Privacy Policy

1. INTRODUCTION

Thumo Delivery Limited (trading as "Swoop") ("Thumo", "we", "us", or "our") is committed to protecting the privacy and personal data of all users of our Platform. This Privacy Policy explains how we collect, use, store, share, and protect your personal data in compliance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), and other applicable data protection laws.

2. DATA CONTROLLER

Thumo Delivery Limited is the data controller for personal data collected through the Platform. Our contact details are:

3. PERSONAL DATA WE COLLECT

3.1 Information You Provide

• Full name, email address, phone number, and delivery address
• Payment information (card details, bank account information)
• Profile photo (optional)
• Identity verification documents (for Riders and Merchants)
• Business registration details (for Merchants)

3.2 Information Collected Automatically

• Device information (device type, operating system, unique device identifiers)
• Location data (GPS coordinates when using the Platform)
• Usage data (pages visited, features used, order history)
• Log data (IP address, access times, app crashes)

3.3 Information from Third Parties

• Payment verification data from payment processors
• Background check results for Riders (where applicable)

4. LEGAL BASIS FOR PROCESSING

We process your personal data on the following legal bases under the NDPA:

• Consent: Where you have given clear consent for us to process your data for a specific purpose.
• Contract Performance: Where processing is necessary to fulfil our obligations under a contract with you (e.g., processing your order).
• Legitimate Interest: Where processing is necessary for our legitimate business interests, provided these do not override your rights.
• Legal Obligation: Where processing is required to comply with Nigerian law.

5. HOW WE USE YOUR DATA

• To create and manage your account on the Platform
• To process and fulfil orders, including delivery coordination
• To process payments and prevent fraud
• To communicate with you about your orders, account, and our services
• To improve and personalize your experience on the Platform
• To ensure safety and security of all Platform users
• To comply with legal and regulatory requirements
• To resolve disputes and enforce our agreements
• To send promotional communications (with your consent, which you may withdraw at any time)

6. DATA SHARING AND DISCLOSURE

We may share your personal data with:

• Merchants: Your name, delivery address, and order details to fulfil your order.
• Riders: Your name, phone number, and delivery address to complete delivery.
• Payment Processors: Payment data to process transactions securely.
• Service Providers: Third-party providers who assist us in operating the Platform.
• Law Enforcement: Where required by law, regulation, or valid legal process.

We do not sell your personal data to third parties.

7. DATA RETENTION

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Account data is retained for the duration of your account and for up to 6 years after account closure for legal and regulatory compliance. Transaction records are retained for a minimum of 6 years in accordance with Nigerian tax and commercial law.

8. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption of data in transit and at rest, access controls, regular security assessments, and employee training on data protection.

9. YOUR RIGHTS

Under the NDPA, you have the following rights:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete data.
• Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to Restrict Processing: You may request that we limit how we use your data.
• Right to Data Portability: You may request your data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at developer@swoop.team. We will respond within 30 days.

10. COOKIES AND TRACKING

We use cookies and similar technologies to enhance your experience, analyze usage patterns, and deliver relevant content. You can manage your cookie preferences through your browser settings. Essential cookies required for the Platform to function cannot be disabled.

11. INTERNATIONAL DATA TRANSFERS

Your personal data may be transferred to and processed in countries outside Nigeria where our service providers are located. We ensure that such transfers comply with the NDPA and that adequate safeguards are in place to protect your data.

12. CHILDREN'S PRIVACY

The Platform is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes through the Platform or by email. Your continued use of the Platform after such notification constitutes acceptance of the updated policy.

14. COMPLAINTS

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC). Contact details for the NDPC are available at https://ndpc.gov.ng.

15. CONTACT US

For any questions or requests regarding this Privacy Policy or your personal data, please contact: