1. undefined
Under the NDPA, the data controller for the Service is ROND by Miles Limited (RC 9470479, TIN 2622400080163), a company registered in Nigeria. You can reach our data protection team at privacy@getrond.com.
If you are not satisfied with our response to a privacy question or complaint, you have the right to complain to the Nigeria Data Protection Commission (NDPC) at the contact details published on their official website.
2. undefined
Account information. Phone number, full name, email address, date of birth, residential address and — for drivers only — National Identification Number (NIN), bank account details, work experience, and guarantor information. Clients provide a business name, business type, and industry.
Verification documents. Driver's licence (front and back), international passport, proof of address, profile photograph, and other supporting documents that you upload as part of onboarding.
Booking and activity data. Bookings you create, accept, decline, or complete, plus ratings, feedback, and any messages or timestamps related to those bookings.
Subscription and payment data. Subscription status, transaction references, and payment method summaries returned by Payaza. We do not store your full card number or CVV.
Technical data. Device model, operating system version, app version, approximate IP-based location, crash logs, and in-app events that we use to diagnose problems and improve the Service.
Location. Only when you grant permission, and only for features that need it (e.g. showing drivers near a booking request). You can revoke the permission at any time in your device settings.
3. undefined
To verify your identity and maintain a trusted driver roster. For drivers, this includes verifying your NIN and identity documents, reviewing documents, contacting guarantors, and calculating a trust score. Verification is the foundation of what we offer — without the data listed above we cannot place a driver on the platform.
To connect drivers with clients. Clients browsing drivers see only the information necessary for their decision: first name, photograph, trust score, availability, general experience, and approximate location. They never see NIN, bank account, surname, phone number, or email.
To operate the Service. Hosting your content, delivering booking notifications, processing subscription payments, sending transactional messages (OTP codes, booking updates, receipts), and diagnosing problems.
To keep the Service secure. Detecting fraud, abuse, or account takeover, enforcing our Terms, and maintaining an append-only audit log of admin actions.
To comply with Nigerian legal and regulatory obligations. Anti-money-laundering checks, know-your-customer records, tax reporting, and responding to lawful requests from regulators or courts.
With your explicit consent, to send occasional product updates by email or push notification. You can opt out at any time from the Notifications screen in Settings.
4. undefined
We process most personal data under the "contract" basis in the NDPA — you need us to process it to receive the Service you signed up for. Identity verification (NIN, bank data) is processed under both "contract" and "legal obligation" because Nigerian law requires us to verify who we are doing business with.
Product improvement analytics and optional marketing messages are processed under "consent" — you can withdraw consent at any time without losing access to the core Service.
5. undefined
Your bank account details are collected only to verify your identity and enable driver payouts. We store them in encrypted form using database-level field encryption (Postgres pgsodium). We never display them to clients or other drivers, and we never store them in plaintext anywhere.
We do not collect your Bank Verification Number (BVN). If you withdraw consent for identity processing, we must also end your driver account, because we cannot keep a driver on the platform without a verified identity.
6. undefined
Clients. When you are a driver, clients who can see your profile receive only the public-facing fields described above. Sensitive identifiers are never shared.
ROND administrators. Authorised ROND staff can access full profile details for verification, vetting, support, and dispute resolution. Every administrative access to sensitive fields is logged in an append-only audit trail.
Service providers. We use a small number of vendors who process data on our behalf under contract — they cannot use your data for their own purposes. They are:
• Supabase (database, authentication, file storage — hosted in the EU region by default);
• Payaza Africa (subscription payment processing);
• Africa's Talking (SMS delivery for one-time passwords and transactional messages);
• Sentry (crash and error monitoring);
• PostHog (first-party product analytics and feature flag evaluation, hosted in the EU region — we have disabled automatic event capture and session recording);
• Expo / Apple Push Notification Service / Firebase Cloud Messaging (mobile push notification delivery).
Law enforcement or regulators, only when compelled by a valid Nigerian court order or regulatory demand, or where we reasonably believe disclosure is necessary to prevent imminent harm.
We do not sell your personal information to anyone for any purpose.
7. undefined
We calculate a trust score for each driver, based on verified documents, guarantor strength, time on the platform, and booking history. The score influences visibility to clients and ranking in search. It does not produce final decisions on its own — a human administrator reviews any outcome that materially affects your ability to earn on the platform (for example, suspension or blacklisting).
Under the NDPA you have the right to object to automated decision-making and to request human review of any score or ranking decision that affects you. Write to us at the privacy email above and we will respond within 30 days.
8. undefined
Active accounts. We keep your profile and activity data for as long as your account is active.
Deleted accounts. When you delete your account, most personal data is removed within 30 days. Limited records are retained longer where the law requires, specifically: identity verification files (NIN references, document images) are retained for five years after account closure to meet CBN anti-money-laundering obligations; transaction records are retained for seven years to meet tax and accounting rules; audit logs are retained for two years for security investigations.
After the retention period ends, data is permanently deleted or irreversibly anonymised.
9. undefined
Sensitive identifiers (NIN, bank account number) are encrypted at rest using Postgres pgsodium with keys that never leave the database server. All traffic between the app and our servers uses TLS.
Row-level security policies in the database restrict which rows an account can read or write, and column-level policies prevent the client apps from reading sensitive fields at all — administrators must call a dedicated, logged function to view them. Anomalous access patterns are alerted to the engineering team.
No system is perfectly secure. If we detect a breach affecting your personal data, we will notify you and the NDPC within the timeframes required by the NDPA.
10. undefined
You have the right to:
• access the personal data we hold about you;
• correct inaccurate data (most fields are editable in the app; write to us for anything else);
• request deletion of your account and associated data, subject to the legal retention exceptions above;
• receive a portable copy of the data you provided, in a structured machine-readable format;
• object to processing, including to automated decisions;
• withdraw consent for anything processed on that basis.
To exercise any of these rights, write to privacy@getrond.com. We respond within 30 days. If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission.
11. undefined
You can delete your account from inside the app. Drivers: go to Profile → Settings → Delete Account. Clients: go to Account → Settings → Delete Account. Confirmation is required. Most personal data is removed within 30 days; limited records are retained as explained in the retention section above.
If you have an active subscription, cancel it first so you are not charged for another period.
12. undefined
Some of our service providers operate outside Nigeria — in particular, Supabase and PostHog host infrastructure in the European Union. Where data is transferred abroad, we rely on contractual safeguards (data processing agreements) and providers that meet international security standards.
13. undefined
The Service is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will remove it.
14. undefined
We do not track you across apps or websites owned by other companies, and we do not sell advertising inside the app. Our product analytics (PostHog) are first-party only, hosted on our own infrastructure, with automatic capture and session recording turned off.
15. undefined
We may update this Privacy Policy from time to time. Material changes will be notified in-app at least 14 days before they take effect. If we need your consent for a new use, we will ask for it.
16. undefined
For privacy questions, write to privacy@getrond.com. You can also reach our general legal team at legal@getrond.com or the support team at support@getrond.com.