Privacy Policy

1 Information We Collect

We collect the following categories of personal information:

1.1 Information You Provide Directly

• Registration details: full name, phone number, email address, and profile photo.
• Identity verification (KYC): government-issued ID (NIN, driver's licence, passport), CAC documents (Vendors), date of birth, and home address.
• Payment information: bank account details, card information (processed securely by Flutterwave — Kugoo does not store raw card data).
• Communications: messages sent to support, chat messages between parties within the Platform.
• User-generated content: ratings, reviews, and feedback submitted on the Platform.

1.2 Information Collected Automatically

• Device information: device model, operating system, unique device identifiers, and mobile network information.
• Usage data: pages viewed, features used, time spent on the Platform, and interaction logs.
• Location data: GPS location data collected while the Platform is active. Riders: collected continuously while online; Customers: collected at order placement and during live tracking; Vendors: business location only.
• Log data: IP address, access times, and error reports.

1.3 Information from Third Parties

• Payment processors (Flutterwave): transaction confirmation and status.
• Identity verification services: results of NIN and BVN checks as required by Nigerian law.

2 How We Use Your Information

We use your personal information to:

• Create, verify, and manage your account on the Platform;
• Process and fulfil orders, including connecting Customers with Vendors and Riders;
• Process payments and manage your Kugoo Wallet;
• Provide real-time delivery tracking and in-app communication features;
• Conduct KYC verification as required by Nigerian law and platform policy;
• Send transactional notifications (order updates, payment receipts, delivery confirmations) via push notification and SMS;
• Send promotional communications (only with your consent, which you may withdraw at any time);
• Monitor and improve Platform performance, safety, and user experience;
• Detect, investigate, and prevent fraudulent transactions and other illegal activity;
• Comply with legal obligations under Nigerian law.

3 Legal Basis for Processing

We process your personal data on the following legal grounds under the NDPA 2023:

• Contract performance: processing necessary to fulfil your order, manage your account, and provide Platform services.
• Legal obligation: processing required to comply with NDPR, NDPA, FCCPC requirements, and anti-money laundering obligations.
• Legitimate interests: fraud prevention, Platform security, and improving our services.
• Consent: marketing communications and optional data sharing (which you may withdraw at any time in Settings).

4 How We Share Your Information

We do not sell your personal data. We share your information only as follows:

• Between platform parties: Customer contact details (first name, delivery address) are shared with the assigned Rider; Vendor name and order details are shared with the Customer and Rider.
• Service providers: payment processors (Flutterwave), cloud hosting providers, SMS gateway providers, and identity verification services — each bound by confidentiality obligations.
• Legal authorities: where required by Nigerian law, court order, or to protect the safety of any person.
• Business transfers: in the event of a merger, acquisition, or sale of Kugoo's assets, your data may be transferred to the successor entity, subject to the same protections.

We require all third parties to implement appropriate technical and organisational measures to protect your data.

5 Location Data

Location data is central to the Kugoo service. We collect it as follows:

• Customers: location is collected at the time of order placement to determine delivery address and fees. Live location may be used during active order tracking.
• Riders: continuous background location is collected while the Rider is set to "Online" on the Platform. This is required for job assignment and live tracking. Location collection pauses when the Rider goes offline.
• Vendors: only the fixed business address is stored; no real-time location is collected.

You may disable location permissions in your device settings, but this will significantly impair the functionality of the Platform.

6 Zaam AI Assistant

Kugoo's in-app assistant, Zaam AI, helps you get quick answers about orders, delivery, and using the Platform. When you chat with Zaam AI — by typing or by speaking to it — we collect and process:

• Your message text, to understand your question and generate a reply.
• A transcript of your voice, if you use the microphone instead of typing.
• Your approximate location at the time you send a message, so Zaam AI can give location-relevant answers (e.g. delivery time estimates, nearby vendors).

This data is processed by Zaam AI, Kugoo's assistant service, which may use third-party AI models to generate responses. We ask for your explicit consent the first time you open the Zaam AI chat, and you may decline — you can still use every other part of the Platform without it.

7 Data Retention

We retain your personal data for as long as your account is active or as necessary to provide our services. Specifically:

• Account data: retained for the duration of your account and for 5 years thereafter, as required for tax and regulatory purposes.
• Transaction records: retained for 7 years in accordance with Nigerian financial regulations.
• KYC documents: retained for 5 years after account closure, as required by anti-money laundering regulations.
• Chat and support communications: retained for 2 years.

Upon request, we will delete or anonymise your data subject to our legal retention obligations.

8 Your Rights

Under the Nigeria Data Protection Act 2023, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your data (subject to legal retention obligations).
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: withdraw consent for any processing based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@trykugoo.com. We will respond within 30 days.

9 Cookies & Tracking

The Kugoo mobile application uses local storage and analytics SDKs (such as crash reporting tools) to improve performance. These do not operate as traditional browser cookies. No advertising tracking pixels are embedded in the app without your explicit consent.

10 Children's Privacy

The Platform is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a user is under 18, we will promptly deactivate their account and delete associated data. If you believe a minor has registered, please contact us at support@trykugoo.com.

11 Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• TLS/HTTPS encryption for all data in transit;
• Encrypted storage for sensitive data at rest;
• Access controls limiting staff access to personal data on a need-to-know basis;
• Regular security audits and penetration testing.

No system is completely secure. You are responsible for keeping your account credentials confidential and should notify us immediately of any suspected breach.

12 International Data Transfers

Your data is stored and processed primarily in Nigeria. Where we engage service providers outside Nigeria, we ensure that appropriate safeguards are in place (such as standard contractual clauses) to protect your data in accordance with the NDPA 2023.

13 Third-Party Links

The Platform may contain links to third-party websites or services (including social media platforms). This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access.

14 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes via the Platform at least 7 days before they take effect. Your continued use of the Platform after notification constitutes acceptance of the updated Policy.

15 Contact & Complaints

For any privacy-related questions, requests, or complaints, please contact our Data Protection Officer:

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.