Privacy Policy

1. Introduction

Welcome to VendRush. VendRush Technologies Limited ("VendRush", "we", "our", or "us") is committed to protecting your privacy and handling your personal information responsibly, transparently, and in accordance with the Nigeria Data Protection Act (NDPA 2023). We recognise that the trust you place in us when using our platform extends beyond the products and services we facilitate. It also includes the confidence that your personal information will be collected, processed, stored, disclosed, and protected in a lawful and responsible manner.

This Privacy Policy explains how VendRush collects, uses, stores, shares, protects, and otherwise processes your personal information whenever you access or use our mobile applications, websites, APIs, customer support channels, marketing platforms, social media pages, and any other digital products or services operated by VendRush (collectively referred to as the "Platform").

This Policy also explains the choices available to you regarding your personal information, the rights you may exercise under applicable law, and the measures we have implemented to safeguard your data throughout its lifecycle.

By creating an account, accessing, browsing, or using any part of the Platform, you acknowledge that you have read, understood, and accepted this Privacy Policy. If you do not agree with this Policy, you should not access or continue using the Platform.

Nothing contained in this Privacy Policy limits any rights that you may have under applicable data protection legislation.

2. Who We Are

VendRush Technologies Limited is a technology company that operates a digital marketplace connecting customers with independent vendors and independent delivery riders for the purchase and delivery of food, groceries, pharmacy products, household items, retail products and other goods or services that may be offered through the Platform from time to time.

VendRush does not manufacture, own, produce or sell most of the products available on the Platform. Rather, we provide technology infrastructure that enables customers to discover participating vendors, place orders, make payments where applicable, communicate regarding their orders, and receive deliveries through independent delivery partners.

For the purposes of applicable privacy legislation, VendRush generally acts as the data controller in relation to the personal information collected through the Platform because we determine the purposes and means of processing such personal data. Where we share necessary order and delivery details with independent vendors and delivery partners to complete an order, such third parties process your information solely for the purpose of fulfilling the specific transaction.

3. Scope of This Privacy Policy

This Privacy Policy applies to every individual who interacts with VendRush, including customers, prospective customers, vendors, vendor representatives, delivery riders, applicants seeking to join our Platform, visitors to our websites, participants in promotions or surveys, individuals who communicate with our customer support team, and any other person whose personal information is processed in connection with our services.

This Policy governs personal information collected directly from you, automatically through your use of the Platform, from your device, through communications with us, and from carefully selected third parties where such collection is lawful and necessary for the operation of our business.

This Privacy Policy should be read together with our Terms of Use, Vendor Agreement, Rider Agreement, Cookie Policy where applicable, promotional terms, and any additional notices that may be presented to you when using particular features of the Platform. Where there is any inconsistency between this Privacy Policy and a specific privacy notice provided for a particular service, the more specific notice shall prevail to the extent of that inconsistency.

4. Definitions

For the purpose of this Privacy Policy, "Personal Information" means any information relating to an identified or identifiable natural person, whether directly or indirectly, including information that can reasonably be linked to an individual.

"Processing" includes every operation performed on personal information, including collecting, recording, organising, storing, adapting, retrieving, consulting, using, disclosing, transferring, combining, restricting, anonymising, archiving, or deleting such information.

References to "Vendor" mean businesses, merchants, restaurants, supermarkets, pharmacies, retailers, service providers, or any other commercial entities that make products or services available through VendRush.

References to "Rider" mean independent delivery personnel who use the Platform to accept and complete delivery requests.

References to "Customer" mean individuals who browse, purchase, request, or receive products or services through the Platform.

5. Our Privacy Principles

Protecting personal information is one of the principles upon which VendRush operates. Whenever we process your information, we aim to ensure that the information collected is relevant to the services we provide, that it is used only for legitimate and lawful purposes, that appropriate security safeguards are maintained throughout its lifecycle, and that you remain informed about how your information is used.

We continuously review our internal processes, operational practices, technological infrastructure, and governance framework to improve the way personal information is managed. As our products evolve, additional privacy measures may be introduced to ensure that our practices continue to meet applicable legal requirements and recognised industry standards.

6. Information We Collect

The information we collect depends on how you interact with the Platform, the services you request, the permissions you grant on your device, and the legal obligations applicable to particular transactions.

When you create an account, we may collect information such as your full name, mobile telephone number, email address, password, OTP, profile photograph where you choose to upload one, residential or delivery addresses, and other information reasonably necessary to establish and maintain your account.

As you continue to use the Platform, we may collect additional information relating to your purchases, delivery preferences, saved addresses, payment methods, transaction history, vouchers redeemed, promotional offers used, customer support enquiries, product reviews, ratings submitted, and communications exchanged with us through authorised channels.

Where identity verification becomes necessary for security, fraud prevention, legal compliance, or access to particular services, we may request additional documentation or information reasonably required to verify your identity before providing continued access to certain features of the Platform.

The information we collect may also include technical information generated automatically by your interaction with the Platform. This includes your device type, operating system, browser configuration, IP address, language preferences, application version, session information, diagnostic logs, network information, device identifiers, crash reports, and similar technical data required to maintain the security, availability, and performance of our services.

Depending on the nature of your interactions with VendRush, we may also receive information from payment service providers, identity verification providers, vendors, riders, logistics partners, customer support systems, fraud prevention service providers, advertising partners, analytics providers, or publicly available sources where permitted by law and reasonably necessary for the provision or protection of our services.

7. Location Data

VendRush collects, uses, and processes location information as an integral part of the services we provide. Location data enables the core functionality of our Platform, including identifying nearby vendors, calculating delivery distances, assigning riders, estimating delivery times, improving route optimisation, reducing failed deliveries, and maintaining the overall efficiency of our marketplace.

Types of Location Data We Collect

• Precise Location (GPS): With your explicit permission, we collect your device's precise GPS coordinates. This is used to show vendors near your current position, set your delivery location, and enable real-time tracking of your order during delivery.
• Approximate Location: Where precise location is not granted or available, we may use network-based or IP-derived approximate location to provide a degraded but functional experience, such as showing vendors within a broad area.
• Saved Addresses: Addresses you manually enter and save (e.g., home, work) are stored as part of your account profile for your convenience.
• Background Location (Riders only): Delivery riders who have accepted an active delivery request may have their location collected in the background so that customers can track their delivery in real time and our operations team can monitor active dispatches. This collection occurs only during an active delivery session and stops when the delivery is completed or cancelled.

How We Use Location Data

• Displaying vendors and stores available near you
• Calculating and displaying delivery fees and estimated delivery times
• Assigning the most suitable available rider to your order
• Enabling live order tracking on the customer and rider apps
• Verifying delivery completion at the correct address
• Detecting unusual account activity or potential fraud based on geographic anomalies
• Improving our logistics algorithms and route optimisation

Your Control Over Location Permissions

Location access is permission-based. You may grant or revoke location permissions at any time through your device settings. Please note that revoking location permissions may limit or prevent your ability to use certain core features of the Platform, such as discovering nearby vendors or enabling real-time delivery tracking. We will always request only the level of location access required for the feature you are using and will prompt you with an explanation before requesting any location permission.

We do not sell your location data to third parties. Location information shared with vendors and riders is limited to what is strictly necessary to fulfil your delivery and is not used for any other purpose.

8. How We Collect Personal Information

VendRush collects personal information through a variety of lawful channels depending on how you interact with our Platform. In many cases, the information is provided directly by you when you create an account, place an order, communicate with customer support, submit a review, participate in a promotional campaign, respond to a survey, or update your profile information. You remain responsible for ensuring that the information you provide is accurate, complete, and kept reasonably up to date throughout your use of the Platform.

We also collect certain information automatically whenever you use our applications or websites. This information is generated through your device, browser, operating system, application settings, network connection, cookies, software development kits (SDKs), application programming interfaces (APIs), server logs, and other technologies that allow us to understand how our Platform is being used, diagnose technical issues, improve performance, and protect against abuse.

In some situations, we may receive personal information from third parties. This may occur where payment processors confirm successful transactions, vendors provide information relating to your orders, riders submit proof of delivery, identity verification providers confirm your identity, fraud prevention partners alert us to suspicious activities, or where another person lawfully provides your information in connection with an order placed on your behalf.

Where permitted by applicable law, we may also receive information from publicly available sources or regulatory authorities where such information is reasonably necessary to verify identities, comply with legal obligations, investigate fraud, resolve disputes, or protect the safety and integrity of our Platform.

We do not intentionally collect more personal information than is reasonably necessary for the purposes described in this Privacy Policy. Whenever additional categories of information become necessary because of new features or legal requirements, we will update this Privacy Policy or provide supplementary privacy notices where appropriate.

9. Lawful Bases for Processing Personal Information

VendRush processes personal information only where there is a lawful basis for doing so under applicable data protection laws, including the Nigeria Data Protection Act, 2023, and any other applicable legislation.

Much of the information we process is necessary to perform our contractual obligations to you. Without processing certain information, we may be unable to create your account, facilitate purchases, process payments, assign deliveries, provide customer support, or otherwise deliver the services requested through the Platform.

In other situations, we process information because you have given your consent. For example, where we request access to certain device permissions, send optional marketing communications, conduct customer research, or introduce new services requiring additional permissions, your consent may serve as the legal basis for processing. Where processing depends on your consent, you may withdraw that consent at any time, although doing so will not affect the lawfulness of processing carried out before the withdrawal.

We also process information where necessary to comply with legal or regulatory obligations imposed upon us by applicable laws, court orders, lawful requests from government authorities, tax authorities, financial regulators, consumer protection agencies, law enforcement bodies, or other competent institutions.

Certain processing activities are carried out because they are necessary for our legitimate business interests, provided those interests are not overridden by your rights or freedoms. These legitimate interests include maintaining the security of our Platform, preventing fraud, improving our services, conducting internal analytics, resolving disputes, managing legal claims, enforcing our agreements, protecting customers, vendors, riders and the public, and ensuring the continued operation and development of our business.

Where sensitive personal information is processed, we shall do so only where permitted under applicable law and subject to appropriate safeguards.

10. How We Use Your Personal Information

VendRush processes personal information for a variety of legitimate business and operational purposes that enable us to provide, improve, secure, and expand our services.

Your information is primarily used to establish and maintain your account, authenticate your identity when necessary, facilitate purchases, coordinate deliveries, process payments, communicate important information regarding your orders, and provide customer support whenever assistance is required.

Personal information also enables us to display nearby vendors, recommend products and services that may be relevant to your location or purchasing behaviour, calculate estimated delivery times, determine applicable delivery fees, assign suitable riders, and improve the efficiency of our logistics operations.

We use information generated through your interactions with the Platform to better understand how users engage with our services. This allows us to improve application performance, identify technical issues, optimise user experience, develop new features, analyse purchasing trends, measure customer satisfaction, evaluate marketing campaigns, and improve operational decision-making across the Platform.

Certain information may also be processed to detect suspicious transactions, investigate fraudulent activity, prevent misuse of our Platform, enforce our Terms of Use and other agreements, respond to complaints, resolve disputes between users, vendors and riders, recover outstanding obligations, protect our legal rights, and maintain the security and integrity of our systems.

Where permitted by law, we may use your information to communicate service announcements, platform updates, security alerts, promotional campaigns, loyalty programmes, referral initiatives, discounts, seasonal offers, educational materials, surveys, and other information relating to VendRush or carefully selected commercial partners. You remain free to manage your communication preferences and may opt out of marketing communications at any time, although certain transactional communications will continue to be sent where necessary for the provision of our services.

From time to time, we may aggregate or anonymise information so that it can no longer reasonably identify any individual. Such information may be used for statistical reporting, research, business intelligence, forecasting, product development, operational planning, investment presentations, regulatory reporting, and other lawful commercial purposes.

11. Data Security

We aim to protect your personal information through a system of organisational and technical security measures. We have implemented appropriate internal security measures designed to protect the security of any personal information we process. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our Platform is at your own risk. You should only access the Platform within a secure environment.

12. Your Privacy Rights

Depending on your location and applicable law, you may have certain rights regarding your personal information. Under the Nigeria Data Protection Act (NDPA 2023), these may include:

• The right to access your personal information
• The right to rectify inaccurate or incomplete information
• The right to erasure of your personal information in certain circumstances
• The right to restrict or object to the processing of your information
• The right to data portability
• The right to withdraw consent where processing is based on consent
• The right to lodge a complaint with a relevant supervisory authority

To exercise any of these rights, please contact us at privacy@vendrush.com. We will respond to your request within a reasonable period and in accordance with applicable law.

13. Contact Us

If you have questions or comments about this Privacy Policy or wish to exercise any of your privacy rights, please contact our Data Protection Officer at:

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or for other operational reasons. The updated version will be indicated by an updated "Last Updated" date at the top of this page and will be effective as soon as it is accessible. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy.