Privacy Policy

1. Who We Are

Your privacy matters to us. This policy explains what personal data we collect when you use SheDrives, why we collect it, how we protect it, and the rights you have over it. We have written this in plain language because we believe you deserve to understand it.

SheDrives Limited is the company behind the SheDrives app, a ride-hailing platform built for women, by women. We are registered in Nigeria (RC No: 9225367). Under the Nigeria Data Protection Act 2023 (NDPA), we are your Data Controller, responsible for deciding how your personal data is used and ensuring it is handled lawfully and safely.

SheDrives offers services including rides and safety-focused transport. Your safety is our priority, and that includes the safety of your personal data.

2. How to Contact Us

For any privacy-related questions, data subject requests, or complaints, please contact our Data Protection Officer:

3. What Personal Data We Collect

We collect and process personal data: (a) provided directly by you; (b) automatically when you use the SheDrives app; and (c) from authorised third parties. The categories below detail each.

3a. Data You Provide to Us

3b. Data We Collect Automatically When You Use the App

3c. Data We Receive from Third Parties

We do not collect sensitive personal data such as your religion, ethnicity, health information, or political views. If you voluntarily share disability information to request an accessibility accommodation, we will only use that data for that specific purpose.

4. Why We Use Your Data and Our Legal Basis

Under the Nigeria Data Protection Act 2023, every use of your personal data must have a lawful basis. Below we set out our purposes, the legal basis under the NDPA, and the data involved.

Legal bases used in this section

• Contract — processing necessary to provide the service you have requested.
• Legitimate Interests — our genuine business or safety interests, balanced against your rights.
• Consent — where we ask for your explicit, freely given agreement for a specific use.
• Legal Obligation — where Nigerian law requires us to process or retain the data.
• Vital Interests — to protect life in an emergency.

4a. Provision of the SheDrives Service

• Create, update and maintain your account — Contract. Uses Profile Data, Device Data.
• Verify your identity and authenticate your account; we may ask for an ID document and selfie and, with your consent, use facial recognition (manual verification is available) — Contract; Legal Obligation; Legitimate Interests; Consent (biometric checks). Uses Profile, Identity/Verification, Device, Geolocation Data.
• Match you with a Driver-Partner and facilitate pick-up and drop-off; your name and masked phone number are shared during the trip — Contract; Consent (real-time geolocation). Uses Profile, Geolocation, App Usage, Device, Communication Data.
• Ensure your journey goes smoothly — route analysis, coverage optimisation, and resolving app quality issues — Legitimate Interests. Uses Geolocation, App Usage Data.
• Keep the app working — updates, authentication, and technical maintenance — Contract; Consent (analytics cookies). Uses Profile, Device, App Usage, Cookies/Analytics Data.
• Suggest rides and destinations based on your trip history and, where you consent, your calendar events — Consent (background geolocation and calendar); Legitimate Interests. Uses Profile, App Usage, Geolocation, Calendar Data.
• Calculate fares and process payments on behalf of Driver-Partners — Contract. Uses Payment, Geolocation Data.
• Administer SheDrives Business accounts where your employer or another user has arranged your ride — Legitimate Interests. Uses Contact, App Usage Data.
• Collect your feedback through surveys and interviews to measure satisfaction and improve the service — Consent (opt-in surveys); Legitimate Interests. Uses Profile, Demographic, Survey/Interview Data.

4b. Customer Support

• Investigate and resolve queries, complaints and disputes between riders and Driver-Partners — Contract; Legitimate Interests. Uses Profile, Communication, User-Generated, Warning/Suspension, Rider Rating Data.
• Respond to safety incidents and cooperate with law enforcement where required — Legal Obligation; Vital Interests. Uses all relevant data categories.
• Automated complaint handling via in-app chat for routine queries; you may request human review of any automated interaction at any time (see Section 11) — Contract; Legitimate Interests.

4c. Safety and Security

• Safety Audio Recording — you or your Driver-Partner may record audio if either party feels unsafe; recordings are encrypted and only accessed by SheDrives if submitted with a safety report — Legitimate Interests; Vital Interests. Uses User-Generated, Geolocation Data.
• SOS / Emergency Assist — call the police or emergency services via the app; SheDrives Support will follow up to check you are safe — Vital Interests; Legitimate Interests. Uses Profile, Geolocation Data.
• Trip Safety Monitoring — we may send you a safety check notification and follow up with Customer Support or local authorities if a concern is flagged — Vital Interests; Legitimate Interests. Uses Geolocation, App Usage Data.
• Trip Sharing — share a real-time link (SMS, WhatsApp, or email) so trusted contacts can follow your live journey — Consent; Legitimate Interests. Uses Geolocation, App Usage Data.
• Women-for-Women Matching — you may choose to be matched only with female Driver-Partners — Consent; Legitimate Interests. Uses Profile, Geolocation Data.
• Detect and prevent fraud and unauthorised account use; our automated system reviews activity at key moments, and no account is blocked without human review — Legitimate Interests. Uses Profile, Device, Geolocation, App Usage, Payment, Communication Data.
• Calculate your average Rider Rating; Driver-Partners rate riders 1 to 5 stars after each trip and your average is visible when they accept a ride; either party may select “Block Future Requests” after a 1-star rating — Legitimate Interests. Uses Rider Rating, Profile Data.
• Issue automated warnings and temporary suspensions where your Rider Rating falls below a threshold; a warning triggers a 90-day improvement period and, if not improved, a 6-month temporary suspension may follow (see Section 11) — Legitimate Interests (warnings); Contract (suspensions). Uses Profile, Rider Rating, Warning/Suspension Data.

4d. Marketing and Advertising

• Send you promotional emails, SMS, WhatsApp messages, push notifications and in-app messages about SheDrives services, features, offers and partner promotions, personalised to your usage — Legitimate Interests (where permitted under the NDPA); Consent (where required by law or for third-party promotions). Uses Contact, App Usage, Device, Cookies/Analytics Data. You can opt out at any time (see Section 10).
• Measure the effectiveness of our marketing campaigns using pixels and similar technologies — Legitimate Interests; Consent (tracking technologies). Uses App Usage, Device, Cookies/Analytics Data.

4e. Service Communications

We use your name, phone number and email address to send trip confirmations, receipts, journey completion notices and important service updates. Legal basis: Contract. Data: Profile Data.

4f. Research and Improvement

• Perform research, testing and analytics to understand usage and improve our services, including algorithms and machine learning models; all bulk data used for research is anonymised — Legitimate Interests; Consent (specific analytics). Uses Geolocation, App Usage, Communication, User-Generated, Device Data.
• Develop new features, partnerships and services — Legitimate Interests. Uses Profile, Geolocation, App Usage, Communication Data.
• Prevent, find and resolve software or hardware bugs — Legitimate Interests. Uses Profile, Geolocation, User-Generated, Communication, Device, App Usage Data.

4g. Legal Compliance

• Investigate and respond to legal claims and disputes; cooperate with regulators (NDPC, FCCPC, CAC), courts and law enforcement — Legal Obligation; Legitimate Interests. Uses all relevant data.
• Fulfil Nigerian tax obligations (FIRS), CBN financial regulatory requirements and transport licensing conditions — Legal Obligation. Uses Profile, Payment, App Usage Data.
• Reorganise or transfer our business (e.g. merger or acquisition); we will notify you if your data is transferred to a new controller — Legitimate Interests. Uses all data.
• Maintain the technical and cybersecurity integrity of the SheDrives platform — Legitimate Interests. Uses all data.

5. Who We Share Your Data With

We do not sell your personal data. We do not share it with advertisers to build profiles on you. We only share data when it is necessary to run the service, to keep you safe, or when the law requires it.

• Driver-Partners — your first name, masked phone number, profile photo and pickup location: the minimum needed to find you. Your actual number is protected by a masked numbers system. After the trip, your name and number remain visible for 24 to 48 hours only, to allow return of any belongings left in the vehicle. Audio recordings may be shared with law enforcement where legally required.
• SheDrives Business clients or other account holders — if your employer’s Business Account or another holder requests or pays for your ride, we share your name, phone number, trip date, time, charges, rating, region and pick-up/drop-off locations via their Business Account dashboard.
• Referrers — if another user referred you, we may confirm that you joined and, where a bonus applies, that you completed qualifying trips. If you refer someone, we tell them you generated the referral.
• Payment providers — tokenised payment data to process your transaction. All providers are PCI-DSS certified and bound by data processing agreements.
• Emergency services — your name and live location when you activate SOS, or where your life or safety is at immediate risk.
• Insurance providers — trip data, identity data and incident details when processing an insurance claim or as required under our insurer contracts.
• Technology service providers — data required to operate the platform: cloud hosting, analytics, fraud detection, identity verification, support tooling, crash reporting and machine learning services. All are bound by data processing agreements.
• Marketing and strategic partners — limited data such as your email address to send you promotions in line with your preferences; we may also share data with social media advertising services (e.g. Google) to measure ad performance.
• Nigerian regulators and law enforcement — we disclose data when legally required by the NDPC, FCCPC, FIRS, police, courts or other competent authorities, verifying lawful basis before any disclosure.
• Prospective business owners (sale or restructuring) — in a merger, acquisition or business sale, data may be shared during due diligence. We will notify you if your data is transferred to a new controller.

Our app may contain links to third-party websites. We are not responsible for their privacy practices. Please review their notices before submitting your data.

6. Transfers Outside Nigeria

Some of our technology partners store or process data in countries outside Nigeria, for example in cloud servers in the UK, EU or United States. Whenever this happens, we comply with Section 43 of the NDPA 2023 and only transfer your data where we have put in place at least one of the following safeguards:

• NDPC-approved Standard Contractual Clauses (SCCs) — contractual commitments that bind the recipient to protect your data to NDPA standards.
• Adequacy decisions — where the NDPC or another competent authority has recognised that the destination country provides adequate data protection.
• Your explicit consent — where we have informed you of the transfer and you have agreed.

We rely on Standard Contractual Clauses for transfers to the jurisdictions where our cloud hosting, analytics and identity verification providers are based. In exceptional cases, such as responding to a lawful law enforcement request, a transfer may take place on the basis of exemptions under the NDPA; in such cases we will minimise the data transferred.

7. How We Keep Your Data Safe

We have implemented appropriate technical and organisational controls to protect your personal data against unauthorised access, accidental loss, damage or destruction. Our security measures include:

• All data in transit is encrypted.
• Sensitive data at rest (including payment tokens) is encrypted.
• Multi-factor authentication for all staff systems that access personal data.
• Access to personal data restricted on a strict need-to-know basis.
• Regular security testing, penetration testing and internal audits.
• Mandatory data protection training for all staff.
• Information security policies governing the confidentiality, integrity and availability of our systems.

Data Breach Notification

If there is ever a personal data breach likely to result in a risk to your rights or freedoms, we will notify the NDPC within 72 hours of becoming aware, as required by Section 40 of the NDPA 2023. We will also notify you directly as quickly as possible where the breach is likely to result in high risk to you.

Your Responsibility

You are responsible for keeping your app login credentials secure. Please choose a strong, unique password. If you believe your account has been compromised, contact us immediately at support@shedrivesng.com.

All bulk data used for research (such as aggregate geolocation data) is anonymised so that you can never be identified from it. We will not attempt to re-identify anonymised data.

8. How Long We Retain Your Data

We keep your personal data only for as long as necessary to provide our services and fulfil the purposes described in Section 4. After a retention period lapses, data is securely deleted or anonymised, unless it is necessary for the establishment, exercise or defence of legal claims.

Uninstalling the SheDrives app does not delete your personal data. If your account has been inactive for three years, we will contact you to confirm whether you wish to keep it active. If we receive no reply, your account will be closed and personal data deleted, subject to the exceptions below.

• Account and profile data — active account plus 5 years after closure (fraud prevention, dispute resolution and regulatory requirements).
• Trip history and geolocation data — 3 years from the date of each trip (dispute resolution and service improvement).
• Payment records — 7 years from transaction date (FIRS tax obligations and CBN financial regulatory requirements).
• Tax, accounting and financial reporting data — 10 years after your last journey.
• Support conversations (chat, email, phone) — 3 years from the interaction (complaint handling, quality monitoring and dispute resolution).
• Instant messages, Customer Support in-app — 90 days; 6 months if related to a reported incident or dispute.
• Instant messages, Rider to Driver-Partner chat — until the trip ends; 3 months in our systems thereafter.
• Audio Trip Recordings stored locally on device — 24 hours if not submitted to SheDrives.
• Audio Trip Recordings submitted to SheDrives — 7 days after the investigation closes; may be extended for legal reasons.
• Ratings and reviews — 3 years (safety, quality monitoring and platform integrity).
• Unmatching status (1-star block) — until either account is deleted.
• Complaints log — 12 months (accessible to the licensing authority on request).
• Formal investigations (criminal, fraud or false information) — as required by law and our internal investigation policy.
• Active disputes — until the claim is satisfied or the limitation period expires.
• Marketing preferences — until you withdraw consent or close your account.

9. Your Rights

The Nigeria Data Protection Act 2023 gives you meaningful control over your personal data. To exercise any right, email support@shedrivesng.com or use 'Privacy Settings' in the app. We will respond within 30 days as required by the NDPA.

• Right of Access — request a copy of all personal data we hold about you.
• Right of Rectification — ask us to correct any personal data that is inaccurate or incomplete; you can also update many details directly in the app.
• Right of Erasure — ask us to delete your personal data where we no longer have a lawful basis to hold it. Data required by law or needed to defend legal claims may not be deleted immediately.
• Right to Restrict Processing — ask us to pause certain uses of your data, for example while you contest its accuracy.
• Right to Object — object to processing based on legitimate interests, including direct marketing. We honour marketing opt-outs immediately.
• Right to Data Portability — request your data in a structured, machine-readable format, or ask us to transfer it to another provider where technically feasible.
• Right to Withdraw Consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to Object to Automated Decisions — see Section 11 for your rights regarding automated decisions such as Rider Rating suspensions.
• Right to Complain to the NDPC — contact the Nigeria Data Protection Commission at ndpc.gov.ng if you believe we have mishandled your data. You may also seek judicial remedy.

10. Direct Marketing

You may receive promotional messages about SheDrives services, features, offers and selected partner promotions via email, SMS, WhatsApp, push notifications and in-app messages. We send these on the basis of our legitimate interests in keeping you informed about services that may benefit you or, where Nigerian law requires it, only with your explicit consent.

We personalise marketing messages based on how you use the SheDrives app (for example, your trip frequency or preferred routes). We also use pixels and similar technologies to track which emails are opened and links clicked, to measure the effectiveness of our campaigns.

You are in full control. You can opt out at any time by:

• Clicking the 'Unsubscribe' link at the bottom of any marketing email.
• Replying 'STOP' to any marketing SMS or WhatsApp message.
• Updating your communication preferences in 'Settings' in the SheDrives app.

Opting out of marketing will not affect service communications such as trip receipts or important account notifications.

11. Automated Decisions

Some of our processes use automated systems to make or support decisions that may affect you. We are committed to transparency about how these work.

Rider Rating System

Your average Rider Rating is calculated automatically from ratings given by Driver-Partners after each trip, over a rolling 365-day period. If your rating falls below a specified threshold, an automated warning is issued. If the rating does not improve within 90 days, a 6-month temporary suspension of your ability to book rides may follow.

Although these processes involve automated logic, human review is part of our process. You have the right to:

• Contest any rating or warning by contacting our Customer Support Team.
• Request a human review of any suspension decision.
• Receive an explanation of the basis for any action taken.
• Understand the behavioural guidelines you are expected to follow (shedrives.ng/rider-guidelines).

Fraud Detection

Our automated fraud detection system may flag unusual account activity and apply a temporary suspension pending investigation. No account is permanently blocked without human review by our team. You may contest any action by contacting our Customer Support Team.

Automated Customer Support

We may use automated chat functions to handle routine queries. You have the right to request a human agent at any time, by asking in the chat or contacting support@shedrivesng.com.

12. Location Data

SheDrives needs your location to work. We use GPS to find you for pick-up, navigate your trip and calculate your fare. Location tracking is active while you are using the app for a trip.

We do not track your location continuously in the background unless you have specifically enabled a feature that requires it, such as automatic pickup detection or ride suggestions based on your current location. When such features are active, you will have explicitly consented to background location access.

You can manage location permissions at any time in your phone's settings. Turning off location access will prevent you from booking rides, as we cannot direct a Driver-Partner to your location without it.

We use aggregated and anonymised location data to improve geographic coverage and route recommendations.

13. Cookies and Tracking Technologies

The SheDrives app uses cookies, tracking pixels and analytics tools to keep you logged in, remember your preferences, understand how people use the app, and serve relevant promotions according to your marketing preferences.

• Session cookies — keep you logged in during your session.
• Preference cookies — remember your language, notification and display settings.
• Analytics SDKs — understand how features are used so we can improve them; crash reporting and performance monitoring.
• Advertising identifiers — measure the effectiveness of our promotional campaigns (not used to build profiles for third-party advertisers).

We do not use tracking technology to build advertising profiles for third-party advertisers, and we do not sell data derived from your app activity.

You can manage your cookie and tracking preferences in 'Settings' in the SheDrives app. For cookies that require your consent under Nigerian law, you will be prompted to opt in before they are activated.

14. Changes to This Policy

We may update this policy when our practices change, when we launch new features, or when Nigerian law requires it. If we make significant changes, we will notify you via the SheDrives app, by email, or through another appropriate channel before the changes take effect.

The current version of this policy is always available at shedrives.ng/privacy. The effective date at the top of this document shows when the policy was last updated.

15. Contact Us

For any privacy-related questions, data subject requests, or concerns, please reach us via:

• Data Protection Officer: support@shedrivesng.com — subject line 'For the attention of She Drives DPO'.
• General support: support@shedrivesng.com or in-app Help chat.
• Nigeria Data Protection Commission (NDPC): ndpc.gov.ng — you may lodge a complaint with the NDPC if you are unhappy with how we have handled your data.