Privacy Policy

Version of 2 November 2026

1. 1. Who is responsible

   For data about a Customer’s staff, drivers and operations, the Customer is the data controller and LODIM processes the data on its behalf (data processor). For data about our Customers’ contacts used for billing and account management, LODIM is the controller.

2. 2. What we process

   • Account data: name, staff ID, email, phone number, job title, role and sign-in history.
   • Operational data: vehicles, drivers and their licences and documents, assignments, maintenance, fuel, journeys, inspections and incident notes, entered by the Customer.
   • Location data: the position of a driver’s phone, only while that driver’s journey is on the road and only after the driver has consented in the app.
   • Device and technical data: push notification tokens, IP address, browser or device type, and an audit trail of actions.
   • Billing data: the Customer’s company details, invoices and payment records. Card details are handled by our payment provider and never reach us.

3. 3. Why we process it

   • To provide the service the Customer subscribed to (contract).
   • To keep journeys safe: live tracking, route deviation and road alerts (the Customer’s legitimate interest and duty of care, and the driver’s consent for phone location).
   • To secure the service, prevent abuse and keep an audit trail (legitimate interest).
   • To invoice and collect payment (contract and legal obligation).

4. 4. Who we share it with

   We use carefully chosen service providers who process data only on our instructions: hosting and database providers, email delivery, SMS delivery (Africa’s Talking), maps and traffic (Google Maps Platform), mobile push notifications (Expo, Google and Apple), and payments (Paystack).

   We do not sell personal data and do not use it for advertising.

5. 5. Transfers outside Nigeria

   Some providers process data outside Nigeria. Where they do, we rely on safeguards permitted by the NDPA, such as contractual protections and providers with adequate data protection.

6. 6. How long we keep it

   • Phone positions: 12 months, then deleted automatically.
   • Operational records and the audit trail: for the life of the Customer’s subscription, and up to 90 days after it ends (longer only where the law requires).
   • Invoices and payment records: as long as tax law requires.

7. 7. Security

   Data is encrypted in transit, access is limited by role and organisation unit, passwords are stored only as strong one-way hashes, and every change is recorded in an audit trail that cannot be edited.

8. 8. Your rights

   Under the NDPA you may ask to access, correct or delete your personal data, object to or restrict its processing, receive it in a portable format, and withdraw consent (for example, to location sharing, in the app) at any time.

   If you are a Customer’s staff member or driver, please contact your employer’s AutoRoute360 administrator first, since your employer controls that data; we will help them respond. You may also complain to the Nigeria Data Protection Commission.

9. 9. Changes and contact

   We may update this policy; each version is dated and we tell Customers about material changes. For privacy questions, contact LODIM Global Services LTD. through your AutoRoute360 representative.