Privacy Policy

SpotnHop Mobility Inc., together with its operating subsidiaries and affiliates (collectively referred to as "SpotnHop", "we", "us", or "our"), operates as the Data Controller responsible for the processing of your personal information under the Nigeria Data Protection Act (NDPA) and applicable data protection frameworks.

This Privacy Policy applies to all individuals who interact with SpotnHop's ecosystem, including:

• Executive Guests & Corporate Rentees: Individuals who book on-demand transfers, hourly charters, or vehicle hires via the SpotnHop Customer App or web portal.
• Protocol Chauffeurs: Professional drivers registered on the SpotnHop Chauffeur platform who deliver transportation services.
• Fleet Hosts: Individual and institutional vehicle owners who list luxury vehicles on the SpotnHop Host platform.
• Website Visitors: Users accessing spotnhop.com and related web applications.

We collect personal data directly from you, automatically through your device interactions, and from verified third-party partners.

Precise geolocation is an indispensable operational foundation of the SpotnHop platform:

• For Guests: We capture your pickup and destination coordinates to calculate transparent upfront fares, match you with the nearest protocol chauffeur, and transmit live arrival updates. Location capture for guests occurs exclusively while the application is actively in use or during an active reservation.
• For Chauffeurs: The SpotnHop Chauffeur application collects continuous precise location telemetry, including in the background when the app is minimized or the screen is locked, whenever the chauffeur is toggled "On Duty". This enables continuous turn-by-turn routing, accurate customer ETA alerts, automated trip lifecycle milestone tracking, and emergency security dispatch.
• For Hosts: Fleet host vehicles are monitored via encrypted hardware telemetry to verify vehicle pickup, enforce geofence operational boundaries, and provide 24/7 anti-theft asset security.

When you order refreshments, artisan dining, or bespoke amenities through the In-Ride VIP Concierge, we collect:

• Selected food and beverage items, including specialty brands and quantities.
• Disclosed dietary restrictions, allergies, and delivery instructions.
• Delivery staging logs indicating pre-stocking verification at the dispatch center prior to chauffeur departure.

Concierge data is retained solely to fulfill your active booking and enhance subsequent tailored travel profiles.

We only collect and process personal data where we have a lawful basis:

• Performance of Contract: Processing required to fulfill bookings, calculate fares, dispatch chauffeurs, process payouts to hosts, and provide customer support.
• Legal & Regulatory Obligations: Compliance with statutory accounting standards, anti-money laundering (AML) directives, transport licensing requirements, and court orders.
• Legitimate Interests: Preventing fraudulent transactions, maintaining physical security of luxury fleet assets, training protocol staff, and refining telemetry algorithms.
• Consent: Where you have granted explicit consent, such as for promotional communications or optional in-ride preference customization.

SpotnHop operates a specialized tripartite marketplace. Data is shared selectively between parties strictly on a need-to-know basis:

• Between Guest and Chauffeur: The chauffeur receives the guest's first name, pickup location, destination, and selected concierge preferences. Phone calls are masked through encrypted VoIP routing; personal numbers are never exposed.
• Between Host and Vehicle: The vehicle host receives trip timestamps, odometer telemetry, and vehicle health metrics, but does NOT receive passenger names or personal travel histories.
• Third-Party Processors: We partner with industry-leading infrastructure providers:
  • Payment Processors: Paystack, Flutterwave, Stripe (PCI-DSS Level 1 certified).
  • Mapping & Navigation: Mapbox, Google Maps Platform.
  • SMS & Telephony: Twilio (with number masking).
  • Cloud Infrastructure: Amazon Web Services (AWS) and Microsoft Azure with SOC 2 Type II certification.

We do not sell, rent, or monetize your personal data with advertising brokers or data brokers under any circumstances.

All payment card transactions on SpotnHop are processed directly through PCI-DSS Level 1 compliant payment gateways. SpotnHop does not store, process, or transmit full primary account numbers (PAN), CVV codes, or card PINs on our servers.

We retain only tokenized payment identifiers and truncated card information (last 4 digits and expiration date) for billing verification and receipt generation. Pre-authorization holds for security deposits are handled securely via gateway tokenization.

SpotnHop primarily operates within Nigeria. To ensure continuous high availability and automated off-site backups, your encrypted data may be processed through enterprise cloud infrastructure regions operated by AWS and Microsoft Azure.

When transferring data internationally, we employ statutory transfer mechanisms, including the Nigeria Data Protection Commission (NDPC) Whitelist, Standard Contractual Clauses (SCCs), and binding corporate data processing agreements to guarantee equivalent levels of security.

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Active Accounts: Maintained for the duration of your active registration.
• Trip & Telemetry Logs: Granular GPS coordinates are aggregated or anonymized after 90 days, retaining only summary distance, duration, and fare data for reporting.
• Financial & Tax Records: Retained for seven (7) years following transaction completion in accordance with corporate statutory accounting requirements.
• Verification Documents: Deleted within thirty (30) days following account deactivation, unless retention is mandated by law enforcement hold.

SpotnHop maintains an institutional defense-in-depth security architecture:

• End-to-end encryption for data in transit using TLS 1.3 cryptographic protocols.
• AES-256 bit encryption for all persistent data at rest.
• Role-Based Access Control (RBAC) restricting customer record access to authorized concierge dispatch and security personnel only.
• Mandatory multi-factor authentication (MFA) across all administrative tools.
• Continuous intrusion detection and third-party penetration testing.

Depending on your location, you possess statutory rights regarding your personal data:

• Right to Access: Request a copy of the personal data SpotnHop holds concerning you.
• Right to Rectification: Update inaccurate or incomplete profile records.
• Right to Erasure ("Right to be Forgotten"): Request the permanent deletion of your account and associated personal data. You may execute this directly at spotnhop.com/delete-account.
• Right to Data Portability: Obtain your personal travel and payment records in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or direct communications.

If you have questions, feedback, or wish to exercise your legal rights regarding your personal data, please contact our Data Protection Office: