Privacy Policy

1. Who We Are and How This Policy Applies

BuruExpress operates an on-demand parcel delivery platform within Abuja, Federal Capital Territory, Nigeria. Our service connects a specific pickup point with a specific destination and enables a Dispatch Rider to carry the parcel directly between those points.

This Privacy Policy explains how BuruExpress handles personal data when you use our application, request a delivery, receive a parcel, work with us as a Dispatch Rider or contact us through an official BuruExpress channel.

For the purposes of the Nigeria Data Protection Act, 2023 and applicable guidance or requirements issued by the Nigeria Data Protection Commission, BuruExpress is the Data Controller for personal data we process in running and managing the Platform.

A Data Subject is any identifiable person whose personal data we process. Depending on the circumstances, this may include a User, sender, recipient or Dispatch Rider.

2. What Information We Need

The information we collect depends on what you do on BuruExpress. We do not need the same information from everyone.

When you create or operate an account, we may collect your name, telephone number, email address, account details and other information needed to create, secure and manage the account.

A delivery creates another set of records. These may include the pickup location, destination, sender's details, recipient's name and telephone number, delivery instructions, parcel information supplied by the User, trip reference numbers, collection and delivery times, trip status and records confirming delivery.

If you contact customer support, we may keep a record of the information you provide and our communications with you.

We may collect additional information from Dispatch Riders where it is reasonably required to verify their identity, manage their relationship with BuruExpress, operate their account, coordinate deliveries or protect the safety and integrity of the Platform.

If you provide us with another person's information — for example, the name, telephone number or address of a parcel recipient — you are responsible for ensuring that you are entitled to provide that information for the delivery.

3. Location, Maps and Active Delivery Tracking

Location data is central to the way BuruExpress works. BuruExpress may process precise location information obtained through GPS, mobile networks, Wi-Fi or other location technologies available on your device to identify or confirm the pickup point and destination, calculate distance, coordinate Rider assignment and improve delivery accuracy.

Depending on device permissions, you may allow BuruExpress to access your location while the app is in use, or enter/select a pickup or destination manually. We do not use the completion of one delivery as a reason to keep showing or continuously tracking a User's real-time location.

The position of a Dispatch Rider matters while a delivery is underway. BuruExpress may collect the Rider's precise location in the foreground and background during an active trip, subject to device permissions, to coordinate collection, monitor trip progress, provide live delivery updates and deal with operational, safety or security issues.

A User may see the assigned Rider moving on the BuruExpress map while the trip is active. That live visibility ends when the trip is completed, cancelled or otherwise closed — the User will not continue to see the Rider's real-time movements after the relevant trip has ended.

BuruExpress may still retain a record of the trip and relevant location history for a reasonable period, for reasons such as investigating a complaint, resolving a dispute, addressing suspected fraud, dealing with a security issue or complying with a legal obligation. Retaining historical records is different from continuing to track or display the Rider's live location.

A Dispatch Rider who turns off location permissions required for an active delivery may be unable to use some parts of the Rider app or complete trips through BuruExpress.

4. Information Shared During a Delivery

A User and a Dispatch Rider need limited information about each other to complete a delivery. We share what is necessary for the trip and do not give either party unrestricted access to the other's account.

For an assigned delivery, the Dispatch Rider may see the User's name and telephone number, the pickup address or precise pickup location, and the destination and recipient details needed to complete the delivery.

The User may see the assigned Rider's name, telephone number and vehicle plate number, and — while the trip is active — the Rider's live location through the BuruExpress map. That access is linked to the particular delivery and is not permission to access unrelated personal information.

Payment credentials are not shared between Users and Riders. A Dispatch Rider does not receive the User's card number, bank account details or similar financial credentials, and the User does not receive the Rider's private banking or payment information.

5. Why We Use Personal Data

We use personal data to run the service — creating accounts, receiving delivery requests, identifying pickup and destination points, assigning Riders, coordinating active trips, communicating updates and keeping records of completed deliveries.

Some processing is necessary because of the service relationship between you and BuruExpress. We also use information to keep the Platform secure, including investigating suspected fraud, account misuse, unlawful activity, delivery disputes, security incidents and conduct that may put Users, Riders or the public at risk.

Personal data may also be processed where Nigerian law requires it, to answer customer enquiries and deal with complaints, and — where appropriate — to analyse operational information to identify technical problems and improve delivery coordination.

Your contact details may be used for delivery updates, account notices, security alerts, payment communications and responses to support requests. Where permitted by law, we may also contact you about BuruExpress services or promotions. You may opt out of marketing communications.

6. Our Legal Basis for Processing

BuruExpress processes personal data only where there is a lawful basis for doing so. Depending on the circumstances, we may process information because you have given consent for a particular purpose; the processing is necessary to provide or perform the service connected with your use of BuruExpress; we are required to comply with a legal obligation; the processing is necessary to protect life or physical safety in circumstances recognised by law; BuruExpress or another party has a legitimate interest in the processing, provided that interest does not override your rights and freedoms; or another lawful basis under applicable Nigerian data protection law applies.

The lawful basis may differ from one activity to another. Where we rely on consent, you may withdraw it — withdrawal will not affect processing that was lawful before the consent was withdrawn.

7. Automated Tools Used by the Platform

Some parts of BuruExpress rely on automated systems to match a delivery with an available Rider, calculate distance or route information, estimate arrival times, support pricing calculations and identify activity that may indicate fraud or misuse.

Automated tools do not give BuruExpress unrestricted freedom to make decisions about people. Where Nigerian data protection law gives a Data Subject rights in relation to a solely automated decision that produces a legal or similarly significant effect, we will apply the safeguards required by law.

8. When We Share Personal Data

BuruExpress does not sell personal data. We may share information where necessary to operate the Platform, complete a delivery, protect our service, comply with the law or obtain legitimate professional or technical support.

This may include limited information shared between Users and Dispatch Riders as explained above; service providers supporting app infrastructure, mapping, communications, customer support, payment processing, technical maintenance and security; professional advisers such as lawyers, accountants, auditors or insurers where their services are needed; authorities and regulators where required by law or in response to a valid and lawful request; and relevant parties in the event of a merger, acquisition, restructuring, financing or transfer of business assets, subject to applicable legal requirements.

9. Payment Information

BuruExpress may process information necessary to confirm, manage and reconcile payments made through the Platform. Where a payment is handled by an authorised payment service provider, that provider may process payment information under its own applicable terms and privacy arrangements.

A Rider does not receive your card details, bank account details or other payment credentials.

10. How We Protect Information

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These can include access controls, authentication requirements, restricted staff access, protected data transmission, system monitoring, security maintenance, confidentiality obligations and procedures for dealing with security incidents.

No online system is completely immune from risk. We cannot promise that unauthorised access will never occur, but we take reasonable steps to reduce those risks and respond appropriately when an incident is identified.

Keep your login details private and contact us promptly if you believe someone has gained unauthorised access to your account.

11. Personal Data Breaches

If BuruExpress becomes aware of a personal data breach, we will assess what happened and take steps appropriate to the nature and risk of the incident, which may involve containing the breach, investigating its cause, securing affected systems and taking corrective action.

Where the Nigeria Data Protection Act requires notification to the Nigeria Data Protection Commission or affected Data Subjects, we will make the required notification within the applicable legal timeframe.

12. How Long We Keep Your Data

We do not keep personal data indefinitely without a reason. The length of time we retain information depends on why we collected it and whether we still need it, and may be affected by legal, accounting or tax obligations, fraud prevention, security requirements, an unresolved complaint or dispute, or the need to establish, exercise or defend a legal claim.

Trip and location records may remain in our systems after a delivery ends where there is a legitimate reason to retain them. That does not extend live tracking — once a trip is closed, the User's access to the Rider's live location ends even if historical trip records remain available to BuruExpress.

When we no longer need personal data, we will delete it, anonymise it or otherwise dispose of it securely, subject to applicable law.

13. Your Rights as a Data Subject

You have rights over your personal data under the Nigeria Data Protection Act, subject to the conditions and limits set by law. Depending on the circumstances, you may have the right to:

• receive information about how we process your personal data;
• request access to information relating to you;
• ask us to correct inaccurate or incomplete data;
• request erasure where the legal requirements for erasure are met;
• ask us to restrict processing in appropriate circumstances;
• object to particular processing;
• opt out of direct marketing;
• withdraw consent where consent is the basis for processing;
• request portability of qualifying personal data where applicable; and
• exercise rights relating to certain automated decisions.

14. Withdrawing Consent and Changing Device Permissions

You may withdraw consent where we rely on your consent to process particular information. You can also change certain permissions, including location permissions, through your device settings.

Changing a permission may affect what the BuruExpress app can do — for example, if location access is unavailable, the Platform may not be able to identify your pickup point accurately. For a Dispatch Rider, disabling the location access required during an active trip may prevent the Rider app from operating properly for that trip.

15. App Technology and Basic Analytics

BuruExpress may use technical tools needed to operate and maintain the app and related digital services, including device or application identifiers and limited analytics information, to understand technical performance, detect faults, improve reliability and identify how key app functions are being used.

We do not use this Policy as a basis for unrelated advertising surveillance or unnecessary behavioural tracking. Where Nigerian law requires consent for a non-essential technology, we will seek that consent before using it for that purpose.

16. Children's Information

BuruExpress is not intended for independent use by a person who does not have the legal capacity required to enter into the relevant service arrangement. A child may, however, be identified as a parcel recipient where an authorised adult arranges the delivery and limited information is genuinely needed to complete it.

We do not knowingly process a child's personal data in a manner prohibited by Nigerian law. If you believe a child's information has been provided to us improperly, please contact us.

17. Third-Party Services

BuruExpress may rely on third-party technology for functions such as mapping, payments, communications and technical infrastructure. Where you provide personal data directly to a third party operating its own independent service, its own privacy practices will apply to that processing.

We are not responsible for privacy practices outside our control, and encourage you to review the privacy information provided by an independent service before giving it your personal data.

18. Changes to This Policy

Our service, technology and legal obligations may change, and we may need to update this Privacy Policy from time to time. An updated version will be made available through an official BuruExpress channel and will show its effective date or last updated date.

If a change materially affects how we handle your personal data, we will provide notice or obtain consent where the law requires us to do so.

19. Contact Us About Privacy

If you have a question about this Policy, want to exercise a data protection right or wish to raise a privacy concern, you may contact BuruExpress through the official support channels available on the Platform.

Service Area: Abuja, Federal Capital Territory, Nigeria.

You may also have the right to complain to the Nigeria Data Protection Commission if you believe your personal data has been handled in breach of applicable Nigerian data protection law.

20. Final Statement

By creating an account, requesting a delivery, receiving a delivery, providing information in connection with a delivery or using the Platform as a Dispatch Rider, you acknowledge that BuruExpress may process personal data as described in this Privacy Policy and in accordance with applicable Nigerian law.

Location information plays a particularly important role in the BuruExpress service. Users may provide or permit access to location information so that pickup and destination points can be identified. Dispatch Riders may be required to permit precise foreground and background location processing during an active trip so that BuruExpress can coordinate the delivery and allow the relevant User to follow the parcel in real time.

Once the trip is completed, cancelled or otherwise closed, the User can no longer view the Rider's continuing live location through that trip.