Policies

"Personal Data" means any information that identifies or can identify an individual.

"Processing" means any operation performed on Personal Data, including its collection, use, storage, disclosure, or deletion.

"Data Subject" means the individual to whom the Personal Data relates.

"Data Controller" means Brit Transport Company that determines the purposes and means of processing Personal Data.

"Data Processor" means a person or organisation that processes Personal Data on behalf of a Data Controller.

"Sensitive Personal Data" means Personal Data relating to matters such as health, biometric data, race, ethnicity, religion, political opinions, trade union membership, sex life, or other categories protected under applicable law.

"Cookies" means small text files placed on your device to enhance functionality, remember preferences, analyse usage, and improve your experience.

"Services" means the transport, logistics, vehicle hire, parcel delivery, website, mobile application, and related services provided by Brit Transport Limited.

"Third Party" means any natural or legal person other than the Data Subject and the Company.

We collect Personal Data through the following means:

a. Directly from You: When you create an account, book transportation services, hire a vehicle, lease a bus, request parcel delivery services, make payments, contact customer support, complete forms, or otherwise interact with our Services.

b. Automatically: When you access or use our website or mobile application, we automatically collect certain technical information through cookies, log files, device identifiers, and similar technologies.

c. From Third Parties: We may receive Personal Data from payment service providers, identity verification providers, corporate customers making bookings on your behalf, travel agents, business partners, or other third parties where permitted by applicable law.

d. From Your Device: Where you grant permission, we may collect location (GPS) data and other device-related information necessary to provide certain features of our Services, such as trip tracking, route optimisation, or nearby service availability.

e. Our vehicles, terminals, and operational facilities may be equipped with CCTV cameras, dashboard cameras, GPS tracking systems, or similar technologies which collect Personal Data for passenger safety, fleet management, security, incident investigation, and regulatory compliance.

We collect the following categories of Personal Data:

a. Identity Data: full name, date of birth, government-issued identification (for KYC compliance).

b. Contact Data: email address, phone number, residential address.

c. Booking & Travel Data: departure point, destination, travel dates, seat preferences, ticket number.

d. Payment Data: transaction references, payment method details (we do not store full card numbers; payments are processed through PCI-DSS-compliant third-party gateways).

e. Technical Data: IP address, browser type, device identifiers, operating system, access times, and usage logs collected automatically.

f. Communication Data: records of your correspondence with our customer support team.

g. Parcel Delivery Data: sender and recipient details, parcel description, and delivery instructions.

h. Emergency Contact Data: Where you voluntarily provide emergency contact details or such information is required for the provision of our Services, we may collect the name, relationship, telephone number, and other relevant contact information of your designated emergency contact.

i. Loyalty, Rewards and Promotional Programme Data: Where offered, and where you participate in any loyalty, rewards, referral, promotional, or customer incentive programme operated by us, we may collect information relating to your membership, accumulated rewards, redemption history, referrals, and participation in such programmes.

j. Customer Preference Data: We may collect information relating to your travel preferences, preferred routes, seating preferences, communication preferences, language preferences, and other information you voluntarily provide to personalise and improve our Services.

k. Accessibility and Special Assistance Data: Where you request special assistance or accessibility accommodations, we may collect information necessary to facilitate such requests, including information relating to mobility assistance, accessibility requirements, or other service-related needs.

l. Complaints and Feedback Data: We may collect and maintain records of complaints, enquiries, feedback, incident reports, investigations, and correspondence relating to your use of our Services.

m. Lost Property Data: Where you report lost or found property, we may collect information relating to the item, ownership, collection arrangements, contact details, and any supporting documentation necessary to facilitate recovery.

n. Device Notification Data: Where you enable push notifications through our mobile application, we may collect device identifiers or notification tokens solely for the purpose of delivering service notifications, booking updates, security alerts, and other communications you have elected to receive.

o. Profile Photographs: Where you choose to upload a profile photograph or other image to your account, we will process such information solely for account identification, security, or other purposes connected with the Services.

p. Biometric Data: Where applicable, and only where permitted by applicable law or with your consent where required, we may collect biometric information solely for identity verification, fraud prevention, security, or regulatory compliance.

q. Call Recording Data: Where customer service telephone calls are recorded for quality assurance, training, dispute resolution, fraud prevention, security, or regulatory compliance purposes, we may process audio recordings and related call information. Where required by law, callers will be notified before call recording commences.

Our Services are not intended to knowingly collect Personal Data directly from children except where such processing is necessary for the provision of transport services and is carried out with the consent or authorization of a parent, guardian, or other person authorized by law. Where we become aware that we have collected Personal Data from a child contrary to applicable law, we will take appropriate steps to delete such information.

We generally do not collect Sensitive Personal Data unless required by law or necessary for the provision of specific Services. Where such processing is required, we will process such data in accordance with the NDPA 2023 and any applicable regulatory requirements.

Where you do not provide Personal Data required for booking, identity verification, payment processing, or regulatory compliance, we may be unable to provide some or all of our Services.

We do not make decisions producing legal or similarly significant effects solely through automated processing. Where automated tools are used to support account verification, route optimization, booking prioritisation, pricing, operational efficiency, or fraud detection and other functions on this platform, appropriate human oversight is maintained where required by applicable law.

We process your Personal Data on the following lawful bases under the NDPA 2023:

8.1 Contractual Necessity: processing is necessary to perform the transportation, car hire, bus leasing, or parcel delivery contract you have entered into with us.

8.2 Legal Obligation: processing is required to comply with Nigerian law, including KYC obligations, tax regulations, and law enforcement requests.

8.3 Legitimate Interests: processing is necessary for fraud prevention, network security, and improvement of our Services.

8.4 Consent: where we rely on consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

8.5 To establish, exercise, or defend legal claims.

We use your Personal Data for the following purposes:

A. To process ticket bookings, reservations, and seat selections.

B. To facilitate car hire, bus leasing, and parcel delivery transactions.

C. To process payments and issue receipts.

D. To verify your identity in compliance with Nigeria's KYC requirements.

E. To send booking confirmations, trip reminders, and service notifications.

F. To respond to enquiries and provide customer support.

G. To comply with legal and regulatory obligations.

H. To detect, prevent, and investigate fraud, identity theft, duplicate accounts, suspicious payments, chargeback prevention, security incidents, and misuse of our Services.

I. To analyse usage patterns and improve our platform and services (using aggregated, anonymised data where possible).

J. To send marketing communications where you have provided consent.

K. To facilitate fleet management, vehicle scheduling, dispatch operations, route planning, traffic management, and service optimisation.

L. To promote the safety and security of passengers, drivers, employees, contractors, vehicles, terminals, and other operational facilities, including through incident monitoring and security measures where applicable.

M. To investigate accidents, security incidents, service disruptions, complaints, claims, and other operational events involving our Services.

N. To administer, process, investigate, defend, or settle insurance claims and other legal or contractual claims arising from the use of our Services.

O. To recover outstanding payments, unpaid charges, penalties, or other sums lawfully due in connection with the provision of our Services.

P. To verify compliance with our Terms of Use, Booking Conditions, and other contractual arrangements, and to detect, investigate, or prevent violations thereof.

Q. To identify, store, return, or otherwise manage lost or abandoned property found on our vehicles, terminals, or other facilities.

R. To monitor, evaluate, analyse, and improve the quality, reliability, safety, efficiency, and performance of our Services, customer support, and operational processes.

S. To comply with applicable legal, regulatory, licensing, taxation, transport, anti-money laundering, counter-terrorism financing, law enforcement, judicial, and other statutory obligations applicable to our business.

T. To generate statistical, analytical, and management information for business planning, operational improvement, demand forecasting, route optimisation, capacity planning, and strategic decision-making using aggregated or anonymised data where reasonably practicable.

We do not sell your Personal Data. We may disclose your data to:

A. Service Providers: We may disclose Personal Data to third-party service providers that process Personal Data on our behalf for purposes such as payment processing, cloud hosting, IT support, customer relationship management, and SMS or email notifications. Such service providers are contractually required to maintain the confidentiality and security of Personal Data, process it only in accordance with our documented instructions, implement appropriate technical and organisational security measures, and delete or return the Personal Data upon completion of the services, unless retention is required by applicable law.

B. Regulatory and Law Enforcement Authorities: the National Information Technology Development Agency (NITDA), the Nigeria Data Protection Commission (NDPC), the police, and other government agencies where required by law or court order.

C. Corporate Affiliates: Brit Holdings Nigeria Limited and its subsidiaries (Brit Properties, Brit Edge) for internal administrative and operational purposes, subject to equivalent data protection standards.

D. Professional Advisers: lawyers, auditors, and insurers under confidentiality obligations.

E. Business Transfers: in the event of a merger, acquisition, or asset sale, your data may be transferred; you will be notified prior to any such transfer.

We primarily process Personal Data within Nigeria. Where Personal Data is transferred outside Nigeria, we shall ensure that such transfer is subject to appropriate safeguards in accordance with the NDPA 2023, including, where applicable, Standard Contractual Clauses (SCCs), Binding Corporate Rules, adequacy decisions recognised by the NDPC, explicit consent where permitted by law, or any other lawful transfer mechanism.

We retain Personal Data only for as long as is necessary for the purposes set out in this Policy and to comply with legal obligations. In general:

A. Booking and transaction records: retained for a minimum of six (6) years from the date of the transaction, in compliance with Nigerian financial and tax laws.

B. KYC documents: retained for a minimum of five (5) years after the end of the customer relationship.

C. Technical/log data: retained for up to twelve (12) months.

D. Marketing data: retained until you withdraw consent or object to processing.

E. Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised.

Under the NDPA 2023 and NDPR 2019, you have the following rights:

A. Right of Access: to request a copy of the Personal Data we hold about you.

B. Right to Rectification: to request correction of inaccurate or incomplete data.

C. Right to Erasure: to request deletion of your Personal Data, subject to overriding legal obligations.

D. Right to Restriction: to request that we limit the processing of your data in certain circumstances.

E. Right to Data Portability: to receive your data in a structured, commonly used format.

F. Right to Object: to object to processing based on legitimate interests or for direct marketing.

G. Right to Withdraw Consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of the above rights, please contact us at info@brittransport.com. We will respond within thirty (30) days as required under the NDPA 2023. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

We implement appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. Such measures include, where appropriate:

a. SSL/TLS encryption to protect Personal Data transmitted over the internet;

b. encryption of Personal Data at rest where appropriate;

c. role-based and least-privilege access controls to ensure that access to Personal Data is restricted to authorised personnel with a legitimate business need;

d. multi-factor authentication for administrative and privileged access to critical systems;

e. audit logs and monitoring to detect and investigate unauthorised access or suspicious activities;

f. periodic security assessments, vulnerability assessments, and penetration testing of our systems where appropriate;

g. secure backup, disaster recovery, and business continuity measures to promote the availability and resilience of our Services; and

h. regular training and awareness programmes for employees and contractors who handle Personal Data.

While we take reasonable steps to protect Personal Data, no method of transmission over the internet or method of electronic storage is completely secure. Accordingly, we cannot guarantee the absolute security of Personal Data.

In the event of a Personal Data Breach, we shall comply with our notification obligations under applicable Data Protection Laws, including notifying the NDPC and affected Data Subjects where required by law.

We encourage you to contact our Data Protection Officer first so we may attempt to resolve your concerns before you lodge a complaint with the NDPC.

We process Personal Data in accordance with the Nigeria Data Protection Act 2023 and other applicable laws and regulatory requirements governing our operations. Depending on the nature of the Services provided, we may process Personal Data to comply with applicable transport and road traffic laws, taxation and financial reporting obligations, anti-money laundering and counter-terrorism financing requirements, law enforcement requests, judicial or regulatory directives, consumer protection laws, and other applicable statutory or regulatory obligations.

We use cookies and similar technologies, including:

a. Essential Cookies, which are necessary for the operation of our website and Services;

b. Analytics Cookies, which help us understand how visitors use our website and improve its performance;

c. Preference Cookies, which remember your settings and preferences to enhance your experience; and

d. Advertising Cookies, where applicable, to measure the effectiveness of advertising campaigns and deliver relevant promotional content.

Where required by applicable law, you will be presented with a cookie notice or consent banner enabling you to manage your preferences for non-essential cookies. Session cookies are generally deleted when you close your browser, while persistent cookies remain on your device until they expire or are deleted, subject to our applicable retention practices.

We do not use tracking technologies to build personal profiles for sale to third parties.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the revised Policy on our website with an updated effective date. Your continued use of our Services after such notification constitutes acceptance of the revised Policy.

For any questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact us:

Brit Transport Company (a subsidiary of Brit Holdings Nigeria Limited)

Address: Plot 8, Budo Farm Layout, Beside AP Filling Station, Ajah, Lagos, Nigeria

Email: info@brittransport.com

Phone: 02012294664