Privacy policy.

1 · Scope & Roles

This Policy applies to personal information collected when accessing or using the Platform, communicating with Conductor, or otherwise interacting with their services. For the NDPA, Conductor functions as the Data Controller regarding personal information, except where specific processing activities involve them acting as a processor on behalf of another controller (such as certain identity-verification activities where the controller is a licensed identity provider).

2 · What We Collect

The following categories of information are collected:

1. Registration & profile data: name, date of birth, phone number, email, gender (where declared), photograph, password (hashed), preferred language, initial role (Passenger or Driver), and occupation category (optional).
2. Identity-verification data: NIN and NIN-verification records; for Drivers, driver’s licence number, licence photograph, and licence verification records; vehicle registration papers, insurance certificate, and other supporting documents.
3. Trip & usage data: Bookings, Trips published, Trip-Days completed, cancellations, ratings, chat messages, service-recovery credits and referrals.
4. Location data: pickup and drop-off coordinates, live GPS during a Trip, and area-level home / work coordinates captured during onboarding (see clause 6).
5. Financial data: Wallet balances, transaction history, bank-account details submitted for withdrawals, and tokenised card details as held by payment processors.
6. Device & technical data: device model, operating system, app version, IP address, session identifiers, telemetry (battery, network kind, GPS accuracy), and analytics events.
7. Safety data: SOS activations, emergency contacts nominated, incident reports, safety-relevant photos or recordings (e.g. vehicle photographs), and dispute records.
8. Communications: messages exchanged in the in-app chat, support tickets, and notifications delivered via their providers.
9. Search & preference data: the routes and days searched, filters applied, promotional codes redeemed, and preferences set.

3 · How We Use It

Personal information is used to:

1. operate the Platform — register accounts, verify identity, publish or book Trips, calculate fares, process payments, and settle earnings;
2. keep the Platform safe — run Trust & Safety systems, detect fraud, prevent abuse, investigate incidents, and respond to disputes;
3. improve the Platform — understand feature usage, prioritise product decisions, calibrate pricing, and develop new features;
4. communicate with users — send Trip notifications, service messages, safety alerts, receipts, and (where opted in or the law permits) promotional messages;
5. meet legal, tax, and regulatory obligations — including obligations under the NDPA, NDPR, FCCPA, Federal Inland Revenue Service (FIRS) requirements, and any lawful requests by competent authorities;
6. enforce Terms and defend legal rights.

4 · Legal Bases (NDPA)

Processing relies on one or more of the following lawful bases under the NDPA:

1. Contract — processing necessary to perform services to users (e.g. matching Passengers with Drivers, processing payments).
2. Legal obligation — processing required by Nigerian law (e.g. VAT, KYC / identity verification, responding to lawful orders).
3. Legitimate interests — where processing is necessary for Conductor’s or a third party’s legitimate interests and not overridden by user rights and freedoms (e.g. fraud prevention, Platform integrity, research and product improvement using aggregated data).
4. Consent — where specifically requested (e.g. certain marketing communications, background-location tracking outside a Trip window).
5. Vital interests — where processing is necessary to protect the life or physical safety of any person (e.g. SOS activations).

5 · Who We Share With

1. Other Users, on a need-to-know basis: a Driver receives the Passenger’s first name, rating, and pickup / drop-off; a Passenger receives the Driver’s first name, rating, and Vehicle’s make / model / plate (partially masked in some contexts). Full identity documents, home / work coordinates, or unmasked phone numbers are not shared between Users.
2. Service providers under written contract and confidentiality obligations, including cloud hosting, payment processing (Paystack), mapping (Google Maps & Places), notification orchestration (Novu, WhatsApp / Meta), identity verification (QoreID, VerifyMe), analytics, and customer-support tooling.
3. Regulators, courts, and law-enforcement agencies where required by law, court order, or valid regulatory demand, or where there is good-faith belief that disclosure is necessary to prevent harm, fraud, or a violation of law.
4. Corporate transactions — in the event of a merger, acquisition, financing, insolvency, or sale of assets, information may be transferred to the counterparty, subject to appropriate protections.
5. With your consent — e.g. where connecting a third-party service to a Conductor account, or authorising sharing information with a workplace-benefits scheme.

Personal information is not sold, and it is not used for interest-based advertising to third parties.

6 · Location Data

1. The Platform collects location data (a) at points where users actively use location features (searching, booking, setting home / work), (b) during Trips (for safety and to power in-Trip UX such as ETA and route replay), and (c) where background-location permission has been granted (for pickup-arrival detection when the phone is asleep).
2. Location permission may be revoked at any time through device settings. Revoking permission may disable safety or matching features that require it.
3. Location precision is minimised where possible. Home and work areas are stored as neighbourhood-level coordinates, not exact street addresses.
4. Location data is not sold.

7 · National Identification Number (NIN)

The following notice supplements this Policy in relation to NIN specifically, and forms part of it.

1. Identity verification. NIN is used to confirm that the registered identity is genuine and belongs to the user. This helps confirm the identity of both Drivers and Passengers and prevents the use of false, stolen, or fraudulent identities.
2. Safety and security. NIN verification forms part of safety measures. It supports accountability, deters misconduct, and protects the community from fraudulent or harmful activity.
3. Driver and Passenger authentication. For Drivers, NIN verification is part of onboarding and due diligence to ensure that only properly identified individuals provide transportation services on the Platform. For Passengers, NIN verification reduces impersonation and promotes trust between all Users.
4. Fraud prevention and investigation. NIN may be used to detect, prevent, investigate, and respond to fraud, identity theft, abuse of the Platform, or other activities that violate the Terms or applicable law.
5. Legal and regulatory compliance. NIN may be processed to comply with applicable laws, lawful requests from competent authorities, and other requirements imposed by relevant governmental agencies.
6. Protection. NIN is treated as sensitive personal information with reasonable administrative, technical, and organisational measures to protect it against unauthorised access, disclosure, alteration, misuse, or loss. Access is restricted to authorised personnel and trusted service providers who require it to perform verification, security, or compliance functions and are bound by confidentiality and data-protection obligations.
7. No sale or marketing. NIN is not sold and is not used for marketing.
8. Retention. NIN is retained only for as long as necessary to fulfil the purposes above, comply with legal and regulatory requirements, resolve disputes, or enforce contractual rights. Where retention is no longer required, it will be securely deleted or anonymised in accordance with the retention schedule.
9. Your rights. Subject to applicable law, users may request access, correction, objection, or exercise other rights available under NDPA (see clause 9 below).

8 · Retention

Personal information is retained only for as long as necessary for the purposes described in this Policy, or for such longer period as is required by law. Indicative retention windows (subject to specific legal, regulatory, or operational requirements):

• Account & profile data — while the account is active, and thereafter for a reasonable period to satisfy legal obligations, resolve disputes, and enforce agreements.
• Identity-verification records (including NIN, licences, vehicle documents) — for the duration of the account and thereafter for such period as is required by anti-fraud, safety, tax, or regulatory obligations.
• Trip, payment, and settlement records — for a minimum of seven (7) years, or such longer period as required for accounting, tax, or audit purposes.
• Search history & usage telemetry — up to 365 days by default (admin-tunable), used for personalisation and product research.
• Chat and support communications — for such period as is required to service tickets, respond to disputes, and comply with law.
• Anonymised / aggregated data — may be retained indefinitely.

9 · Your Rights

Subject to applicable law and to any specific conditions, users have the right to:

• ask Conductor to confirm whether personal information is processed and to receive a copy;
• ask Conductor to correct inaccurate or incomplete information;
• ask Conductor to delete personal information no longer having a lawful basis to retain;
• object to processing on grounds of particular situation, or to withdraw a consent previously given;
• request restriction of processing in certain cases;
• request portability of personal information provided to Conductor, in a structured, commonly used, machine-readable format;
• lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise a right, contact privacy@conductor.ng. Conductor may need to verify identity before responding. Response will be within the timeframe required by law and generally within thirty (30) days.

10 · Security & Breaches

1. Administrative, technical, and organisational safeguards are implemented to protect personal information from unauthorised access, disclosure, alteration, misuse, or loss. These include encryption in transit, access controls, network segmentation, audit logs, and staff training.
2. No system is completely secure. If account or personal information has been compromised, contact Conductor immediately at security@conductor.ng.
3. Where a personal-data breach is likely to result in a risk to affected individuals, the Nigeria Data Protection Commission and any affected individuals will be notified in accordance with the NDPA.

11 · Children

The Platform is not intended for and may not be used by any person under the age of 18. Personal information is not knowingly collected from any person under 18. If Conductor becomes aware that such information has been collected, it will be deleted and the associated account will be terminated.

12 · Cross-Border Transfers

Some service providers process personal information outside Nigeria. Where personal information is transferred outside Nigeria, this is done in accordance with the NDPA, including by relying on adequacy decisions, standard contractual clauses, binding corporate rules, or one of the other lawful transfer mechanisms recognised under Nigerian law.

13 · Contact & Data Protection Officer (DPO)

Questions, requests, or complaints about privacy or personal information: privacy@conductor.ng.