Legal
Privacy Policy
This policy explains what personal data Kelu collects, why, who we share it with, and the rights you have over it. We handle your data in line with the Nigeria Data Protection Act 2023 (“NDPA”) and guidance from the Nigeria Data Protection Commission (“NDPC”).
About this policy
This policy applies to the Kelu customer and rider apps, our website at getkelu.com, and any service that links to it. It sits alongside our Terms of Service, Rider Agreement and Cookie Policy.
Who controls your data
The data controller is ED’S GO LTD, registered in Nigeria with registration number 9582169, registered office at 23, Chief Imam Street, Agric, Epe, Lagos State, Nigeria. For any privacy matter, contact our data protection contact at [email protected].
Information we collect
Information you give us
- Account details, name, email address, phone number, and the role you use (customer or rider).
- Delivery details, pickup and drop-off addresses, recipient contact details you enter, item descriptions and handling notes.
- Rider verification (riders only), identity and KYC documents, bike details, plate number, working zones and bank account details for payouts.
- Communications, in-app chat messages, ratings, reviews, and messages to our support team.
Information we collect automatically
- Location data, precise location while you are booking or while a Rider is delivering (see the Location data section).
- Device & usage data, device type, app version, identifiers, push notification tokens, and how you use the app.
- Transaction data, order history, fares, wallet top-ups and balances, and payment status (we do not collect full card numbers).
- Diagnostics, crash reports and error logs that help us fix problems.
How we use your data
- To create and manage your account and verify Riders;
- To match orders with Riders and complete deliveries;
- To process payments, wallet top-ups, refunds and Rider payouts;
- To show live tracking and send order and account notifications;
- To provide support and resolve disputes;
- To keep the Service safe and prevent fraud and abuse;
- To improve and develop the Service; and
- To meet legal, tax and regulatory obligations.
Our legal bases
Under the NDPA, we rely on these lawful bases to process your data:
- Performance of a contract, to provide the Service you ask for.
- Consent, for example, precise location and certain marketing; you can withdraw consent at any time.
- Legitimate interests, to secure the Service, prevent fraud and improve our product, balanced against your rights.
- Legal obligation, to comply with applicable laws, including tax and record-keeping.
Payment information
Card payments and wallet top-ups are processed by Paystack, a licensed payment processor. Paystack collects and handles your card details directly under its own privacy terms; we do not store your full card number. We keep records of transactions (amount, status, reference) needed to operate wallets, refunds and payouts.
Location data
We use precise location to set pickup points, calculate fares, match nearby Riders and show live tracking during a delivery. The Rider app collects location while a Rider is online or on a delivery so customers can track progress. You can control location permissions in your device settings, though some features will not work without location.
How we share data
We share data only as needed to run the Service:
- Between customers and Riders, to complete a delivery, a Rider sees the pickup/drop-off and the contact details needed; you see the Rider’s name, vehicle and live location. Please share only what a delivery requires.
- Service providers, the trusted processors listed below, who act on our instructions.
- Legal & safety, authorities, regulators or advisors where required by law or to protect people, property or the Service.
- Business transfers, a buyer or successor if the business is sold or reorganised, under appropriate safeguards.
We do not sell your personal data.
Service providers
We use the following providers to run Kelu. Each processes data only as needed for its function:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, app backend & hosting | Account, order, wallet & profile data |
| Paystack | Payments & rider payouts | Payment & bank details, transaction records |
| Mapbox | Maps, geocoding & routing | Addresses & location data |
| ZeptoMail | Transactional & sign-in emails | Email address, message content |
| Sentry | Crash & error reporting | Device & diagnostic data |
| Cloudflare | Domain (DNS) & security | Network/technical data |
| Expo / EAS | App delivery & updates | Device & app data |
| Firebase Cloud Messaging (FCM) | Push notifications | Push token, device data |
Keep this list current as your stack changes. If you add analytics or a new processor, add it here and reflect it in the Cookie Policy.
International transfers
Some of our providers store or process data outside Nigeria. Where data is transferred abroad, we take steps required by the NDPA to ensure it remains adequately protected, including relying on adequacy decisions or contractual safeguards with the provider.
How long we keep data
We keep personal data for as long as your account is active and as needed to provide the Service. After that, we keep certain records, for example, transaction and tax records, for the periods required by law, then delete or anonymise the rest. Indicative periods: we keep transaction and tax records for 6 years, and delete or anonymise inactive accounts after 24 months.
How we protect data
We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and row-level security on our database. No system is perfectly secure, but we work to keep risks low and will notify you and the NDPC of a personal data breach where the law requires.
Your rights
Under the NDPA you have the right to:
- access the personal data we hold about you;
- correct inaccurate or incomplete data;
- ask us to delete your data, subject to legal limits;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time; and
- lodge a complaint with the NDPC.
To exercise any right, contact [email protected]. We will respond within the time the NDPA allows.
Children
Kelu is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
Cookies
Our website uses cookies and similar technologies, and our apps use device identifiers and SDKs. See our Cookie Policy for details and how to manage them.
Changes to this policy
We may update this policy from time to time. We will post the new version here and update the date above. If changes are significant, we will tell you through the app, by email or on our website.
Contact & complaints
For privacy questions or to exercise your rights:
ED’S GO LTD, Data Protection
23, Chief Imam Street, Agric, Epe, Lagos State, Nigeria
Email: [email protected]
Phone: +234 805 998 8084
If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission (NDPC).