Privacy Policy — Vexa Logistics

Vexa Logistics Ltd — Privacy Policy Version 1.0 1. Who we are Vexa Logistics Ltd ("Vexa", "we", "us") is a Nigerian logistics company that moves parcels and freight between and within Nigerian cities. We are the data controller for the personal data described in this policy. You can reach us at hello@vexalogistics.com or Bayse-One Checkmate Plaza, Ring Road, Ibadan. This policy explains what we collect, why we collect it, how long we keep it, who we share it with, and the rights you have under the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation (NDPR). 2. What we collect Customers and corporate clients - Account details: name, email address, phone number, company name and password (stored only as a secure hash by our authentication provider). - Booking details: pickup and delivery addresses with map coordinates, recipient name and phone number, package description, weight, dimensions, declared value and package photographs. - Payment details: transaction references, amounts, payment channel and wallet balances. We never see or store your full card number — card data is handled entirely by our payment processor. - Support and dispute records: messages, dispute categories and notes you send us. - Technical data: IP address at the time you accept our legal documents, device and browser information, and app usage logs. Drivers and riders - Identity and KYC data: full legal name, date of birth, residential address, phone number, National Identification Number (NIN), Bank Verification Number (BVN) and driver's licence number and expiry. - Work data: assigned vehicle, employment type, job history, acceptance rate, earnings and payout records. - Location data: approximate live location while you are online or on a job, used for dispatch and tracking. We do not track drivers who are offline. Recipients - If someone books a delivery to you, we hold your name and phone number, and the delivery address, so we can complete that delivery. Public tracking links show only status, area-level locations and a courier's first name. 3. Why we use it and our lawful basis - To perform the delivery contract you entered into with us: booking, pricing, dispatch, tracking, proof of delivery and support. - To meet legal and regulatory obligations: verifying driver identity (NIN/BVN) for anti-fraud and know-your-customer purposes, tax records, and responding to lawful requests from authorities. - For our legitimate interests: preventing fraud and theft, investigating disputes and damage claims, improving routing and service quality, and securing our platform. - With your consent: optional marketing messages and push notifications, which you can withdraw at any time. We do not sell your personal data, and we do not use automated decision-making that produces legal effects about you. 4. Who we share it with - Drivers and hub staff: the delivery details needed to collect and deliver your parcel. - Payment processor (Paystack): transaction data required to take and reconcile payments and refunds. - Wallet and settlement provider (Embedly): the identity and account details required to create and fund driver and corporate wallets. - Cloud hosting, database, email and push notification providers acting on our written instructions as data processors. - Law enforcement, regulators or insurers where we are legally required to disclose, or where disclosure is necessary to establish or defend a legal claim. Some of these providers process data outside Nigeria. Where that happens we rely on contractual safeguards requiring a standard of protection comparable to Nigerian law. 5. How long we keep it - Account and profile data: for as long as your account is active, then up to 24 months after closure. - Booking, delivery and tracking records: 6 years, to support tax, accounting and claims obligations. - Payment, wallet and payout records: 6 years, as required by financial record-keeping rules. - Driver KYC data including NIN and BVN: for the duration of the engagement plus 6 years, after which it is deleted or irreversibly anonymised. - Package photographs and proof-of-delivery data: 12 months, unless attached to an open dispute or claim. - Audit logs: retained for the life of the platform because they are deliberately immutable. 6. How we protect it Access to personal data is restricted by role. Sensitive identifiers such as NIN and BVN are visible only to the driver themselves and to authorised administrators. All access to production data is logged in an append-only audit trail. Data is encrypted in transit and at rest by our infrastructure providers. 7. Your rights Under the NDPR and the Nigeria Data Protection Act you may: - ask for a copy of the personal data we hold about you; - ask us to correct data that is inaccurate or incomplete; - ask us to delete data we no longer have a lawful reason to keep; - object to, or ask us to restrict, processing based on our legitimate interests; - withdraw consent for marketing or notifications at any time; - ask for your data in a portable, machine-readable format; - lodge a complaint with the Nigeria Data Protection Commission (NDPC). To exercise any of these rights, email hello@vexalogistics.com. We will respond within 30 days. We may ask you to verify your identity first, and we may keep data where the law requires us to. 8. Cookies and similar technologies We use only the storage strictly necessary to keep you signed in, remember your preferences and keep the app working offline as a progressive web app. We do not use third-party advertising trackers. 9. Children Our services are not directed at anyone under 18, and we do not knowingly collect data from children. 10. Changes to this policy If we make a material change we will publish a new version here and, where it affects you, ask you to review and accept it the next time you sign in. The version and effective date at the top of this document always tell you which policy applies.

Vexa Logistics Privacy Policy