TrustBasket Rider — Privacy Policy

1.1 Account and profile data

• Full name, email address, phone number, and password (stored in hashed form);
• Profile photograph (where provided);
• Vehicle type, plate number, and vehicle photograph;
• Working hours and availability preferences.

1.2 Identity and verification data (KYC)

Because riders handle goods and payments on behalf of vendors and customers, we collect verification data during onboarding:

• National Identification Number (NIN);
• Driver's licence image;
• Passport photograph;
• Home address, a photograph of your residence, and (where requested) a utility bill.

1.3 Bank and financial data

• Bank name, bank code, account number, and account name (used to verify your account and pay out withdrawals);
• Transaction PIN (stored in hashed form; used to authorise withdrawals);
• Wallet balance, earnings, withdrawal requests, and transaction history.

1.4 Guarantor data

We collect the name, phone number, NIN, and address of the two guarantors you nominate. You must obtain your guarantors' consent before submitting their details; we process guarantor data to verify your application and to contact guarantors where our Terms permit.

1.5 Order and activity data

• Orders offered to, accepted, and completed by you; pickup and delivery addresses; delivery and pickup verification events; timestamps; earnings per order;
• Ratings, feedback, and support communications relating to you.

1.6 Device and technical data

• Device model, operating system, and app version;
• Push notification token (used to alert you to new orders and account events);
• Network status and diagnostic information, IP address, and security logs.

1.7 Camera and photo library

With your permission, the App accesses your camera and photo library solely so you can capture and upload the verification documents and images described above. We do not access your photos for any other purpose.

The App does not track your background location and does not record audio.

We use personal data to:

• Create, verify, and manage your rider account, including KYC/identity verification and guarantor checks;
• Match you with delivery orders and operate the pickup/delivery workflow;
• Calculate, credit, and pay out your earnings, verify your bank account, and process withdrawals authorised with your PIN;
• Send you push notifications about new orders, order updates, payouts, and account or verification status;
• Provide customer and rider support and resolve disputes;
• Detect, investigate, and prevent fraud, order manipulation, unremitted cash collections, and other misuse;
• Comply with legal obligations, including financial-records, anti-fraud, anti-money-laundering, and regulatory requirements;
• Maintain the security, performance, and improvement of the App.

Depending on the processing activity, we rely on: performance of a contract (operating your rider account, orders, and payouts); legal obligation (KYC, financial records); legitimate interests (fraud prevention, platform security, service improvement); and consent (camera/photo access, push notifications — each of which you can withdraw in your device settings).

We do not sell your personal data. We share it only with:

• Vendors and customers on the platform — limited to what they need to complete a delivery (e.g. your name, photo, vehicle details, and phone contact for an active order);
• Identity-verification and KYC providers — to verify your NIN, documents, and bank account;
• Payment and banking partners — to verify your bank account and process withdrawals;
• Cloud infrastructure and storage providers — which host our backend and store uploaded documents and images on our behalf;
• Push-notification service providers (e.g. Expo/Firebase) — to deliver order alerts to your device;
• Your nominated guarantors — we may confirm with them that they agreed to act, and contact them where our Terms permit;
• Law enforcement, regulators, or courts — where disclosure is required by law or necessary to establish or defend legal claims;
• A successor entity — in connection with a merger, acquisition, or restructuring, subject to this Policy.

All service providers act under contracts that restrict their use of your data to the services they provide to us.

Some of our service providers (e.g. cloud hosting, document storage, and push-notification services) may store or process data outside Nigeria. Where data leaves Nigeria, we take steps required under the NDPA to ensure an adequate level of protection, including contractual safeguards with the receiving party.

We take the security of your data seriously:

• Data in transit is encrypted using HTTPS/TLS;
• Passwords, transaction PINs, and session tokens are stored hashed, never in plain text;
• Authentication tokens on your device are held in the platform secure enclave (iOS Keychain / Android Keystore);
• Access to verification documents is restricted to personnel who need it for verification and compliance.

No system is completely secure. If we become aware of a breach affecting your personal data, we will notify you and the Nigeria Data Protection Commission as required by law.

We keep personal data only as long as needed for the purposes above:

• Account, profile, and order data: for the life of your account and for a limited period after closure to resolve disputes and meet legal obligations;
• KYC and financial-transaction records: retained after account closure for the period required by applicable Nigerian financial and anti-money-laundering regulations;
• Guarantor data: for the life of your account and any period during which a claim involving you remains open;
• Documents that fail verification: deleted or anonymised within a reasonable period after rejection, unless retention is required for fraud prevention.

When retention is no longer required, data is deleted or irreversibly anonymised.

Under the NDPA you have the right to:

• Access the personal data we hold about you and receive a copy;
• Correct inaccurate or incomplete data (much of your profile can be edited in-app);
• Delete your account and data — available in-app under Profile → Manage Account → Delete my account, subject to legally required retention (Section 7);
• Withdraw consent for camera, photo, or notification access at any time in your device settings;
• Object to or restrict certain processing, and request data portability;
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data has been mishandled.

To exercise any right, contact us using the details in Section 11. We respond within the timelines required by law and may need to verify your identity first.

The App is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that a minor has registered, we will delete the account and associated data.

We may update this Policy from time to time. Material changes will be notified through the App or by other reasonable means, and the “Last updated” date above will be revised. Continued use of the App after changes take effect constitutes acknowledgement of the updated Policy.

For privacy questions, data-subject requests, or complaints:

• Email: support@trustbasket.co
• In-app: Profile → Support