Privacy Policy & Data Protection Charter
Gazie Commute Technologies Ltd. • Effective Date: August 28, 2026 • Version 2.1
1Data Controller & Scope
This Privacy Policy describes how Gazie Commute Technologies Ltd.(“Gazie Commute”, “we”, “our”, or “us”) collects, stores, processes, discloses, and protects your personal data when you interact with our web platform, mobile applications, and matchmaking infrastructure.
Gazie Commute operates as a designated Data Controller in full compliance with the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR) overseen by the Nigeria Data Protection Commission (NDPC).
2Categories of Personal Data Collected
2.1 Identity & KYC Data
Full name, mobile telephone number, email address, password cryptographic hash, National Identification Number (NIN) document/slip, government ID card, and trusted emergency contact telephone numbers.
2.2 Driver & Vehicle Data
Driver’s Licence copy, vehicle make, model, color, vehicle registration plate number, routine commute corridors, departure time windows, seat fare rates, and driver ratings.
2.3 Trip & Transaction Data
Pickup and drop-off hubs, booking timestamps, ride match statuses, Paystack transaction reference tokens, community ratings & reviews, and safety incident logs.
3Lawful Bases for Processing
Pursuant to Section 25 of the NDPA 2023, we only process personal data when an authorized legal basis applies:
- Contractual Necessity: To authenticate accounts, perform ride matchmaking, facilitate communications between matched commuters, and administer digital transit passes.
- Legal & Regulatory Obligation: To maintain verifiable driver/commuter safety records and cooperate with statutory regulatory or law enforcement inquiries.
- Consent: For opt-in commute alerts, WhatsApp notifications, and promotional updates (which can be withdrawn at any time).
- Legitimate Interests: To prevent fraud, protect commuter physical security, optimize route density, and defend against legal liability.
4Data Sharing & Third-Party Sub-Processors
- Between Matched Commuters: Once a match is confirmed and unlocked, your full name, verification badge, vehicle particulars, and direct telephone contact are shared strictly between the matched driver and passenger to coordinate daily transit.
- Authorized Cloud & Payment Infrastructure:
- Supabase Inc.: SOC2-compliant managed PostgreSQL database, authentication engine, and encrypted document storage.
- Paystack Payments Ltd.: CBN-licensed, PCI-DSS Level 1 certified payment gateway for platform fee settlements. We never view or store raw credit/debit card numbers.
- Vercel Inc.: High-availability edge compute and CDN deployment network with DDoS mitigation.
- Zero Commercial Sale Guarantee: We do not sell, monetize, rent, or lease personal commuter data to third-party advertisers or data brokers under any circumstances.
5. International & Cross-Border Data Transfers
In accordance with Sections 41, 42, and 43 of the NDPA 2023 (Cross-Border Transfer of Personal Data), Gazie Commute utilizes world-class international cloud infrastructure (Supabase AWS instances and Vercel Global Edge Network) located in high-security jurisdictions ensuring adequate data protection standards.
Adequacy Safeguards Employed:
- Data Processing Agreements (DPAs): Comprehensive DPAs incorporating Standard Contractual Clauses (SCCs) guaranteeing data protection levels equivalent to the NDPA.
- End-to-End Encryption: All data transferred internationally is encrypted in transit using TLS 1.3 and encrypted at rest using AES-256.
- Data Minimization: Data routed through international edge CDNs is limited strictly to encrypted session tokens and encrypted application payloads.
6Technical & Organizational Security Measures
We implement comprehensive enterprise-grade safeguards designed to prevent unauthorized access, alteration, disclosure, or destruction of personal data:
AES-256 bit encryption at rest for all database tables and uploaded KYC documents; TLS 1.3 encryption for all network transmissions.
Strict PostgreSQL database policies ensuring users can only read and modify their own records, preventing cross-tenant data leakage.
All user credentials are protected with one-way salted Argon2/Bcrypt password hashing algorithms; passwords are never stored in plaintext.
KYC verification files (NIN, licences) are stored in dedicated cloud buckets with ephemeral presigned access tokens and restricted admin privileges.
7. Data Retention & Erasure Schedule
Personal data is retained only for the duration necessary to fulfill the purposes outlined in this Policy, adhering to the following statutory retention schedules:
| Data Category | Retention Period | Statutory Rationale |
|---|---|---|
| Account Profile & Contact Info | Duration of active account + 12 months after closure | Account management & post-closure inquiries |
| KYC Documents (NIN, Licences) | Duration of verified status; purged within 30 days of account deletion | Safety verification & fraud prevention |
| Trip Bookings & Match History | 5 Years | Commercial audit & transit dispute resolution |
| Platform Fee Payment Logs | 6 Years | CBN regulatory financial record-keeping standards |
| Safety Incident Reports | 7 Years | Legal defense, passenger safety & liability claims |
8. Complete Data Subject Rights (NDPA 2023)
Under Part V of the NDPA 2023, you are entitled to exercise the following statutory data rights free of charge:
You have the right to request a complete copy of all personal data held about you.
You can modify or update inaccurate, incomplete, or outdated profile information via your dashboard or by contacting us.
You may request permanent deletion of your profile, verification files, and unassociated data.
You can request restriction of processing while a dispute regarding data accuracy is being resolved.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON/CSV).
You can object to processing based on legitimate interests or withdraw consent for non-essential notifications at any time.
To exercise any of your data rights, submit a written request to our Data Protection Officer at gaziecommute@gmail.com. We will acknowledge and respond to requests within 30 days as required by law.
9. Personal Data Breach Management & Notification Procedure
In accordance with Section 40 of the NDPA 2023, Gazie Commute maintains a comprehensive Incident Response and Data Breach Protocol:
In the event of a confirmed personal data breach that is likely to result in a risk to the rights and freedoms of commuters, Gazie Commute will formally notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach.
Where a data breach poses a high risk to affected individuals, we will directly notify affected commuters without undue delay via registered email and platform banners, detailing the nature of the breach, compromised data categories, mitigation actions taken, and recommended precautions (e.g., password reset).
Immediate technical measures will be enacted to contain the incident, revoke compromised access tokens, patch vulnerabilities, and document comprehensive forensic audit trails for regulatory submission.
10. Regulatory Oversight & Complaint Escalation to NDPC
If you have concerns about how your personal data is handled, we encourage you to contact our Data Protection Officer first so we can promptly address your issue. However, you have the unfettered statutory right under the NDPA 2023 to escalate complaints directly to the national regulatory supervisory authority:
Headquarters Address: No. 5, Charles de Gaulle Close, Asokoro, Abuja, FCT, Nigeria.
Official Email: info@ndpc.gov.ng / complaints@ndpc.gov.ng
Official Portal: https://ndpc.gov.ng
11. Contact Our Data Protection Officer (DPO) & Policy Updates
We may update this Privacy Policy periodically to reflect technological improvements, product feature additions, or legislative changes. When material changes occur, we will notify registered commuters via email and dashboard notification prior to the change taking effect.
Gazie Commute Technologies Ltd.
CAC Registration / RC Number: RC: 7924018
Registered Business Address: Federal Capital Territory (FCT), Abuja, Nigeria
Official Corporate Email: gaziecommute@gmail.com
Support WhatsApp: +234 816 473 7221
For platform commute rules, liability exclusions, and driver/passenger conduct standards, please review our Terms of Service.