1. INTRODUCTION

Welcome to TruBooker's Privacy POLICY ("Privacy POLICY").

TruBooker Ltd. ("we", "us", "our", or "the Company") operates the TruBooker Platforms, which include the website www.trubooker.com and the TruBooker App. This Privacy Policy governs the use of our website, applications, and any services we offer (collectively referred to as "the Services").

We are committed to safeguarding your privacy and ensuring the security of your personal information. This policy outlines our practices in relation to the collection, use, disclosure, and protection of your personal data, in accordance with the laws of the Federal Republic of Nigeria.

For the purposes of this policy, the terms “we”, “us”, and “our” refer to TruBooker Ltd., a company registered in Nigeria with its office located at 6a Charles Idahosa Street, Amufi, Edo State, Nigeria. Regardless of your location within the country, our methods for handling your personal data remain consistent nationwide.

As the data controller, TruBooker Ltd. assumes responsibility for your personal information in accordance with applicable data protection laws.

For more information about us, and our presence in your state, please visit www.trubooker.com.

Definitions:

"Personal Information" refers to any data that can be used to identify or reasonably link to an individual. This definition is not limited to private or confidential details; it also includes general identifiers such as your name, date of birth, and email address. For a detailed explanation of the specific Personal Information we collect, please refer to Section 5.

"Sensitive Personal Information" includes data related to an individual's racial or ethnic background, political views, religious or philosophical beliefs, trade union affiliation, genetic or biometric data used for unique identification purposes, health information, or details regarding one’s sexual orientation or sex life. It also covers data on criminal convictions or offenses, as well as any other information considered sensitive under applicable data protection regulations.

2. SCOPE OF OUR PRIVACY POLICY

Our Privacy Policy applies to all Personal Information we collect, use, share, or otherwise process through our business activities, both online and offline, which display, link, or refer to this Privacy Policy, including:

• our website;
• our official social media pages;
• our e-mails;
• our apps;
• our online and offline campaigns; and
• your conversations or correspondence with our representatives.

Throughout this document, we will refer to our online activities as "Platforms" and to our offline activities as "Services."

You should be aware of the fact that our Platforms may contain hyperlinks to third-party websites, apps, etc. which are not controlled by us and which are not covered by this Privacy Policy. We have no responsibility or liability for the content and activities of these third-party websites, apps, etc. As these third parties may collect your Personal Information, we suggest that you consult the privacy policies of these third parties to learn more about their use of your Personal Information.

Our websites make use of cookies. For more information on this subject, please also consult our Cookies Policy.

Further, when using our Platforms or Services, please always also read our Terms of Use. By accepting the Company's Terms of Use or providing information to us via our Platforms, you consent to the use and disclosure of personally identifiable information as outlined in this Privacy Policy.

3. GUIDING PRINCIPLES

TruBooker is committed to maintaining the principles in the Nigeria Data Protection Act 2023 (NDPA) and the Nigerian Data Protection Regulation (NDPR) regarding the processing of Personal Data. The collection and processing of your Personal Data shall be in accordance with the legitimate and lawful purpose consented to and shall only be stored for the period, which is reasonably required, provided also that your Personal Data shall be adequately secured against foreseeable hazards within our contemplation. To demonstrate this commitment as well as our aim of creating a positive privacy culture within TruBooker, TruBooker adheres to the following basic principles relating to the processing of Personal Data: lawfulness, fairness, and transparency; data accuracy; purpose limitation; data minimization; storage limitation; integrity and confidentiality; and accountability.

4. FAIR AND LAWFUL PROCESSING

We process your Personal Information for the below listed purposes on the basis of your consent, unless stated otherwise. In some cases, where required by law, we may ask for your explicit consent for processing your Personal Information for a specific purpose. We only collect, use, disclose, or otherwise process your Personal Information where it is fair and lawful to do so. In many cases providing your Personal Information to us is necessary for the performance of your contract with us; if you do not wish to provide your Personal Information to us, we may not be able to provide you with the services you have requested from us.

5. HOW DO WE OBTAIN YOUR PERSONAL INFORMATION?

Personal Information obtained from you directly.

Firstly, we may obtain your Personal Information from you directly, e.g. when you sign up for our newsletters, register on our Platforms, book a TruBooker Trip from us, fill out a survey, make a comment or inquiry, post something on our social media pages, subscribe to direct marketing, etc.

Personal Information collected this way may include:

• name;
• address;
• e-mail address;
• user name;
• telephone number (and recordings when you call the Vehicle Operator’s line);
• credit card or other payment information;
• age;
• date of birth;
• gender;
• booking information;
• information, feedback, or content you provide regarding your marketing preferences;
• user-generated content, posts, and other content you submit to our Platforms;
• in limited circumstances, information about your family or other individuals that you have provided to us. In such cases, we assume that you have the authority to share any personal information you provide to us about them;
• in limited circumstances based on your explicit consent or for carrying out our legal obligations or if necessary for reasons of substantial public interest, Sensitive Personal Information such as information relating to your image, health (including information related to medical history), and biometrics collected during volunteer consumer research studies (such as facial expression recognition, heart rate, and skin condition);
• demographic information; or
• any other Personal Information you voluntarily provide us with directly.

Personal Information collected automatically.

Secondly, some Personal Information may be collected automatically when you visit or use our Platforms (and those of our third-party service providers acting on our behalf), such as information collected by cookies and other technologies (such as web analytic tools and pixel tags) on our website. Please also consult our Cookies Policy for more information on how we make use of cookies and other automated means of data collection.

Personal Information collected this way may include:

• Information about your (mobile) device or your type of browser;
• Information about the way you use our website, such as details of the web pages you have viewed, the banners and the hyperlinks you have clicked, etc.;
• Whether you have opened e-mails sent by us to you;
• The websites you have visited before arriving at one of our websites;
• Your IP address;
• The hyperlinks you have clicked;
• Your username, profile picture, gender, networks, and any other information you choose to share when using third-party sites (such as when you use the “Like” functionality on Facebook or the +1 functionality on Google+);
• Your MAC address;
• Information you choose to share by using social media tools incorporated in our websites or using your social media log-in details to access certain applications;
• Information you share with us about your location. Where we are required to do so by law, we will only use that information where you have agreed that we can.

Personal Information obtained from other sources

Lastly, we may also collect Personal Information about you from other sources. These other sources may include:

• Our trusted business partners;
• Social media sites;
• Consumer research organizations;
• Credit reference agencies;
• Intermediaries that facilitate data portability.

Personal Information collected this way may include your interests such as hobbies and pets, consumer and market research data, purchase behavior, publicly observed data, or activities such as blogs, videos, internet postings, and user-generated content.

6. FOR WHICH PURPOSES, MAY WE USE YOUR PERSONAL INFORMATION

We use your Personal Information for the following business purposes:

• Based on your contract with us, handling and managing your booking, for instance, communicating to you with respect to your booking, processing your payments, delivering the purchased services, and offering you the necessary customer service; allowing you to participate in promotions, contests, surveys, and polls;
• Allowing you to share information and ideas on our social media pages, forums, blogs, and other communication channels, to participate in social sharing, and to send messages to a friend through our Platforms or the websites of our trusted business partners;
• Better understanding your needs to provide you with more relevant information, analyzing and evaluating our corporate activities, testing, developing, and evaluating new services and improving our existing services, conducting market research and audits, identifying user trends, and examining the degree of effectiveness of our marketing campaigns and degree of satisfaction of our customers;
• Telling you about our services, and sending you promotional materials (such as announcements relating to new services, promotions, savings programs, joint promotions, and other programs) relating to our brand and those of our carefully selected trusted business partners, subject to your consent to such marketing where required by law;
• Managing our Platforms, and tuning the experience and content of our Platforms to your previous activities on our Platforms, in view of personalizing your experience when visiting our Platforms;
• Responding to our requests or inquiries;
• Dealing with any service adverse events you report to us;
• Administering general record keeping; and
• Meeting legal and regulatory requirements.

The law may require us to set out in this Privacy Policy the legal grounds on which we rely in order to process your Personal Information. In such cases, our use of your Personal Information is permitted by law because:

• It is necessary for our legitimate interests in the effective delivery of information and services to you, and in the effective and lawful operation of our business (in each case provided such interests are not overridden by your rights);
• It is necessary to take steps to enter into a contract with you for the services you purchase, or for carrying out our obligations under such a contract;
• It is required to satisfy any legal or regulatory obligations that we are subject to; and
• In limited circumstances and if required by law, you have agreed to us processing your Personal Information, such as when you opt for marketing messages, or processing with your explicit consent in the case of Sensitive Personal Information, such as health information.

We may create anonymous data records from Personal Information by excluding information (such as your name) that makes the data personally identifiable to you. We use this anonymous data to analyze our services. We reserve the right to use such anonymous data for any purpose and disclose anonymous data to third parties, including but not limited to our research partners, in our sole discretion.

7. TO WHOM WE MAY DISCLOSE YOUR PERSONAL INFORMATION

Third-party service providers

We may share your Personal Information with trusted third-party service providers who work on our behalf, such as marketing agencies, market research companies, e-commerce partners, software, data hosting and other IT service providers, call centers, payment processors, etc. These third-party service providers are required not to use your Personal Information other than to provide the services requested by us or otherwise in accordance with our instructions.

Other trusted third parties

We may also share your Personal Information with other trusted third parties, such as our business partners, advertisers (where we are permitted to do so), and data exchanges, so that we can offer you tailored content, including more relevant advertising for products and services which may be of interest to you. These third parties may set and access their cookies, web beacons, and similar tracking technologies on your device in order to deliver customized content and advertising to you when you visit our websites.

Acquisitions

If another company acquires (part of) our company, business, or our assets, that company may acquire all or part of the Personal Information collected by us and will assume the rights and obligations regarding your Personal Information as described in this Privacy Policy. In the unlikely event of an insolvency, bankruptcy, or receivership, your Personal Information may also be transferred as a business asset, subject to applicable law.

Disclosures

We may disclose your Personal Information if we believe in good faith that such disclosure is necessary for our legitimate interest or prudent in light of our obligations under applicable law:

• In connection with any legal investigation;
• To comply with relevant laws or to respond to court or authority orders, subpoenas or warrants served on us;
• To protect or defend our rights in legal procedures; or
• To investigate or assist in preventing any violation or potential violation of the law, this Privacy Policy, or any applicable Terms and Conditions.

8. HOW WE PROTECT YOUR PERSONAL INFORMATION

We value the trust you place in us.

We have implemented appropriate technical and organizational measures to protect your Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access and against all other unlawful forms of processing.

When collecting or transferring Sensitive Personal Information we use a variety of additional security technologies and procedures to help protect this information.

The Personal Information you provide us with is stored on computer systems located in controlled facilities which can only be accessed by a limited number of persons who have a need to know in order to carry out their tasks and any services requested by you.

When we process highly confidential information (such as credit card numbers) over the Internet, we protect it through the use of encryption.

9. Your Choices Regarding Direct Marketing

We may periodically send you free newsletters, surveys, offers, and other promotional materials related to our products and services which we believe are useful for you if you have consented (opted-in) to receive such messages via e-mail or any other electronic channel (where such opt-in is required under law).

If you do not wish to receive such communications anymore, you will always have the opportunity to "opt-out" by following the unsubscribe instructions provided in each of our direct marketing e-mails or by contacting us directly (please see our contact information at “how to contact us” below).

Where permitted under law, we may send you service messages identifying any updates to our Privacy Policy (even where you have opted out of receiving marketing messages from us).

10. Your Rights

Depending on your location, you may have various rights in relation to your Personal Information. In particular, you may have the right to:

• request a copy of the Personal Information we hold about you;
• ask that we restrict how we use your Personal Information;
• ask that we update the Personal Information we hold about you, or correct any Personal Information that you think is incorrect or incomplete;
• ask that we delete personal data that we hold about you (the “right to be forgotten”);
• withdraw consent at any time for the future to our processing of your Personal Information (to the extent such processing is based on consent);
• object to our processing of your Personal Information (including for direct marketing purposes);
• request your personal data be transferred to you or another data controller (the “data portability” right).

In addition, in certain circumstances, we may process your personal data through automated decision making, including profiling. This may include segmenting and tailoring the data to enable us to match our communication and products to your perceived needs. In the case we process your Personal Information through automated decision-making, we will inform you about the logic involved, as well as the significance and the envisaged consequences of such processing for you. Depending on your location, you may be able to request not to be subject to automated decision-making, including profiling.

If you would like to exercise these rights or understand if they apply to you, please click here to complete and submit an online request form. Alternatively, you can get in touch using the details set out at “how to contact us” below.

11. Complaints

If you are unhappy with the way we have handled your Personal Information or any privacy query or request that you have raised with us, you have a right to complain to the data protection regulator in Nigeria.

You can contact the National Data Protection Commission at 12 Dr. Clement Isong, Asokoro, Street 900103, Federal Capital Territory.

We will cooperate fully with the NDPC in investigating and resolving any complaints, and we will take all necessary steps to remedy any issues that are identified.

12. How Long We Retain Your Personal Information

We will only retain your Personal Information as long as reasonably required for the purposes as set out in this Privacy Policy or otherwise to comply with legal or regulatory requirements applicable to us.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, and the applicable legal requirements.

You can request to have all your personal information deleted entirely. Please note that if you request the erasure of your personal information, we may retain and use your personal information to the extent necessary to comply with our legal obligations, including but not limited to tax, legal reporting, and auditing obligations.

When your Personal Information is processed:

• for the performance of your contract with us, we retain your Personal Information for a period of 7 years following the completion of a contractual order;
• To meet legal and regulatory requirements, we retain your Personal Information as it is set out by the applicable law;
• In all other cases, we process your Personal Information, depending on the type, for up to 2 years from the date of our last interaction with you.

13. Children

Our Platforms are not directed towards children and we request that children below the age of 18 do not provide Personal Information through our Platforms.

If you are the parent or legal guardian of a child under 18 who has registered on our Platforms, or who you believe has otherwise provided Personal Information to us, please contact us using the details set out at “how to contact us” below to have the information deleted. Information voluntarily provided by children via e-mails, message boards, chat sessions, etc. may be used by other parties to generate unsolicited e-mails. We encourage parents and legal guardians to inform children about how to use the Internet safely and responsibly.

Depending on your location and where permitted by law, we may collect information on your children to provide you with relevant information about our services.

14. Transfers to Other Countries

Your Personal Information may be transferred to and processed in other countries where laws governing the processing of Personal Information may be less stringent than the laws in Nigeria.

In such cases, where required by law we will ensure that there are adequate safeguards in place to protect your Personal Information. Depending on the location of the entity exporting the relevant Personal Information, this adequate safeguard might be a data transfer agreement with the recipient based on standard contractual clauses. Where we are legally required to do so, further details of these transfers and copies of these agreements are available from us on request.

To the extent required and valid under law, you consent to your Personal Information being transferred and processed this way.

15. How to Contact Us

We welcome your feedback. If you have any comments, questions, or complaints regarding this Privacy Policy or our processing of your Personal Information, or would like to exercise any of the rights set out at “your rights” above that are applicable in your location, you can contact our Group Data Protection Officer by sending an e-mail to [Official e-mail].

You may also write to us at:

16. CHANGES TO THIS PRIVACY POLICY

This Privacy Policy was last modified in October 2024. This document is a notice to you and not a contract between us. We may occasionally modify or amend it from time to time. When we make changes to this Privacy Policy, we will update the revision date at the top of this Privacy Policy. Where those changes are material, we will take steps to let you know. The new modified or amended Privacy Policy will apply from that revision date. Please always verify whether you have consulted the latest version of the Privacy Policy.