1. Scope and Application
This Privacy Policy applies to all users of the Aerodrop mobile application, web application, parcel delivery network, and API services in Nigeria—including Senders, Delivery Agents, Hub Partners, and Parcel Recipients.
2. Personal Data We Collect
We collect personal data necessary to provide secure parcel custody and verification services. This includes:
- Identity & Account Data: Full legal name, phone number, email address, profile photo, and account credentials.
- KYC & Verification Data: Government identification numbers (NIN, BVN, Driver's License, Voter's Card), identity document scans, facial verification photos, and vehicle registration details (for Field Agents and Hub Partners).
- Location & Geolocation Data: Precise real-time GPS coordinates, pickup/destination addresses, and route tracking logs. For Field Agents: We collect precise location data when the agent app is active or executing an assigned drop request to facilitate real-time parcel tracking and handover verification.
- Transaction & Escrow Data: Payment references, escrow transaction histories, fare calculations, bank account/payout details (processed securely via Paystack), and 4-digit PIN verification logs.
- Technical & Device Data: IP address, device model, operating system, unique device identifiers, app usage statistics, and crash logs.
3. Lawful Bases for Processing (NDPA 2023)
Under Section 25 of the Nigeria Data Protection Act (NDPA) 2023, we process personal data based on the following legal grounds:
- Performance of a Contract: To process drop requests, match Senders with Field Agents, execute escrow transactions, and deliver parcels.
- Compliance with Legal Obligations: To fulfill anti-money laundering (AML), counter-terrorism financing (CFT), tax reporting, and law enforcement requirements in Nigeria.
- Legitimate Interests: To prevent fraud, verify physical handovers, protect parcel security, optimize delivery routing, and improve network safety.
- Consent: Where required for specific optional features, direct marketing communications, or precise location access permissions.
4. How We Use Your Information
- To onboard, verify, and authenticate users, Field Agents, and Hub Partners.
- To calculate dynamic delivery fares, process escrow payments, and execute agent payouts via Paystack.
- To provide live parcel tracking updates to Senders and Recipients via SMS, push notifications, and in-app alerts.
- To verify physical parcel handovers at each transit step using cryptographic 4-digit PIN checks.
- To investigate claims, resolve disputes, prevent fraudulent drop requests, and ensure physical safety across the network.
5. Sharing and Disclosure of Personal Data
We do not sell your personal data. We share information only with authorized parties under strict confidentiality agreements:
- Transacting Counterparties: Senders, assigned Field Agents, and Recipients receive necessary contact details (first name, phone number, pickup/delivery address) required to complete a specific drop request.
- Infrastructure & Technology Partners: Cloud database providers (Supabase), payment processors (Paystack), geocoding/mapping services, and SMS/push notification gateways.
- Legal & Regulatory Authorities: Law enforcement agencies, the Nigeria Data Protection Commission (NDPC), or judicial bodies when required by subpoena, court order, or applicable law (e.g. NDLEA, Nigeria Police).
6. Data Security and Technical Safeguards
We maintain comprehensive administrative, technical, and physical security measures to protect personal data against unauthorized access, loss, alteration, or disclosure. Key safeguards include:
- End-to-end Transport Layer Security (TLS 1.3/HTTPS) encryption for all network traffic.
- Row-Level Security (RLS) policies enforcing strict access boundaries in database layers.
- Hashed storage of sensitive authentication credentials and cryptographic verification for PIN handovers.
- Strict role-based access controls for operational support staff.
7. Data Retention and Deletion
We retain personal data only for as long as necessary to fulfill the operational purposes outlined in this policy or to satisfy legal, tax, accounting, and dispute resolution requirements under Nigerian law. Account information is retained during account activity and up to six (6) years following account termination for audit and financial compliance purposes. Geolocation logs associated with completed drop requests are anonymized after 90 days.
8. Your Rights Under the NDPA 2023
As a data subject under Nigerian law, you possess the following rights regarding your personal data:
- Right to Access: Request a copy of your personal data processed by Aerodrop.
- Right to Rectification: Request correction of inaccurate or incomplete personal information.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where processing is no longer required or consent is withdrawn, subject to legal retention obligations.
- Right to Restrict or Object to Processing: Object to processing based on legitimate interests or direct marketing.
- Right to Data Portability: Request transfer of your data to another service provider in a structured, machine-readable format.
9. Data Protection Officer and Contact Details
If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us at:
Aerodrop Technologies Limited — Data Protection Officer
99, Edet Akpan Avenue, Uyo, Akwa Ibom, Nigeria.
Email: info@aerodrop.app
Regulatory Authority: Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng