Sub-processors
The service providers that handle personal data for Pickup, what each one does, what data it receives and where it is processed, and how we tell you about changes.
Updated 2 November 2026 · 7 min read
Version 3.0. Effective 2 November 2026.
In short
- These are the companies that handle personal data for us, so we can run Pickup Charter. Your data is stored outside Nigeria with Supabase and Vercel.
- Each one works only on our instructions, under a written contract, and may not use your data for its own purposes.
- We transfer data out of Nigeria only on a basis the law allows, such as standard contractual clauses or adequate protection.
- No provider receives personal data until it is listed here.
- We update this page before any change. If a change affects your identity or biometric data, or moves data to a new country, we also tell you at least 30 days ahead.
This summary is for convenience only. The numbered clauses below govern.
1. About this list
1.1 This list is published by Pickup Technology Limited, RC 9548096, Lekki Phase 1, Lagos State, Nigeria, trading as Pickup Charter ("Pickup", "we", "us"). It forms part of our Privacy Policy. Words with capital letters have the meaning given there.
1.2 A Processor handles personal data for us and on our instructions. This list is complete: it covers every Processor that handles personal data of Guests, Travellers, Operators, Assigned Crew or website visitors. No other provider receives personal data from us.
1.3 Each Processor is bound by a written contract under the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025 (GAID) that requires it to act only on our instructions, keep the data confidential and secure, use its own sub-processors only on the same terms, help us meet your rights, tell us of a breach without undue delay, and delete or return the data when the service ends.
1.4 Some companies receive data as controllers in their own right, not as our Processors. They are listed in section 3 so the picture is complete. Their own privacy notices apply.
2. Our Processors
| Category | Provider | Purpose | Personal data | Where processed |
|---|---|---|---|---|
| Hosting, database, authentication and file storage | Supabase | Runs our main database, the email code sign in, sessions, our backend and scheduled jobs, website waitlist sign-ups, and storage of documents and photos, including a separate restricted area for identity documents and selfies | Account, sign in, booking, trip, location, payment record, message, case, verification outcome, document and waitlist data | Outside Nigeria, in Europe (the United Kingdom or the European Union) |
| Website and staff console hosting | Vercel | Hosts and delivers the pickupcharter.com website and the staff console. Authorised staff use the console to work with personal data, including opening ID files | Website: IP address, request data, server logs. Console: account, booking, case and location data, and ID files, as staff open them | Outside Nigeria. Website: United States, and Vercel's global network. Console: United Kingdom |
| Payments, refunds and payouts | Flutterwave | Card payments through its secure checkout, bank transfers and booking-specific virtual accounts in naira. Pickup's collected funds stay in Pickup's balance with Flutterwave until they are paid to the Operator by transfer or refunded. Account name checks | Name, email, phone, card token, last four digits, card brand, expiry and issuing country, payment and payout records, bank account details | Nigeria, and the countries where its cloud hosting runs |
| Identity verification | Dojah | Reads identity documents issued in Nigeria and abroad, checks NIN records, makes the face template from your selfie and returns the match result, including when you change your phone number. Checks chauffeurs' NIN, selfie and driving licence, and Operators' company registration, director BVN and tax number. See the Biometric Data Notice | Identity document images and details, NIN, selfie, face template, match result; for Operators, company details, BVN and TIN check results | Nigeria, and the countries where its cloud hosting runs |
| Email delivery | Resend | Sends sign in codes, booking, trip, payment and account emails, emails to your emergency contacts, and the marketing emails you agree to | Name, email address, email content, delivery and open records | United States |
| Push notifications | Expo | Relays app notifications to Apple and Google | Push token, notification content | United States |
| Push delivery | Apple Push Notification service and Google Firebase Cloud Messaging | Delivers notifications to your device | Push token, notification content | United States, and their global networks |
| Maps, places and routes | Google Maps Platform | Maps, pickup point and place search, routes and drive times, live trip display, jetty, marina and airport locations | Locations you enter, trip location inside the Trip Window, IP address | United States, and its global network |
| Error monitoring | Sentry | Finds and fixes crashes and errors in the app and our backend. It is not used on the website | Technical logs, device and app data, scrubbed of contact details and tokens before they are sent | European Union |
| Product analytics | PostHog | Shows us, on pseudonymised data, how the app is used. It runs only with your consent, asked at first launch. It is not used on the website | Pseudonymised usage and device data, your account ID, and location derived from your IP address | European Union |
| AI help chat and listing photo checks | Anthropic | Generates answers in the help chat, only after you agree. Labels listing photos and flags dark photos, plates and people in shot. Anthropic may not train its models on this data, under a contract that limits how long it keeps it | Help chat: what you type, your first name, and your recent trips, totals and refunds, or for operators and crew the matching business or crew facts. Photo checks: the listing photos | United States |
| Staff email and documents | Google Workspace | Our own email and documents | Data handled in internal operations, including support and privacy correspondence | United States and European Union |
2.1 Our Processors may use their own sub-processors, such as cloud hosting. They may do so only on terms that give the same protection, and they remain responsible to us for them. You can ask us for details at privacy@pickupltd.com.
2.2 No personal data. These providers receive no personal data from us. Flight status for jet trips and airport pickups comes from AirLabs, or FlightAPI.io or AeroDataBox as a fallback, looked up by flight number and date only. Boat weather comes from Open-Meteo, looked up by the jetty's location. Display exchange rates come from ExchangeRate-API.
3. Independent controllers
| Who | Why they receive data | Their notice |
|---|---|---|
| The Operator on your Booking | To deliver your trip and meet its own legal duties. See the Privacy Policy for what each Operator must do | The Operator's own notice |
| Flutterwave | For its own regulatory, anti money laundering, fraud, card scheme and record keeping duties | Flutterwave's privacy notice |
| Your bank or card issuer | 3D Secure checks and its own one time codes. Pickup never sends codes by SMS | Your bank's notice |
| Apple and Google | Sign in with Apple or Google, if you choose it; app store downloads | Apple's and Google's privacy notices |
| An Operator's insurer | At your request, to support a claim. After an injury or severe property damage, we give the claimant the Operator's insurance certificate details | The insurer's notice |
| Authorities | Only as our Law Enforcement Requests policy allows | Not applicable |
3.1 Pickup does not provide, sell or arrange insurance, and shares no data with any insurer for a policy of its own.
4. Transfers out of Nigeria
4.1 Your data is stored outside Nigeria with Supabase and Vercel. Where a Processor handles data outside Nigeria, in the countries shown in section 2, we rely only on a basis the NDPA allows, as clause 10 of the Privacy Policy sets out: a recognition of adequate protection by the NDPC where one exists, and otherwise standard contractual clauses.
4.2 The countries where personal data is processed are: Nigeria, the United Kingdom, the European Union and the United States, together with the global networks of Vercel, Apple and Google for delivery.
5. Changes to this list
5.1 We update this page before a new Processor starts handling personal data, before an existing one changes what it does or where it processes data, and when we stop using one. The date at the top shows the last change.
5.2 If a change affects identity documents or biometric data, or moves personal data to a country not already listed, we also tell account holders in the app or by email at least 30 days before it takes effect, unless it is urgent for security or to meet the law. You can object by writing to privacy@pickupltd.com. If we cannot meet your objection, you can delete your account before the change takes effect.
5.3 Earlier versions of this list are available on request.
6. Contact
6.1 Questions about this list: privacy@pickupltd.com, for the attention of our Data Protection Officer.
6.2 You may complain to the Nigeria Data Protection Commission at ndpc.gov.ng at any time.
Questions about this document?
Email legal@pickupltd.com or write to Pickup Technology Limited, Lekki Phase 1, Lagos State, Nigeria. For help with a booking, use Help in the app.
Contact legal