Privacy Policy
Effective: March 17, 2026 · Compliant with the Nigeria Data Protection Act 2023 (NDPA 2023)
1. Introduction
AutoPaddy NG (“AutoPaddy”, “we”, “us”, “our”) is committed to protecting your personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA 2023) and all applicable Nigerian data protection regulations. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights as a data subject.
2. Data Controller
AutoPaddy NG is the Data Controller responsible for your personal data.
- Company: AutoPaddy NG
- Address: Lagos, Nigeria
- Data Protection Officer: privacy@autopaddy.com
3. Data We Collect
| Category | Examples | Legal Basis (NDPA 2023) |
|---|---|---|
| Identity | First name, last name, date of birth | Contract performance |
| Contact | Email address, phone number | Contract performance |
| Vehicle | Plate number, VIN, make, model, year | Contract performance |
| Document | Document type, expiry date, uploaded files | Contract performance |
| Financial | Payment reference, transaction history, wallet balance | Legal obligation (CBN) |
| Technical | IP address, browser type, session tokens | Legitimate interest (security) |
| KYC | Government-issued ID (agents only), business registration | Legal obligation |
| Waitlist preferences | Signup role, state, documents you renew, renewal habits, biggest pain point, willingness to pay, your queue position | Consent |
4. How We Use Your Data
- Renewal processing: Matching users with agents and facilitating document renewals.
- Payments & escrow: Processing payments via Paystack (CBN-licensed) and holding funds in escrow.
- Reminders: Sending document expiry reminders via email.
- Agent matching: Showing users available agents in their state and LGA.
- Fraud prevention: Monitoring for fraudulent transactions and disputes.
- Regulatory compliance: Meeting CBN, FIRS, and other applicable Nigerian regulatory requirements.
5. Data Sharing
- Paystack: We share payment data with Paystack (a CBN-licensed PSP) to process transactions.
- Agents: We share your state, LGA, and document type with agents when you post a job. Full details are only shared after an agent accepts your job.
- Government agencies: We may share information as required by FRSC, LASDRI, or other regulatory bodies for verification purposes.
- Law enforcement: We will disclose data when required by a valid Nigerian court order or law enforcement request.
- We do not sell your personal data to any third party for marketing or commercial purposes.
6. International Transfers
Where personal data is transferred outside Nigeria, we ensure appropriate safeguards are in place in accordance with Section 43 of the NDPA 2023, including standard contractual clauses or adequacy decisions where applicable.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | 7 years after account closure (CBN requirement) |
| Payment records | 7 years (CBN AML/CFT requirement) |
| Renewal records | 5 years |
| KYC documents | 5 years after last transaction |
| System/security logs | 90 days |
8. Your Rights
Under the NDPA 2023, you have the following rights:
- Right of access: request a copy of the personal data we hold about you.
- Right to correction: request correction of inaccurate or incomplete data.
- Right to deletion: request deletion of your data (subject to legal retention obligations).
- Right to object: object to processing based on legitimate interest.
- Right to data portability: receive your data in a structured, machine-readable format.
- Right to withdraw consent: where processing is based on consent, you may withdraw at any time.
- Right to lodge a complaint: contact the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
We will respond to all verified requests within 30 days. Submit requests to privacy@autopaddy.com.
9. Cookies
We use cookies and browser storage for platform functions:
- Essential cookies: Required for authentication (JWT session management) and platform security. These cannot be disabled.
- Appearance preference: We save your light, dark or device-theme choice so it stays consistent as you move between AutoPaddy pages. You can change this choice using the theme control.
10. Data Security
- All data in transit is encrypted using TLS 1.2+.
- Data at rest is encrypted using AES-256.
- Access to personal data is controlled by role-based access control (RBAC).
- We conduct regular security audits and penetration tests.
- In the event of a data breach, we will notify affected users and the NDPC within 72 hours of becoming aware, in accordance with the NDPA 2023.
11. Contact & Complaints
For privacy enquiries or to exercise your rights, contact our Data Protection Officer at privacy@autopaddy.com.
To file a complaint with the Nigeria Data Protection Commission: ndpc.gov.ng.