1. Who we are
Drivio is operated by Drivio Limited (“Drivio”, “we”, “us”), a company incorporated in the Federal Republic of Nigeria. For the purposes of the Nigeria Data Protection Act, 2023 (the “NDPA”) and the Nigeria Data Protection Regulation, Drivio is the data controller of the personal data described in this policy.
This policy applies to everyone who uses Drivio: people who request rides (“Riders”), people who offer rides (“Drivers”), and visitors to our website. It covers the Drivio rider app, the Drivio Driver app, our website and related services (together, the “Platform”). It should be read together with our Terms of Service.
Drivio is a marketplace. Drivers set their own prices, Riders choose the offer they prefer, and fares are paid in cash directly to the Driver. Drivio does not hold, move or store money for anyone. The only payments we process are Drivers’ subscription fees for using the Platform.
2. Information we collect
Information you give us
- Account details: full name, phone number, email address, password, and (for Drivers) referral codes. Riders may also choose a username so friends can book rides for them.
- Identity and verification data (Drivers): Bank Verification Number (BVN), National Identification Number (NIN), a selfie with a live face check, your driver’s licence, and vehicle details such as make, model, colour, year, plate number, vehicle photos and registration documents. We do not collect insurance documents.
- Face verification (Riders): before your first ride request we ask you to take a selfie with a live face check. This confirms you are a real person and becomes your profile photo, which Drivers see alongside your first name and rating. See section 7.
- Trip details: pickup and drop-off locations, the offers Drivers make and the offer you accept, trip status, trip preferences (for example, requested vehicle amenities), and details of any ride you book on behalf of another Drivio user.
- Communications and content: in-app messages, in-app voice calls (we record that a call happened, its duration and who was on it, not the content), ratings, reviews, feedback, support requests, and safety or SOS reports.
- Payment information (Drivers only): Driver subscription payments are processed by Paystack. Paystack handles your card or bank details directly; we receive only a payment reference, the amount, and whether the payment succeeded. We never see or store your full card number. Riders pay Drivers in cash, so we hold no Rider payment details at all.
Information we collect automatically
- Location data: see section 6.
- Device and technical data: device model, operating system, app version, language, push-notification tokens, approximate IP-based location, and crash and performance reports when the app has a problem.
- Usage data: how you interact with the Platform, including trips requested, offers made and accepted, time online (Drivers), and feature usage. We use a pseudonymous identifier for product analytics; your name, phone number and email are not sent to our analytics provider.
Information from third parties
We receive identity-verification results from our verification provider (whether your NIN or licence matched, not the underlying government record), payment confirmations from Paystack, and information from the other party to a trip (for example, a Rider’s rating of a Driver, or a friend booking a ride on your behalf).
3. How we collect it
We collect personal data (a) directly from you when you register, set up your profile, complete verification or use the Platform; (b) automatically through your device and your use of the apps; and (c) from third parties such as verification and payment partners and other users, as described above.
4. Our lawful bases
Under the NDPA, we process personal data where:
- Performance of a contract: to provide the Platform, connect Riders and Drivers, and process Driver subscriptions;
- Consent: for example, to use your face for verification, to access precise location, or to send you certain marketing; you may withdraw consent at any time;
- Legal obligation: for identity verification, anti-fraud, tax and regulatory requirements;
- Legitimate interests: to keep the marketplace safe and trustworthy, prevent abuse, tell existing users about Drivio features and offers, and improve our services, where not overridden by your rights;
- Vital interests / public interest: to protect the safety of users in an emergency.
5. How we use your information
- create and manage your account and verify your identity;
- show Drivers nearby ride requests, show Riders the offers they receive, and enable trips and communication between them;
- process Driver subscription payments;
- provide safety features, investigate incidents and respond to SOS reports;
- calculate ratings, detect and prevent fraud, abuse and unsafe behaviour;
- provide customer support and send service messages (for example, trip, verification and subscription updates);
- keep the apps working reliably, including diagnosing crashes;
- improve and develop the Platform; and
- comply with legal obligations and enforce our Terms of Service.
6. Location information
Location is central to a ride-hailing service, so we want to be clear about it:
- Drivers: when you are online and available, we collect your precise location, including in the background, so we can show you nearby requests and share your live position with a Rider during a trip. When you go offline, we stop collecting your live location. Your device will show a persistent notification while this is happening.
- Riders: we collect your location to set your pickup, show your request to nearby Drivers, and follow the trip to your drop-off. During an active trip your location is visible to your assigned Driver.
- Trip sharing: if you share a trip link, the people you share it with can see the live trip until it ends.
You can control location permissions in your device settings, but turning them off will prevent core features from working.
7. Face verification and photos
Both Riders and Drivers complete a short live face check in the app. Facial images are sensitive personal data under the NDPA, so we want to be specific about how we use them:
- Why: to confirm you are a real, present person and (for Drivers) that the face matches your identity documents. This protects both sides of every trip.
- What we keep: the photo captured during the check. It becomes your profile photo, which the other party to a trip sees. We do not build a searchable face database or use your face for advertising.
- Basis: your consent, which you give when you take the check. You can withdraw it by deleting your account (section 15). Because verification is essential to keeping the marketplace safe, we cannot offer the Platform without it.
- Retention: kept while your account is active and removed when your account is deleted, unless we must keep it for a legal or safety investigation.
8. Automated decisions
Some parts of the Platform run automatically. In plain terms:
- Showing requests and offers: which Drivers see a ride request depends on their being online and near the pickup. Which offer wins is always the Rider’s choice, not ours.
- Verification: NIN, licence and face checks are performed automatically first. If a check fails, a member of our team reviews it before any decision is made about your account, and you can resubmit.
- Safety and fraud signals: we look for patterns such as repeated cancellations, unusual routes or trip durations, and abusive messages. These flag an account for review; a person reviews before any suspension.
- Ratings: your average rating is calculated automatically from ratings the other party gives after trips.
We do not make decisions with legal or similarly significant effects on you based solely on automated processing. If you believe an automated step has affected you unfairly, you can ask for a human review at contact@drivedrivio.com.
9. Calls, messages and marketing
Between Riders and Drivers
You can call and message the other party to a trip inside the app. Calls are placed through the app, so your phone number is not shown to the other party. We keep records of in-app messages and of when calls happened (not call audio) for safety, dispute resolution and fraud prevention.
Service messages
We send messages you need to use Drivio, such as verification codes, trip updates, incoming-request alerts, subscription reminders and security notices, by push notification, SMS or email. You cannot opt out of these while you hold an account.
Marketing
As an existing user, we may tell you about Drivio features, offers and promotions by push notification, SMS or email, relying on our legitimate interest in keeping you informed about the service you use. Where the law requires it, or for anything from a partner, we will ask for your consent first. You can opt out at any time from your app settings, by using the unsubscribe link in an email, or by replying STOP to an SMS. Opting out never affects service messages.
11. International transfers
Some of the providers listed in section 10 store or process data outside Nigeria, including in the United States and the European Union. Where we transfer personal data abroad, we do so in accordance with the NDPA: only to jurisdictions or recipients that provide an adequate level of protection, or under appropriate safeguards (such as contractual protections), or on another lawful basis recognised by the Nigeria Data Protection Commission.
12. How long we keep it
We keep personal data only as long as necessary for the purposes described here. In practice that means:
- Account, profile and verification data: for as long as your account is active, then deleted or anonymised when you close it (see section 15);
- Trip and location history: for as long as needed to provide the service, handle disputes and keep the marketplace safe, after which it is deleted or anonymised;
- Subscription payment records: for the period required by Nigerian tax and company law;
- Safety reports, disputes and fraud investigations: until the matter is resolved and any legal time limit has passed;
- Support conversations: for as long as needed to resolve your issue and improve our support.
When data is no longer needed, we delete it or irreversibly anonymise it so it can no longer identify you.
13. How we protect it
We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls and row-level security on our database, and restricted staff access, to protect personal data against loss, misuse and unauthorised access. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data and to notify you and the regulator of a breach where the law requires.
14. Your data-protection rights
Subject to the NDPA, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data (most profile details can be edited in the app);
- Erase your data where there is no overriding legal basis to keep it;
- Restrict or object to certain processing, including direct marketing;
- Port your data to another provider where applicable;
- Not be subject to a decision based solely on automated processing that significantly affects you, and to ask for human review;
- Withdraw consent at any time, without affecting processing already carried out; and
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC).
To exercise any of these, contact us at contact@drivedrivio.com. We will respond within the timeframe required by law and in any case within 30 days. We may need to verify your identity first.
15. Deleting your account
You can ask us to delete your Drivio account at any time using the account deletion form. Here is exactly what happens:
- We verify that the request is genuinely from you.
- We delete your login credentials so the account can no longer be used, and remove or anonymise your profile: name, phone number, email, photos, and (for Drivers) identity and vehicle documents.
- Trip records and Driver subscription payment records are kept in anonymised form, no longer linked to you, because we are legally required to keep transaction records and because the other party to each trip has a right to their own history.
- We send you an email confirming that deletion is complete.
We may need to pause a deletion if you have a trip in progress or an open dispute or safety investigation, and we will tell you if so.
16. Children
The Platform is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
18. Changes to this policy
We may update this policy from time to time. If we make material changes, we will give reasonable notice (for example, in the app or by email) before they take effect, and we will always update the date at the top of this page. Please review it periodically.
19. Contact us and complaints
For any privacy question or request, or to reach our Data Protection Officer:
Drivio Limited
Data Protection Officer: contact@drivedrivio.com
You also have the right to complain to the Nigeria Data Protection Commission at ndpc.gov.ng if you believe your data has been mishandled.