1. Data Controller
Chyft Mobility Technologies Ltd is the designated data controller responsible for the personal information collected through the Chyft mobile applications, websites, and terminal logistics consoles across Nigeria.
2. Information We Collect
Passenger Information: Full name, telephone number, email address, emergency contact details, and travel itinerary history.
Payment Details: Transaction reference IDs, settlement dates, and virtual bank account numbers. Card payments are tokenized securely through our licensed payment partner Paystack. We never store credit or debit card PAN numbers, CVV security codes, or banking PINs on our servers.
Telematics and Location: Coarse and precise geographic location data during active trips to power live trip sharing, emergency SOS triggers, and manifest auditing.
Cameras and recordings: Images or video from cameras on some vehicles. Some of those cameras use a flash. Photos or short clips you take in the passenger or driver app when you scan a boarding pass, add a profile photo, or upload a document.
Driver and Partner Data: National Identity Number (NIN), driver license details, biometric verification data, background check records, vehicle registration, and bank account details for weekly settlement.
3. Cameras and recording
Some Chyft vehicles have cameras. Some of those cameras use a flash. A camera may record the cabin, the road, or the bay. Not every vehicle has a camera.
The passenger app and the driver app may also use the phone camera when you scan a boarding pass, take a profile photo, or upload a document. The apps do not keep a continuous video of the trip from your phone.
Someone else on the trip may record with their own phone. That recording is theirs unless they send it to us for an incident.
Identifiable images are personal data under the Nigeria Data Protection Act 2023. We process them to keep passengers, drivers, and the fleet safe, and to review incidents. The lawful bases we rely on are our legitimate interest in securing the fleet, and, where someone is at risk, vital interest.
We do not sell this footage. We may share it with a safety or law-enforcement agency where Nigerian law requires, or with a court. We keep it only as long as needed for that safety purpose, a legal claim, or a legal duty.
Questions go to the Data Protection Officer at dpo@chyft.com.ng.
4. Lawful Basis and Purpose of Processing
We process your personal data under the lawful bases defined by the NDPA 2023, including contractual necessity to fulfill transport reservations, legal obligation under Nigerian road safety regulations, and our legitimate interest in securing our fleet and preventing fraudulent transactions.
5. Data Sharing and Third Parties
We do not sell, rent, or trade your personal data. We disclose information strictly to:
- Assigned drivers and terminal coordinators to verify passenger boarding passes.
- Payment gateway providers (such as Paystack) to authorize and clear transit fares.
- Federal highway safety and security agencies (such as FRSC) where mandated by law or in emergency rescue scenarios.
6. Data Retention and Security
We implement bank-grade encryption in transit (TLS 1.3) and at rest (AES-256). Personal trip records are retained only for as long as necessary to comply with tax, statutory reporting, and passenger manifest auditing guidelines under Nigerian law.
7. Your Rights Under the NDPA 2023
As a data subject in Nigeria, you hold the legal right to request access to your personal data, rectify inaccuracies, request deletion of non-statutory records, restrict processing, and lodge complaints with the Nigeria Data Protection Commission (NDPC).
To exercise any of these rights, contact our Data Protection Officer directly at dpo@chyft.com.ng. Account deletion steps are on the Delete your account page.