Privacy Policy

Last updated: February 2026. Compliant with NDPA and GAID 2025.

1. Data Controller

DriveRight ("we", "us") operates the DriveRight CRM and listing platform. We process personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive (GAID) 2025.

2. Data We Collect

We collect:

  • Account data: name, email, phone, role, dealership information
  • Transaction data: payments (via Paystack), subscription and billing records
  • Usage data: how you use the Platform, logs, and analytics necessary for service improvement
  • Content you provide: vehicle listings, enquiries, messages, and documents you upload

3. Lawful Bases

We process your data on the bases of: performance of a contract (providing the service), consent (where we ask for it), and legitimate interests (security, fraud prevention, and improving the Platform).

4. How We Use Data

We use your data to provide and improve the Platform, process payments, communicate with you, enforce our terms, and comply with legal obligations. We do not sell your personal data to third parties.

5. Sharing and Transfers

We may share data with: payment processors (e.g. Paystack), cloud and infrastructure providers, and where required by law. Cross-border transfers are done with appropriate safeguards as required by NDPA.

6. Data Subject Rights

You have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Request erasure (subject to legal retention requirements)
  • Restrict processing and data portability where applicable
  • Object to processing based on legitimate interests
  • Withdraw consent where processing is based on consent

To exercise these rights or to address a grievance, use our Data Subject Rights Portal (Standard Notice to Address Grievance – SNAG) or contact our Data Protection contact (see Section 9).

7. Retention and Security

We retain data only as long as necessary for the purposes described or as required by law. We implement appropriate technical and organizational measures to protect your data.

8. Nigeria Data Protection Commission

You may lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe our processing violates applicable law. See ndpc.gov.ng.

9. Contact and DPO

For privacy requests, data subject rights, or to contact our Data Protection Officer (DPO), use the contact details provided in the Platform (Settings or footer), or the Data Subject Rights form linked above.