Privacy Policy

1. Introduction

Ride Along ("Ride Along," "we," "us," or "our") is operated by Steadyway Global Ventures Ltd[cite: 2]. We provide a commuter ride-sharing marketplace ("Platform") that connects Passengers with Ride Partners who are already travelling and are willing to share available seats in their vehicle.

This Privacy Policy explains how we collect, use, share, and protect personal data when you use the Ride Along mobile application and related services (collectively, the "Service"). It is intended to comply with the principles of the Nigeria Data Protection Act, 2023 ("NDPA") and related regulations.

By using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Scope

This Privacy Policy applies to:

• Passengers who use the Service to search for and book seats on journeys;
• Ride Partners who publish journeys and make seats available; and
• Visitors to our websites and users of our customer support channels.

It does not apply to third-party websites, applications, or services that we do not control, even if accessed through the Service.

3. Data Controller

The data controller responsible for your personal data is:

If we appoint a Data Protection Officer, their contact details will be made available at the address above.

4. Information We Collect

We collect the categories of information described below. Not every user will have all categories of data collected, as this depends on how you use the Service (e.g., as a Passenger or Ride Partner).

5. How We Collect Information

We collect information:

• Directly from you, when you register an account, complete your profile, publish or book a journey, submit identity verification documents, make or receive a payment, or contact support.
• Automatically, through your use of the app (e.g., device information, log data, location data where you have granted permission).
• From third parties, such as our payment provider(s) (e.g., confirmation of payment status) and Google Maps/Google Places (e.g., location and route data you search for or select).

6. How We Use Personal Data

We use personal data to:

• Create and manage your account;
• Enable Passengers to search for, book, and pay for available seats;
• Enable Ride Partners to publish journeys and receive bookings;
• Calculate booking prices on our servers;
• Facilitate identity verification for Ride Partners;
• Process payments, refunds, and wallet-related records;
• Send transactional and service-related communications;
• Provide customer support;
• Detect, investigate, and prevent fraud, abuse, and platform manipulation;
• Maintain the safety, security, and integrity of the Service;
• Comply with legal and regulatory obligations;
• Improve and maintain the Service, including through diagnostics, crash reporting, and troubleshooting.

We do not use identity verification data or NIN information for any purpose beyond verifying Ride Partner identity and complying with applicable legal obligations, unless you are separately informed and, where required, your consent is obtained.

7. Legal Bases for Processing

Under the NDPA, we process personal data on one or more of the following legal bases, as applicable:

• Performance of a contract — to provide the Service you have requested (e.g., account creation, bookings, payments);
• Consent — for specific processing activities where consent is the appropriate basis (e.g., certain identity verification steps, marketing communications);
• Legal obligation — where we are required to collect, retain, or disclose information to comply with applicable Nigerian law;
• Legitimate interests — for purposes such as fraud prevention, platform safety, and service improvement, balanced against your rights and interests.

Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

8. Location Data

We collect location data to enable core features of the Service, including matching Passengers with Ride Partners, displaying pickup/drop-off points, calculating routes, and enabling navigation.

Location functionality is powered in part by Google Maps/Google Places services. When you use location-related features, certain information (such as searched addresses or selected routes) may be processed by Google in accordance with Google's own privacy policy.

You can control location permissions through your device settings. Disabling location access may limit or prevent certain features of the Service from functioning.

9. Identity Verification and NIN

Ride Partners may be required to complete identity verification before publishing journeys or receiving bookings. This may involve submitting:

• Government-issued identification information;
• NIN information;
• A selfie or photograph for comparison purposes;
• Supporting identity documents.

Important: Our current verification process does not include automated liveness detection or anti-spoofing technology. Verification is carried out through the review procedures we have in place at the relevant time, which may include manual review.

Identity documents and verification data are stored securely and are accessible only through authorized internal administrative processes. We do not share identity verification data with other users of the Service. We may share such data with regulators, law enforcement, or service providers assisting with verification, where legally required or necessary to operate the Service.

10. Payment Information

Steadyway Global Ventures Ltd[cite: 2] uses third-party payment provider(s) to process payments made through the Service. When you make a payment:

• We and/or our payment provider(s) process information such as the booking amount, applicable fees, payment status, and transaction references.
• We do not store raw card numbers, CVV codes, PINs, or other sensitive card credentials. Such information, where applicable, is handled directly by our payment provider(s) in accordance with their own security and compliance standards.
• Payment confirmation is determined through our payment infrastructure and is not based solely on information a user reports within the app.

We recommend reviewing the privacy policy of the applicable payment provider for details of how they process your payment card information.

11. Wallet and Earnings Information

Ride Partners may accumulate earnings through the Platform in an in-app wallet. The wallet is currently earn-only: there is no self-service withdrawal feature within the app at this time.

We may make administrative adjustments to wallet balances where necessary, including for support-related corrections or to facilitate off-platform payouts. We maintain records of wallet transactions and adjustments for accounting, dispute-resolution, and fraud-prevention purposes.

The Ride Along wallet is not a bank account or deposit account, and funds reflected in the wallet are not held in a separate regulated deposit-taking institution on your behalf by virtue of this feature alone.

12. Ride and Booking Information

We collect and retain information relating to journeys published, bookings made, and rides completed or cancelled, including timestamps, routes, participants, fares, and status. This information is used to operate the Service, resolve disputes, respond to safety concerns, and comply with legal obligations.

13. Communications and Notifications

We may send you:

• Push notifications;
• SMS messages;
• Emails;
• Transactional communications (e.g., booking confirmations, ride reminders);
• Verification notifications;
• Security alerts;
• Service announcements.

Transactional and security-related communications are necessary for the operation of the Service and cannot be opted out of while you maintain an account. See Section 24 for marketing communications.

14. Device and Technical Information

We collect technical information reasonably necessary to operate, secure, analyze, and support the Service, including device information, operating system, app version, IP address, authentication/session data, crash and error logs, push notification tokens, and general log data.

15. Cookies and Similar Technologies

Our website(s), if applicable, may use cookies or similar technologies for functionality, analytics, and security purposes. Where used, we will provide appropriate notice and, where required, obtain your consent through a cookie banner or similar mechanism.

16. How We Share Information

We may share personal data with:

• Other users, to the extent necessary to facilitate a booking (e.g., a Ride Partner may see a Passenger's name and pickup location; a Passenger may see a Ride Partner's name, journey details, and, where applicable, vehicle information). We do not share identity verification documents or NIN information with other users.
• Service providers, who process data on our behalf and under our instructions (see Section 17).
• Regulators and law enforcement, where required by applicable law, legal process, or to protect the rights, property, or safety of Steadyway Global Ventures Ltd[cite: 2], our users, or the public.
• Professional advisors, such as legal or accounting advisors, where necessary.
• In connection with a corporate transaction, such as a merger, acquisition, or sale of assets, subject to appropriate safeguards.

We do not sell personal data to third parties.

17. Third-Party Service Providers

We work with third-party service providers to operate the Service, which may include:

• Google Maps/Google Places (mapping, location search, and route functionality);
• Payment provider(s) (payment processing);
• Cloud storage/hosting providers (data storage and infrastructure);
• Authentication and security infrastructure providers;
• Email and SMS providers (delivering communications);
• Push notification infrastructure providers;
• Analytics and crash-reporting providers, where used.

These providers are only permitted to process personal data as necessary to provide their services to us and are subject to appropriate contractual protections.

18. Google Maps/Google Places

Ride Along uses Google Maps/Google Places APIs to provide location search, mapping, and route-related functionality. Your use of these features is also subject to Google's applicable terms and privacy policy. We encourage you to review Google's privacy policy to understand how Google processes data in connection with these services.

19. Data Retention

We retain personal data for as long as necessary to:

• Provide the Service to you;
• Comply with applicable legal, regulatory, accounting, or tax obligations;
• Resolve disputes;
• Prevent fraud and abuse;
• Enforce our agreements.

Retention periods vary depending on the type of data and the purpose of processing. Where you request deletion of your account, certain information may need to be retained in accordance with this Section, as further explained in Section 23.

[Business decision required: specific retention periods per data category should be confirmed and documented internally.]

20. Data Security

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These measures include, among others, access controls for sensitive information such as identity verification documents, encrypted storage of authentication credentials, and secure infrastructure practices.

No method of transmission or storage over the internet is completely secure. While we work to protect your information, we cannot guarantee its absolute security, and no service can promise it is "100% secure" or "impossible to hack."

21. Your Rights Under the NDPA

Subject to applicable law and any relevant exceptions, you may have the right to:

• Be informed about how your personal data is processed;
• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your personal data, subject to Section 23;
• Object to or restrict certain processing;
• Withdraw consent where processing is based on consent;
• Request portability of certain data, where applicable;
• Lodge a complaint with the relevant supervisory authority.

To exercise these rights, contact us at [PRIVACY EMAIL]. We may need to verify your identity before actioning a request.

22. Access, Correction and Deletion Requests

You may request access to, correction of, or deletion of your personal data by contacting [PRIVACY EMAIL] or through in-app support channels, where available. We will respond within a reasonable timeframe in accordance with applicable law. We may decline or limit certain requests where permitted or required by law, such as where retention is necessary for legal, regulatory, fraud-prevention, or dispute-resolution purposes.

23. Account Deletion

You may request deletion of your account at any time by contacting [SUPPORT EMAIL] or [PRIVACY EMAIL], or visiting our Account Deletion page.

When you request deletion:

• We will deactivate your account and, where feasible, remove or anonymize personal data that we are not otherwise required to retain.
• Certain information may need to be retained for legal, regulatory, fraud-prevention, dispute-resolution, accounting, or security purposes, even after account deletion.
• Deletion of your account does not mean immediate, permanent destruction of every record associated with you, where lawful retention obligations apply.

We will inform you, where appropriate, of the categories of data retained and the general reason for retention.

24. Marketing Communications

Where we send you marketing or promotional communications, we will do so in accordance with applicable law, including obtaining consent where required. You may opt out of marketing communications at any time via the unsubscribe mechanism provided or by contacting [SUPPORT EMAIL]. Opting out of marketing communications does not affect transactional or security-related communications necessary for operating the Service.

25. International Data Transfers

Some of our service providers (for example, cloud hosting or infrastructure providers) may process or store data outside Nigeria. Where personal data is transferred outside Nigeria, we will seek to ensure appropriate safeguards are in place consistent with the requirements of the NDPA.

[Business decision required: confirm whether, and to which countries, cross-border data transfers actually occur, so this section can be finalized with specifics.]

26. Children's Privacy

The Service is not intended for use by individuals under the age of [MINIMUM AGE — see Section 3 of Terms of Use]. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete such data.

27. Data Breach / Security Incident Handling

In the event of a personal data breach that poses a risk to your rights and freedoms, we will take reasonable steps to investigate, contain, and remediate the incident, and will notify affected users and/or the relevant regulatory authority as required under applicable law.

28. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will post the updated version with a revised Effective Date, and, where changes are material, we will provide additional notice (e.g., in-app notification or email) where reasonably practicable.

29. Contact Information

If you have questions or requests regarding this Privacy Policy or your personal data, contact us at:

30. Complaints and Regulatory Rights

If you believe your personal data has been processed in violation of applicable law, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or any successor regulatory authority, in addition to any other remedies available to you.