MotoBites Limited

1. Scope & Applicability

This Privacy Policy applies to all individual consumers, corporate meal subscribers, website visitors, and mobile application users who access MotoBites' food ordering, corporate catering, and express delivery services across Lagos and other operational jurisdictions.

2. Information We Collect

To process transactions, fulfill deliveries, improve user experience, and deliver relevant marketing communications, we collect:

• Customer Identity & Profile Data: Full name, phone number, email address, corporate entity/employer name (for corporate meal subscriptions), and account login credentials.
• Delivery & Geolocation Data: Physical drop-off addresses, designated delivery landmarks, GPS coordinates, and real-time location telemetry during active order dispatch and fulfillment.
• Transactional & Payment Data: Order history, meal preferences, dietary or allergen specifications, itemized invoices/receipts, and tokenized payment identifiers handled via PCI-DSS certified payment processors (MotoBites does not store raw credit/debit card numbers or CVV codes).
• Technical & Usage Information: IP address, device hardware model, operating system version, browser type, interaction heatmaps, push notification tokens, and session telemetry.
• Advertising & Device Identifiers: Mobile advertising identifiers (such as Apple IDFA and Google Advertising ID / GAID), pixel tracking tags, and app event metadata used strictly for attribution, performance analytics, and targeted advertising.

3. Lawful Bases for Processing Data

Under the NDPA 2023, we process personal data under the following lawful bases:

• Performance of Contract: To authenticate orders, process payments, route dispatch riders, deliver meals to your specified location, and administer corporate meal accounts.
• Legal Obligation: To preserve financial and tax accounting records, comply with statutory audits, and cooperate with lawful regulatory orders.
• Legitimate Interests: To prevent fraud, optimize logistics efficiency, maintain food safety standards, secure our infrastructure, and assess the aggregate performance of our platform.
• Consent: To collect advertising identifiers, track behavioral events via non-essential cookies or SDKs, deliver interest-based advertisements across external platforms, and transmit direct promotional SMS/email communications.

4. Information Sharing & Third-Party Disclosures

No Sale of Personal Data: MotoBites does not sell, rent, trade, or monetize your personal data to third parties for monetary consideration. We share information solely on a confidential, need-to-know basis with vetted service providers and partners:

• Logistics & Fulfillment Partners: Independent dispatch riders and third-party delivery contractors who receive recipient names, contact numbers, and drop-off addresses strictly for executing live meal deliveries.
• Payment Processors: PCI-DSS certified electronic payment gateways and financial switches that process payment authorizations and settlements.
• Advertising & Marketing Partners (Meta & TikTok):
  • Data Disclosed: Hashed contact identifiers (such as pseudonymized email addresses and phone numbers), device advertising IDs (IDFA/GAID), IP addresses, and in-app event data (e.g., app installs, menu views, items added to cart, and completed checkouts).
  • Purpose: To serve personalized advertisements, display relevant meal and subscription promotions on Meta platforms (Facebook and Instagram) and TikTok, measure campaign conversion performance, and build custom or lookalike audience segments.
• Group Affiliates & Subsidiaries: Internal administrative units within Sujimoto Group for consolidated operational oversight, centralized cloud infrastructure, and customer support.
• Regulatory Authorities & Law Enforcement: Competent statutory agencies when legally compelled under valid court orders, statutory warrants, or enforceable regulatory directives.

5. International Data Transfers

When sharing advertising identifiers, telemetry, and event data with global technology partners such as Meta Platforms, Inc. and TikTok (ByteDance Ltd.), your personal data may be transferred, stored, and processed on servers located outside Nigeria (including in the United States, the European Union, and Singapore).

Where cross-border transfers occur, MotoBites ensures adherence to the NDPA 2023 through appropriate legal transfer mechanisms, including:

• Verification of adequate data protection safeguards in recipient jurisdictions;
• Incorporation of standard contractual clauses and binding data processing agreements with international recipients; and/or
• Your explicit, informed consent obtained prior to processing cross-border advertising identifiers.

6. Consent Management: Advertising, Profiling & Opt-Out

We respect your autonomy over personalized marketing and advertising tracking:

• Granting Consent: When you first visit motobitesnig.com or launch the MotoBites mobile app, we request your explicit consent via our cookie and tracking banner before activating non-essential advertising cookies, Meta Pixel, or the TikTok SDK. On iOS and Android devices, tracking permissions are managed via native operating system prompts (e.g., Apple App Tracking Transparency).
• Withdrawing Consent: You may withdraw your consent at any time without affecting your ability to place orders:
  • In-App / Web Settings: Toggle off “Targeted Advertising & Marketing Tracking” under your MotoBites Account Privacy Settings or Cookie Preferences center.
  • Mobile Operating System Controls: Reset or restrict your advertising identifier by navigating to:
    • iOS: Settings > Privacy & Security > Tracking (toggle off for MotoBites).
    • Android: Settings > Security & Privacy > Privacy > Ads > Delete or Reset Advertising ID.
  • Direct Opt-Out: Contact our Data Protection Officer at privacy@motobitesnig.com to request complete exclusion from custom audience hashing and direct promotional broadcasts.

7. Children's Privacy

MotoBites is designed exclusively for general commercial audiences and does not knowingly target, solicit, or collect personal data from individuals under the age of 18 without verifiable parental or guardian consent.

If we discover that an individual under the age of 18 has submitted personal information without appropriate authorization, we will immediately delete the associated account, erase stored data from our active systems, and restrict further platform access. Parents or legal guardians who believe their child has provided personal information to MotoBites may request swift remediation by contacting privacy@motobitesnig.com.

8. Data Retention & Security Architecture

MotoBites maintains technical and organizational measures designed to safeguard personal data against unauthorized disclosure, alteration, or unlawful destruction:

• Encryption Standards: All data exchanged between your browser/app and our servers is encrypted in transit using modern Transport Layer Security (TLS 1.2/1.3) protocols. Sensitive database fields are secured using industry-standard AES encryption at rest.
• Access Control: Production databases and administrative systems are governed by strict least-privilege role access, session logging, and mandatory multi-factor authentication (MFA).
• Retention Limits: Personal data is retained only for the duration necessary to maintain active customer profiles, complete order processing, settle disputes, or fulfill statutory accounting and tax retention periods under Nigerian law.

9. Data Subject Rights

Under the NDPA 2023, you retain enforceable legal rights regarding your personal data:

• Right of Access: Obtain confirmation and a machine-readable summary of the personal data we hold about you.
• Right to Rectification: Update or correct obsolete contact details, delivery addresses, or profile records.
• Right to Erasure (“Right to Be Forgotten”): Request deletion of your personal data where retention is no longer justified by contract or statute.
• Right to Object / Restrict: Object to data processing predicated on legitimate interest, or halt direct marketing and cross-context behavioral advertising.
• Right to Data Portability: Request transfer of your profile and order data in a structured, commonly used electronic format.