Privacy & Data Protection Policy

Effective: April 1, 2026

This Policy describes how ExoShuttle Management Ltd collects, uses, stores, and protects your personal information when you use our website, platforms, vehicle ownership solutions, fleet management services, and related offerings. By using our Services, you consent to data processing as described here. ExoShuttle complies with the Nigeria Data Protection Act (NDPA).

1. Introduction

ExoShuttle Management Ltd is committed to compliance with the Nigeria Data Protection Act (NDPA) and all applicable data protection regulations. We process personal data lawfully, fairly, and transparently, ensuring that your rights are respected at every stage of data handling.

2. Data Collection Scope

This Policy applies to all Users located in Nigeria and in any other jurisdiction where ExoShuttle operates. We collect data from the following sources:

• Direct data — Information you provide directly when registering, filling out forms, or communicating with us.
• Automated data — Information collected automatically through cookies, analytics tools, and device interactions.
• Third-party sources — Information obtained from partners, service providers, or publicly available databases.

3. Information We Collect

We may collect the following categories of personal information:

• Identification information (full name, date of birth, government-issued ID)
• Contact details (email address, phone number)
• Address and location data
• Financial information (bank details, payment records)
• Location data (GPS, IP-based geolocation)
• Usage activity (pages visited, features used, interaction patterns)
• Transaction records (payment history, vehicle ownership details)
• Device information (browser type, operating system, device identifiers)

We may also obtain information about you from third-party sources, such as identity verification services and credit agencies, where permitted by law.

4. Use of Information

We use your personal information for the following purposes:

• Account management and authentication
• Identity verification and fraud prevention
• Facilitating vehicle ownership and hire purchase arrangements
• Fleet operations, driver onboarding, and performance monitoring
• Processing payments and financial transactions
• Ensuring the safety and security of Users and Vehicles
• Providing customer support and responding to inquiries
• Sending service-related communications and updates
• Compliance with legal and regulatory obligations

5. Cookies

We use cookies and similar tracking technologies to enhance functionality and gather analytics about how the Site is used. Cookies help us improve your experience by remembering preferences and understanding usage patterns. You can control or disable cookies through your browser settings; however, some features of the Site may not function properly without them.

6. Information Sharing

We may share your personal information with the following parties:

• Service providers — Third parties that assist in delivering our Services (e.g., payment processors, IT support).
• Business partners — Organisations we collaborate with to offer vehicle ownership and fleet solutions.
• Financial institutions — Banks and lenders involved in hire purchase and financing arrangements.
• Insurance providers — Companies providing coverage for Vehicles and operations.

We may also disclose your information when required to do so by law, regulation, or court order, or to protect the rights, property, or safety of ExoShuttle, its Users, or others. We do not sell your personal data to third parties.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Financial records may be retained for up to 7 years in accordance with regulatory requirements. After the retention period expires, data is securely deleted or anonymized.

8. Objections and Complaints

You have the right to object to the processing of your personal data in certain circumstances. If you have a complaint about how your data is handled, we encourage you to contact us first so we can resolve the matter. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

9. Grounds for Processing

We process your personal data based on one or more of the following legal grounds:

• Contract performance — Processing necessary to fulfil our contractual obligations to you.
• Legal obligations — Processing required to comply with applicable laws and regulations.
• Vital interests — Processing necessary to protect your life or the life of another person.
• Legitimate business interests — Processing necessary for our legitimate interests, provided they do not override your fundamental rights.
• Consent — Processing based on your explicit consent, which you may withdraw at any time.

10. Your Legal Rights

Under the NDPA and applicable data protection laws, you have the following rights:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete data.
• Deletion — Request erasure of your personal data where there is no compelling reason for continued processing.
• Objection — Object to processing based on legitimate interests or direct marketing.
• Restriction — Request restriction of processing in certain circumstances.
• Portability — Request transfer of your data to another service provider in a structured, machine-readable format.
• Withdraw consent — Withdraw previously given consent at any time without affecting the lawfulness of prior processing.

11. Information Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. All third parties who process data on our behalf are required to comply with equivalent security standards.

12. Consent

By using our Services, you consent to the collection and processing of your personal data as described in this Policy. You may withdraw your consent at any time by contacting us; however, withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

13. Choice and Transparency

We provide you with meaningful choices regarding how your data is used. You can manage your preferences through:

• Account settings — Update or delete your personal information.
• Device permissions — Control location access and notifications through your device settings.
• Communication preferences — Opt out of promotional emails and notifications.

14. Updates to Policy

We may amend this Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Material changes will be communicated through the Site or via email. Your continued use of the Services after any update constitutes your acceptance of the revised Policy.

15. Limitation of Liability

To the fullest extent permitted by law, ExoShuttle shall not be liable for any indirect, incidental, special, or consequential damages arising from or related to the processing of your personal data, including but not limited to loss of data, revenue, or business opportunities.

16. Third-Party Links

Our Site may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any external sites you visit.

Contact Us

If you have questions about this Policy or wish to exercise your data protection rights, please contact us:

ExoShuttle Management Ltd
Email: info@exoshuttle.ng
Phone: +234 902 182 8037