Privacy Policy
This policy explains how ArewaNext Innovations Limited ("we", "us") handles personal data in TripDesk, our transport management platform. We follow the Nigeria Data Protection Act 2023 (the "NDPA") and the directions of the Nigeria Data Protection Commission (the "NDPC").
Who is responsible for your data
Two different roles apply, depending on whose data it is.
- Transport operators' passenger and trip data. Each transport company using TripDesk decides why and how its passengers' data is used. The company is the data controller. We act as its data processor and handle that data only on the company's instructions.
- Account and website data. For the staff accounts, sign-in records and website visits described below, we are the data controller.
If you are a passenger and want to use your rights over ticket or booking data, contact the transport company you travelled with first. We will help the company respond.
What we collect
Staff and administrator accounts
- Name, email address, phone number, role, company and branch.
- Sign-in details: a securely hashed password, last login time, and session tokens.
Passenger and trip data (entered by the transport operator)
- Passenger name, phone number and email address where provided.
- Booking details: trip, route, seat, fare in naira (₦), ticket number and QR code, boarding status.
- Driver and vehicle records: licence details and expiry dates, maintenance logs, expenses.
Technical data
- IP address, browser or device type, and server logs needed to run and protect the service.
- Delivery status of SMS and email notifications we send for an operator.
We do not knowingly collect sensitive personal data, and operators should not enter it into free-text fields.
How we use it
- To provide the service: scheduling trips, issuing and scanning tickets, printing tickets, and producing reports.
- To send notifications on behalf of operators, such as booking confirmations and departure reminders.
- To secure accounts, prevent fraud and misuse, and investigate incidents.
- To support customers, fix faults and improve the product.
- To meet legal obligations.
We do not sell personal data and we do not use passenger data for advertising.
Lawful bases
We rely on the bases the NDPA allows: performing a contract (providing the service to the operator and, through the operator, to the passenger), our legitimate interests in securing and improving the service, compliance with legal obligations, and consent where we ask for it. Where we send marketing about our own products, you can opt out at any time.
Who we share it with
We share personal data only as needed to run the service.
| Recipient | Why |
|---|---|
| Termii (SMS provider) | Delivers text messages such as booking confirmations. Receives the recipient's phone number and message text. |
| Email delivery provider (SMTP) | Delivers email notifications. Receives the recipient's email address and message content. |
| Hosting and database provider | Stores and processes the data on our behalf. [confirm provider name and location] |
| The transport operator | Operators can see passenger data for their own company and branches. |
| Regulators, courts and law enforcement | Only where the law requires it, or to protect rights and safety. |
Our providers are bound by written terms that require them to protect the data and use it only for our instructions.
Transfers outside Nigeria
Some providers may process data outside Nigeria. Where that happens, we make sure the destination has adequate protection under the NDPA, or we use another lawful transfer safeguard such as contractual clauses. [confirm hosting region]
How long we keep it
- Operator data is kept while the operator's account is active, then for [30] days after closure so the operator can export it, then deleted or anonymised.
- Refresh tokens expire after 7 days or when you sign out.
- Records we must keep for tax, accounting or legal reasons are kept for the period the law requires.
Your rights
Under the NDPA you can ask to:
- Know whether we hold your data and get a copy.
- Correct data that is wrong or incomplete.
- Have your data deleted, where we have no lawful reason to keep it.
- Restrict or object to certain uses, including direct marketing.
- Receive your data in a portable format.
- Withdraw consent you gave, without affecting earlier use.
Email privacy@tripdesk.ng. We will reply within one month. We may need to confirm your identity first. If you are unhappy with our response, you can complain to the Nigeria Data Protection Commission.
Children
The service is for businesses and is not aimed at children. A parent or guardian may buy a ticket that names a child as a passenger. In that case the operator is responsible for having the guardian's authority to share the child's details.
Keeping data safe
We use technical and organisational measures to protect personal data. See our Security page. If a breach is likely to put people at risk, we will tell the affected operator without delay, and notify the NDPC within 72 hours where the NDPA requires it.
Changes to this policy
We will post updates here and change the effective date. For material changes we will also notify account administrators by email.
Contact us
ArewaNext Innovations Limited, [Registered office address], Nigeria
Data protection contact: privacy@tripdesk.ng