security > Delete my account. Enter the code we email you and type DELETE. This is the same however you sign in, including with Apple or Google. (b) Operators: close the operator account first, in the menu at Business details > Close operator account. Your guest account stays open. Then delete it as in (a). (c) Chauffeurs and crew: close the crew record first, at Profile > Security > Delete your account in crew mode. Your guest account stays open. Then delete it as in (a). (d) Without the app: email privacy@pickupltd.com from your registered address with the subject "Delete my account". We confirm it is you with a code sent to that address. You do not need to reinstall the app. Our Delete your account page explains the steps.

You cannot delete your account while you have an active booking, a crew trip you are assigned to, or an open case you opened. The app tells you which applies. A request by email is also checked for any legal hold. Deleting the app from your phone does not delete your account.

11.3 What happens when you delete. Deletion takes effect at once and cannot be undone. It erases your name, phone, date of birth, photo, home address, marketing data and sign in links, along with your emergency contacts, travel companions, assistance needs, preferences, saved payment tokens and push tokens. Any copies left go within 30 days, including from backups. Wallet credit is lost. Financial, booking, tax and anti money laundering records stay for 5 years, attached to an anonymous account reference where possible, and other records we must keep stay for the periods in clause 11.1. They are restricted to the staff who need them and then deleted. We confirm by email.

11.4 Deleting some data without closing your account. You can remove saved cards, emergency contacts, travel companions, assistance needs and your profile photo yourself in the app, and withdraw your biometric consent (clause 5.10). To ask us to delete other data, write to privacy@pickupltd.com.

11.5 Legal hold. Where a dispute, incident, police request or regulatory request is open, relevant records are kept until it concludes, even where a period above has ended. A legal hold overrides every period in this clause. We tell you when this applies, unless the law prevents us.

12. Your rights

12.1 Under the NDPA you have the right to:

(a) be told how we use your data, and get access to a copy of it with the purposes, recipients, retention period and source; (b) have inaccurate or incomplete data corrected; (c) have data erased where we no longer have a lawful reason to keep it; (d) restrict processing while a dispute about accuracy or an objection is resolved; (e) object to processing based on legitimate interest, and to direct marketing at any time; (f) receive the data you gave us in a structured, commonly used, machine readable format, and have it sent to another controller where feasible; (g) withdraw consent at any time, without affecting earlier processing; (h) not be subject to a decision based solely on automated processing that significantly affects you, and have a person review an automated result (clause 8); and (i) complain to the NDPC.

12.2 These rights belong to everyone in clause 2, including Travellers, Operator directors and Assigned Crew.

12.3 How to exercise them. Email privacy@pickupltd.com or write to us through Profile > Help in the app. To get a copy of your data, you can also use Profile > Privacy and your data > Request a copy of your data. To delete your account, follow clause 11.2. We may verify your identity first, usually with a code sent to your account email. A request is free. We acknowledge it within 7 days and complete it within 30 days. For complex or numerous requests we may extend that by up to two further months, telling you within the first 30 days with the reason. Details are in Data Protection: Your Rights.

12.4 Limits. Some rights are limited by law, for example where we must keep records (clause 11), where disclosure would reveal another person's data, or where it would prejudice the prevention or detection of crime. We will tell you which limit applies unless the law prevents us.

13. Guests outside Nigeria, including the United Kingdom and European Union

13.1 When this applies. We market Pickup to people wherever they live, including in the United Kingdom, the United States and the European Union, and our services are delivered in Nigeria. Wherever you are, you have the rights in this Policy. If you are in the United Kingdom or European Union, UK GDPR or EU GDPR may also apply to our processing of your data, and you have rights under those laws as well. Nothing in this Policy or our terms takes away a right those laws give you.

13.2 Lawful bases. The bases in clause 4 correspond to Article 6 of UK and EU GDPR (contract, legal obligation, legitimate interests, vital interests and consent). Biometric data used to identify you, and health data in an assistance need, are special category data. We rely on your explicit consent under Article 9(2)(a), and for keeping verification results after withdrawal, on Article 9(2)(f) (legal claims).

13.3 Rights. You have the rights in Articles 15 to 22, which match those in clause 12. We respond within one month, extendable by two further months for complex or numerous requests, and we will tell you if we extend.

13.4 Contact. We have no establishment in the United Kingdom or the European Union. We are appointing a UK and EU data protection representative. In the meantime, privacy@pickupltd.com takes requests from those places, and our Data Protection Officer answers them under the timescales in clause 13.3.

13.5 Transfers to Nigeria. Nigeria does not have a UK or EU adequacy decision. You give us your data directly, for trips delivered in Nigeria by Nigerian Operators, so it is processed in Nigeria because that is necessary to perform the contract you ask for, with the safeguards in clause 10. Our main database is hosted outside Nigeria (clause 10.3).

13.6 Complaints. You may complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in your EU country of residence, work or the place of the alleged infringement.

13.7 Other countries. Before we offer trips in another country, such as Ghana or the United Arab Emirates, we add to this Policy the rights, lawful bases and contacts that country's law requires.

14. Children

14.1 The Platform is not for children. You must be 18 or over to create or hold an account, as a Guest, an Operator director or Assigned Crew. We ask for your date of birth at sign up, and the identity check confirms it against a government document before any trip. We do not knowingly collect personal data from anyone under 18 for an account. If we find that an account holder is under 18, we close the account and delete its data, except records we must keep by law.

14.2 A child may travel on a Booking made and supervised by a parent, guardian or other responsible adult. For cars and boats we then hold only the passenger count and any assistance need the adult records.

14.3 For a private jet, the passenger manifest must include every passenger, including a child, because the Operator needs it to meet aviation security and passenger reporting rules. A parent or guardian, or the Booker with their authority, enters the child's details and gives consent on the child's behalf. We process them because the Operator's aviation security duty requires them, and only to pass the manifest to the Operator. We keep them as long as NCAA rules require (clause 11.1). A child cannot use the share link to enter their own details.

14.4 If we learn that we hold data collected from a person under 18 without the consent of a parent or guardian where the NDPA requires it, we delete it. Parents or guardians can contact privacy@pickupltd.com.

15. Security and breaches

15.1 We apply technical and organisational measures appropriate to the risk, including:

(a) encryption in transit and at rest, with identity documents and selfies held in a separate, restricted storage area; (b) no passwords for users; email codes or Apple or Google sign in, and for our staff, an emailed code plus an authenticator app with backup codes, or a passkey; (c) named, role based staff accounts and least privilege access, with ID files open only to Trust and Safety and Compliance staff; (d) logging of administrative access to personal data, including every opening of an ID file; (e) card data handled only by Flutterwave, which is certified to the Payment Card Industry Data Security Standard; Pickup receives only tokens; (f) confidentiality and data protection obligations on staff and contractors, and training; (g) recurring security review and testing, including after major changes, with findings tracked to closure; and (h) for Operators, a change of payout account needs a name check with the bank; the new account takes over after 72 hours, and we email the account owner.

15.2 Breaches. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we notify the NDPC within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you, we tell you immediately and without undue delay, in plain language, by email or in the app, with what happened, the likely consequences, what we are doing and what you can do to protect yourself. Our Processors must tell us of a breach without undue delay, and Operators within 24 hours of becoming aware of it. We keep a record of every breach, whether or not it is notified.

15.3 Report a concern. Report a security vulnerability or suspected breach to security@pickupcharter.com. We acknowledge security reports within 2 business days.

16. Data Protection Officer

16.1 Our Data Protection Officer oversees our compliance with the NDPA and the GAID and is your point of contact for anything in this Policy.

16.2 Contact: privacy@pickupltd.com. Requests and notices about personal data are made by email or through Profile > Help, and take effect when we receive them.

16.3 We may change the person who holds the role without changing this Policy. The contact details above always reach the Data Protection Officer.

16.4 Our compliance staff oversee the anti money laundering checks on Operators and payouts. Contact them through legal@pickupltd.com.

17. Complaints

17.1 We would like the chance to put things right first. Write to privacy@pickupltd.com. Our Dispute Resolution page explains how we handle complaints and how long each step takes.

17.2 You may complain to the Nigeria Data Protection Commission at any time, at ndpc.gov.ng. You do not need to come to us first.

18. Changes

18.1 We publish the current version and its date on this page. Earlier versions are available on request.

18.2 If a change materially affects how we use your data, who receives it, where it is processed or how long we keep it, we notify you in the app or by email at least 30 days before it takes effect. A change needed for safety or to meet the law takes effect immediately. We ask for fresh consent where the law requires. When we publish a new version, existing users see the "We've updated our terms" screen the next time they open the app, and review it there. You may delete your account instead (clause 11.2). Changes to the Sub-processors page follow clause 10.2.

19. Contact

20. Summary of data collected by the app

20.1 This table summarises clauses 3 to 10 in the categories used by Apple's App Privacy details and Google Play's Data safety section. If it differs from the clauses above, the clauses above apply. "Linked to you" means linked to your account. "Tracking" has the meaning in clause 9.7. None of this data is used for tracking.

20.2 Not collected. Health and fitness data (beyond an assistance need you choose to record), your address book, browsing history outside the app, audio recordings, calendar, files, advertising identifiers, credit score, and Face ID or fingerprint data.

20.3 Security and deletion. All data is encrypted in transit and at rest (clause 15). You can delete your account in the app or by email, or ask us to delete some of your data (clause 11.2 to 11.4).