Skip to content
ePoynt
Legal

RidePoynt Privacy Notice (Draft for legal review)

Product notice — reads together with the ePoynt Privacy Policy.

Last updated: 28 Oct 2026 (draft, not in force) Provider: ePoynt Technologies Ltd (RC 9009902), Abuja, Nigeria Scope: RidePoynt — seats on shared car trips between Kano and Abuja, for travellers, car owners, drivers and the people who refer owners.

Read this together with the ePoynt Privacy Policy, which covers security, subprocessors, hosting and your rights generally. This notice adds what is specific to RidePoynt, because RidePoynt holds data about members of the public, including children, and about where people are picked up.

⚠️ This is a draft for legal review. It is not in force.

We process personal data under the Nigeria Data Protection Act 2023 (the Act).

1. Our role

For RidePoynt, ePoynt is the data controller. This is different from most ePoynt products, where an organisation is the controller and we are its processor. RidePoynt is our own service, so we decide what it holds and why.

Car owners and drivers receive some traveller data for the trip they drive (section 6). They must use it only for that trip, under their agreement with us.

2. Whose personal data RidePoynt holds

The person who books. Name, phone number, email address, booking history, payment references, refunds, fees owed, ratings and reports. If a refund cannot reach the account you paid from, also the bank account you give us for it and, if you show an ID card for it, the record that ePoynt staff saw it, with the date and the staff member's name. We do not keep a copy of the ID card. We do not see or store card details. Paystack holds them.

Each traveller. Name, seat number, pickup and drop-off landmarks, luggage sizes, and next of kin if given. A traveller may be a different person from the one who books, and may be a child.

Car owners. Name, phone number, email address, Paystack subaccount and bank details for settlements, the car's documents and photos, inspection records, earnings, settlements, ratings and strikes. We also hold the referrer an owner names, if any.

Drivers. Name, phone number, photo, driving licence number and expiry date, identification, ratings, recorded pickup and drop-off times, and one phone position at each pickup (section 3).

Referrers. A referrer is a person who brings a new owner under the RidePoynt Owner Referral Offer. We hold their name, phone number and bank account for rewards, the referrals they made and the rewards paid. We also record that ePoynt staff checked their ID card, with the date and the staff member's name. We do not keep a copy of the ID card. The new owner gives us the referrer's name and phone number.

3. Location, specifically

RidePoynt holds three kinds of location data. We state them here rather than leave them in a database design.

  • Landmarks. Each traveller's pickup and drop-off landmark, and where the car should stop, as text. These say where a person will be at a stated time, so we treat them as personal data.
  • A map pin, only if you choose one. If you press "Use my location" or move the map, we store that pin and the nearest NIPOST Digital Postcode. If you do not, we store no position for you. The driver of your trip can open your pin in a map app on the driver's phone, such as Google Maps; the company behind that app then receives the pin.
  • One driver position per pickup. When the driver presses "Arrived", the driver's phone records its position once. We keep it as evidence if a late fee is disputed.

⛔ RidePoynt does not track anyone. There is no live map, no continuous location and no background collection, for travellers or for drivers. The trip link you can share with family shows the trip's date, status and times, not a map, and stops working 24 hours after the trip ends, whether it is completed or ends on the road.

4. Why we hold it, and our lawful basis

Section 25 of the Act lists the lawful bases for processing. We rely on these:

| Purpose | Lawful basis | |---|---| | Take bookings, hold seats, take payments and make refunds | Contract | | Arrange pickups and drop-offs, and send pickup windows | Contract | | Apply the waiting and luggage rules, and settle disputes, including the driver position at pickup | Contract, and our legitimate interest in fair and provable charges | | Check owners, drivers and cars, and keep that check current | Contract with the owner, and our legitimate interest in travellers' safety | | Pay owners, and keep ePoynt's accounts | Contract, and legal obligation | | Record referrals, and pay referrers their rewards | Contract with the referrer, and legal obligation for accounts and tax | | A map pin you choose to drop | Consent, which you can withdraw | | Next of kin, used only in an emergency | Vital interests | | Meet our legal and tax duties | Legal obligation |

We do not use RidePoynt data for advertising, and we do not sell it.

5. Children

A traveller may be a child under 18. Section 31 of the Act requires the consent of a parent or guardian to process a child's personal data.

  • An adult books for a child, and the child travels with an adult on the same booking.
  • When you book for a child, you confirm that you are the child's parent or guardian, or that you have their consent. We record that confirmation.
  • We hold only the child's name and seat, and the luggage on their seat. We do not create an account for a child or contact a child directly.

6. Who sees what

  • Travellers, and the person who books, see the driver's name and photo, and the car's make, colour and plate. We send them with the pickup window, by 8:00 p.m. the evening before the trip. The person who books gets every traveller's pickup window on the booking.
  • The driver sees, for their own trip only, each traveller's name, phone number, landmarks, any map pin, seat and luggage. That view opens at 6:00 p.m. the evening before the trip, when the trip is confirmed, and closes when the trip is completed or ends on the road, or at once when another driver takes the trip over. If ePoynt suspends the driver, it closes at once, except on a trip the driver has already started. Before 6:00 p.m., the driver sees only how many seats are sold. The driver does not see next of kin.
  • The owner sees the seats sold and the earnings for their trips. An owner who is not the driver does not see travellers' names or phone numbers.
  • A referrer learns the date of each completed trip that earns a reward, and the reward, for the 3 months of the offer. The reward shows how many seats were sold. A referrer sees no traveller's details. ePoynt staff tell a new owner this before the owner names a referrer.
  • A person you send the trip link to sees the trip's date and status, and its pickup, departure and drop-off times, until 24 hours after the trip ends, whether it is completed or ends on the road. If the car stops on the road, they see that, but not why. They see no names, phone numbers or landmarks.
  • Next of kin is seen only by ePoynt staff, and only in an emergency.
  • ePoynt staff access is least-privilege and used for support, safety, disputes and settlements.

7. Who we share it with

  • Paystack processes payments, refunds, owners' settlements and referrers' rewards. For a booking, it receives the email address of the person who books, and the amount. For a refund that cannot reach the account paid from, it receives the bank account that the person who books gives. For a reward, it receives the referrer's name, bank account and the amount.
  • The WhatsApp Business Platform, operated by Meta, carries tickets, pickup windows, driver cards, trip messages, payment links and one-time codes. They come from ePoynt's WhatsApp number, which other ePoynt products, such as FleetPoynt, also use. Meta processes the phone number and the message outside Nigeria.
  • Our email provider delivers a booking's messages, such as tickets and receipts, to the email address of the person who books.
  • The NIPOST Postcode API receives the position of a map pin, and returns the nearest Digital Postcode. Its gateway is hosted in AWS's Ireland region (eu-west-1), as reported by Space in Africa on 3 Oct 2026.
  • PoyntBooks, ePoynt's accounting product, receives daily sales totals. It receives no traveller names.
  • Authorities, when the law requires it.

8. Retention

| Data | Kept for | |---|---| | Landmarks, map pins, driver positions and next of kin | 6 months after the trip, unless a dispute about that trip is open | | Traveller names on a booking | 6 months after the trip | | Owner and driver documents, photos and inspection records | While the car or driver is listed, then 6 months | | Referrers' phone numbers, bank accounts and ID-check records | 6 months after the last reward, or 6 months after the referral if it earns none | | Booking, payment, refund, settlement and referral reward records | As long as Nigerian company and tax law require for accounting records |

After a period ends, we delete the data or make it anonymous. These periods are a first setting. We will review them, and this notice will say when they change.

9. Where it is held

RidePoynt runs on the same managed cloud infrastructure as the rest of ePoynt, outside Nigeria: application servers and databases in Singapore, and stored documents and encrypted backups in object storage under an EU jurisdiction restriction. We do not currently offer hosting inside Nigeria.

WhatsApp messages are processed by Meta outside Nigeria, and NIPOST Postcode API requests pass through a gateway in Ireland (section 7). Section 41 of the Act governs transfers out of Nigeria. Our data-processing terms set the safeguards we apply.

10. Security and breaches

The ePoynt Privacy Policy describes our security controls. If a breach of RidePoynt data is likely to put people's rights at risk, we notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as section 40 of the Act requires, and we tell the people affected without undue delay.

11. Your rights

Under the Act you may ask for access to your personal data, for correction, for deletion, for restriction, or for a copy to take elsewhere, and you may object to processing. You may withdraw a consent you gave, such as a map pin, at any time.

  • Deleting a booking record may be limited where the law requires us to keep it for accounting or tax. We will tell you which duty applies and what we can do instead.
  • If you booked for other travellers, you may make a request for them. A traveller may also write to us directly.
  • If you are not satisfied with our answer, you may complain to the Nigeria Data Protection Commission.

12. Contact

Privacy questions about RidePoynt, or to exercise a right: info@epoynt.com

ePoynt Technologies Ltd (RC 9009902), Abuja, Nigeria.