Terms & Privacy

Effective Date: 16 March 2026 (Last Updated: 16 March 2026)

Rehda Technologies Limited (“Prinstar,” “we,” “us,” or “our”) operates the Prinstar Platform. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal data in compliance with the Nigeria Data Protection Act 2023 (NDPA), including sections 24 (principles), 25 (lawful bases), 30 (sensitive personal data), Part VI (data subject rights, sections 34–39), section 40 (breaches), and Part VIII (cross-border transfers).

This Policy forms part of our Terms of Use and should be read together with them. By creating an account or placing an Order, you acknowledge that you have read and understood this Policy.

Data Controller

Rehda Technologies Limited. We act as the data controller. Where we engage Vendors or Riders, they act as our data processors under written data processing agreements.

1. Personal Data We Collect

We collect:

• Account Information: name, email, telephone number, date of birth (where provided).
• Transaction & Order Information: order history, service specifications, payment references.
• Device & Usage Data: IP address, device type, browser, cookies/analytics data, interaction logs.
• Uploaded User Content: documents, images, passport photographs (which may contain biometric data).
• Delivery Information: address, delivery codes, OTP verification data.

Sensitive Personal Data (NDPA s.30)

Passport photographs and any biometric data are sensitive personal data. We process these only with your explicit consent (separate tick-box or affirmative action) and enhanced safeguards.

2. Lawful Bases for Processing (NDPA s.25)

We process your data only where at least one lawful basis applies:

• Performance of contract (to fulfil Orders and deliver Services).
• Legitimate interests (fraud prevention, Platform improvement, security – balanced against your rights).
• Legal obligation (tax, regulatory compliance, NDPC requests).
• Consent (marketing, sensitive data processing, certain analytics).
• Vital interests (rare, e.g., emergency delivery issues).

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

3. Purposes of Processing

• Providing, fulfilling, and delivering Services.
• Account management and identity verification.
• Payment processing and fraud prevention.
• Customer support and dispute resolution.
• Platform analytics and improvement (with minimised data).
• Legal and regulatory compliance.

4. Data Sharing & Third Parties

We share personal data only on a need-to-know, minimised basis:

• Vendors & Riders: only information strictly necessary for fulfilment/delivery (contact details masked where possible).
• Service Providers (payment processors, cloud hosting, analytics): under strict data processing agreements.
• Regulatory authorities: when required by law.

We do not sell personal data.

5. Cross-Border Transfers (NDPA s.41)

Some processors (e.g., payment gateways, cloud services) are outside Nigeria. Transfers occur only where:

• the destination country has an adequacy decision, or
• appropriate safeguards (standard contractual clauses or equivalent) are in place, or
• another s.41 exception applies.

6. Data Security & Accountability (NDPA s.24)

We implement technical and organisational measures including encryption, access controls, regular audits, and staff training. We conduct Data Privacy Impact Assessments for high-risk processing (e.g., biometric services).

No system is 100% secure, but we maintain accountability through documented policies and records of processing activities.

7. Data Retention

We retain personal data only as long as necessary for the purposes listed or as required by law (e.g., tax records). Uploaded files are retained for the Order lifecycle plus a limited period for disputes. You may request deletion once no longer needed (subject to legal exceptions).

8. Your Data Subject Rights (NDPA Part VI, sections 34–39)

You have the right to:

• Access and confirmation of processing (s.34).
• Rectification of inaccurate data.
• Erasure (“right to be forgotten”).
• Restriction of processing.
• Objection to processing (including legitimate-interest processing).
• Portability of your data in a structured, machine-readable format.
• Withdraw consent at any time.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if we do not resolve your request.

We respond to requests within one (1) month (extendable by two months for complex cases) at no cost, unless the request is manifestly unfounded or excessive. Submit requests to privacy@prinstar.com.ng.

9. Personal Data Breaches (NDPA s.40)

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will:

• Notify the NDPC without undue delay and, where feasible, not later than 72 hours after becoming aware.
• Notify you directly where the breach is likely to result in high risk (unless we have taken measures that render the data unintelligible).

10. Cookies and Tracking Technologies

We use essential cookies for Platform functionality and analytics cookies (with consent where required under GAID). You can manage preferences via your browser or our consent banner.

11. Children’s Privacy

Our Services are not directed at children under 18. Where a child’s data is involved (e.g., minor’s passport photo), we require verifiable parental consent.

12. Policy Updates

We may update this Policy to reflect legal or operational changes. Material changes will be notified via the Platform, email, or in-app notice at least 14 days in advance. Continued use after the effective date constitutes acceptance.

13. Data Protection Officer (where applicable)

If we qualify as a data controller of major importance, we have designated a Data Protection Officer (DPO). Contact: privacy@prinstar.com.ng (marked “Attention: DPO”).

14. Contact

For privacy inquiries, rights requests, or complaints:

privacy@prinstar.com.ng

This Policy is governed by the laws of the Federal Republic of Nigeria.