MotoBites Limited

1. Scope & Applicability

This Privacy Policy applies to all customers, corporate meal subscribers, website visitors, and mobile application users who access MotoBites' food ordering, catering, and express delivery services across Lagos and other operating regions.

2. Information We Collect

To process orders, optimize delivery routing, and enhance customer experience, we collect:

• Customer Identity & Profile Data: Full name, phone number, email address, company name (for corporate meal subscriptions), and account credentials.
• Delivery & Geolocation Data: Exact physical drop-off addresses, delivery landmarks, GPS coordinates, and real-time live location during active order fulfillment.
• Transactional & Payment Data: Order history, meal customizations, dietary/allergen notes, itemized receipts, and tokenized payment identifiers handled via PCI-DSS certified payment processors (MotoBites does not store raw credit/debit card credentials).
• Technical & Usage Information: IP address, mobile device model, operating system, push notification tokens, session telemetry, browser type, and interaction heatmaps.

3. Lawful Bases for Processing Data

Under the Nigeria Data Protection Act (NDPA), we process your personal data based on:

• Performance of Contract: To confirm orders, dispatch riders, deliver meals to your exact location, and handle corporate catering billing.
• Legal Obligation: To maintain financial transaction records, comply with tax requirements, and adhere to regulatory directives.
• Legitimate Interests: To optimize logistics routes, prevent fraudulent orders, guarantee food safety traceability, and improve user experience.
• Consent: To deliver promotional notifications, customized discounts, and non-essential analytical cookies.

4. Information Sharing & Third-Party Disclosures

MotoBites does not sell or lease personal data. We disclose information only on a need-to-know basis to:

• Fulfillment Logistics Partners & Dispatch Riders: Sharing delivery recipient name, phone number, and physical drop-off address solely to execute active deliveries.
• PCI-DSS Certified Payment Gateways: Secure third-party aggregators that process electronic payments and settlements.
• Group Subsidiaries & Affiliates: Authorized internal administrative units within Sujimoto Group for consolidated reporting, centralized IT infrastructure, and customer support.
• Regulatory Authorities: Law enforcement or statutory bodies when mandated by valid legal process or court order.

5. Data Retention & Security Architecture

We implement enterprise-grade technical safeguards including TLS/SSL encryption for data in transit, tokenized database storage, multi-factor authentication for operational personnel, and access-controlled cloud infrastructure. Personal data is retained only as long as necessary to maintain active customer accounts, resolve disputes, or satisfy statutory tax and corporate record-keeping limits under Nigerian law.

6. Data Subject Rights

Under the NDPA, you possess statutory rights enforceable at any time:

• Right of Access: Request confirmation of processing and obtain a digital copy of your personal data profile.
• Right to Rectification: Update inaccurate delivery addresses, phone numbers, or corporate details directly in-app or via support.
• Right to Erasure (“Right to Be Forgotten”): Request account deletion and de-indexing where legal and contractual retention periods have elapsed.
• Right to Restrict or Object: Opt out of direct marketing, promotional SMS/push notifications, or profiling.
• Right to Data Portability: Receive your order and profile information in a structured, machine-readable format.