Privacy Policy

This Privacy Policy explains how Cotean Mobility Technologies (“Cotean”, “we”, “us” or “our”) collects, uses, discloses, stores and otherwise processes personal data when you use the Cotean mobile application, website or related services (the “Platform”).

For questions or requests about personal data, contact info@cotean.com. Our registered office is 117, Alpha Mall, Ogudu, Lagos, Nigeria.

For the purposes of applicable data-protection law, Cotean is a data controller for information it processes to operate the Platform, manage accounts, administer bookings, prevent fraud and meet legal obligations. In some workflows, Cotean processes data on behalf of a Vendor, or a Vendor independently controls data it receives. The role depends on the processing activity and the law that applies.

This Policy applies to Customers, prospective Customers, Vendors and their representatives, Drivers where they interact with the Platform, and people who contact Cotean or otherwise interact with our services. Read it with the Terms of Service and any separate notice presented when you submit particular information.

The Platform provides mobility and vehicle-rental marketplace services in Nigeria. If Cotean expands into other markets, or introduces a materially different feature, this Policy may be updated.

Depending on how you use the Platform, we may collect:

• Account and contact data. Name, phone number, email address, account identifiers, profile details and account status.
• Verification data. Information needed to verify an account, a Vendor business, an authorised representative, a Driver or a compliance document. This may include identification or document images where a feature requires them. We collect only what is necessary for that purpose.
• Booking data. The selected vehicle, booking dates and times, rental duration, pickup and return details, price, booking status, Customer and Vendor communications, support records, cancellations and dispute information.
• Vendor and fleet data. Business name and contact details, registration and verification documents, vehicle details, registration documents, insurance and compliance evidence, listing photographs and videos, rates, availability and Driver assignment information.
• Payment and transaction data. Transaction references, amount, currency, payment status, refunds and settlement records. Card and bank credentials are handled by our payment providers. We do not store full card numbers.
• Device and technical data. Device type, operating system, app version, IP address, log data, diagnostic information, crash reports and security events.
• Usage data. Interactions with screens and features, navigation within the Platform, and performance information, where analytics tools are used.
• Communications and support data. Messages, feedback, complaints, reports and information you provide to customer support.
• Location data. Location information only where you give the app permission for a feature, or where you supply a location yourself, such as a pickup address. We do not continuously track your precise location.
• Preferences. Communication preferences, and a record of whether you opted in or out of marketing messages.
• Information from others. Information a Vendor supplies in connection with a Booking, a payment provider’s confirmation of a transaction, or information from a fraud-prevention or verification service where we use it lawfully.

We collect data directly from you when you create an account, complete a profile, submit a booking, upload a document, contact support or use the Platform. We also generate technical and usage records when you interact with the Platform. We receive limited transaction or verification information from service providers, and we may receive booking-related information from a Vendor.

If you provide personal data about another person, such as a Driver or an authorised representative, you must have a lawful basis to provide it, and you should make sure that person receives any notice the law requires.

We process personal data for these purposes:

• Creating and administering accounts, authenticating users and providing Platform features.
• Searching for, requesting, confirming, administering and supporting Bookings, including sharing the details a Vendor or Driver needs to perform the Booking.
• Processing payments, refunds, reconciliation and settlement, keeping transaction records, and investigating payment issues.
• Onboarding and verifying Vendors, their representatives, vehicles and Drivers, and monitoring compliance with Platform requirements.
• Providing customer support, investigating complaints and facilitating disputes.
• Detecting, preventing and investigating fraud, abuse, security incidents and unlawful activity.
• Maintaining, troubleshooting, testing, analysing and improving the Platform.
• Sending service messages, including one-time passwords, booking confirmations, changes, reminders, safety notices and support responses.
• Sending marketing communications only where the law permits and, where it is required, with your consent. You can opt out of marketing at any time.
• Complying with legal, regulatory, accounting, tax, court or law-enforcement requirements.
• Establishing, exercising or defending legal claims, and protecting the rights, safety and property of Cotean, users and others.

Depending on the processing, we rely on one or more lawful bases recognised by the Nigeria Data Protection Act 2023 and other applicable law:

• Performance of a contract, or steps you ask us to take before entering into a contract.
• Compliance with a legal obligation.
• Consent, where consent is required.
• Protection of vital interests, where that applies.
• Performance of a task in the public interest, where the law applies that basis.
• Legitimate interests that are not overridden by your rights and interests.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before you withdraw. Some information is necessary to create an account, verify a Vendor, administer a Booking or meet a legal obligation. If you do not provide that information, we may be unable to provide the relevant feature or service. Consent is not our default legal basis for every activity.

We may disclose relevant personal data to:

• Vendors and, where a Booking requires it, their authorised staff or assigned Drivers. This may include Customer contact details, booking information, pickup arrangements and relevant service requests.
• Customers, in a limited form: the Vendor and Driver information needed to identify the supplier and perform a Booking.
• Payment service providers, banks and payment processors, to authorise and reconcile transactions, refunds and settlements.
• Technology providers that support hosting, cloud infrastructure, authentication, one-time passwords, customer support, analytics, diagnostics, security and communications.
• Professional advisers, auditors, insurers and service providers, where it is reasonably necessary and subject to appropriate confidentiality and security arrangements.
• Regulators, courts, law-enforcement agencies or other parties, where the law or a valid legal process requires it, or where it is necessary to protect rights, safety and property.
• A successor or acquiring entity, in connection with a merger, restructuring or sale of the relevant business, subject to appropriate safeguards and applicable law.

We do not sell your personal data. We share only what is reasonably necessary for the relevant purpose. A Vendor or other third party may process information under its own privacy notice. Where that party decides the purposes of the processing itself, it is responsible for its own legal obligations.

Some of our service providers may store or process personal data outside Nigeria. Where personal data is transferred across borders, we take the steps required by applicable law. That includes assessing the transfer and using an appropriate legal mechanism or safeguard where the law requires one.

We keep personal data only for as long as it is reasonably necessary for the purposes in this Policy. Those purposes include account and Booking administration, customer support, fraud prevention, dispute resolution, accounting, legal compliance, and the establishment or defence of legal claims. The period depends on the type of data and the reason we hold it.

When data is no longer required, we delete it, anonymise it or dispose of it securely. We may keep it for longer where the law requires retention, a dispute is unresolved, a security need remains, or a lawful preservation requirement applies. This covers account records, verification documents, booking records, payment records, support records, analytics and security logs.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Depending on the system and the risk, these measures include access controls, least-privilege permissions, encryption in transit, secure credential handling, logging, backups, vendor due diligence and incident-response procedures.

No online service can guarantee absolute security. If a personal-data breach occurs, we will assess it, respond to it, and notify affected people and the relevant authority where the law requires us to do so.

Subject to applicable law, and to any conditions or exceptions that apply, you may have the right to:

• Be informed about how your personal data is processed.
• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete information.
• Request erasure of personal data in the circumstances where that right applies.
• Request restriction of processing in the circumstances where that right applies.
• Object to certain processing, including processing based on legitimate interests, and object to direct marketing.
• Receive certain data in a portable format, or ask for it to be transmitted to another controller, where the legal requirements are met.
• Withdraw consent where processing relies on consent.
• Not be subject to a decision based solely on automated processing, where the law gives you that right, and to request human intervention where it is required.
• Lodge a complaint with the Nigeria Data Protection Commission, or with another competent authority.

These rights are not absolute, and legal exceptions may apply. To make a request, contact info@cotean.com. We may need to verify your identity before we respond. We will respond within the time the law requires.

You can also contact the Nigeria Data Protection Commission through its official channels at ndpc.gov.ng.

The website and app may use cookies, software development kits (SDKs), analytics tools and similar technologies to keep the service secure, remember preferences, understand performance and improve your experience.

Non-essential tracking is used only where the law allows it, and in line with the choices presented to you. You can control cookies through your browser settings. Technologies that are required to operate the service, keep it secure, or remember a session may remain active.

We send essential service communications about account security, one-time passwords, Bookings, payments, refunds, support and legal notices. These are not promotional marketing.

We send marketing messages only where the law permits. You can opt out through the unsubscribe option in the message, or by contacting info@cotean.com. Opting out of marketing does not stop essential service communications.

The Platform is not directed at children. You must be at least 18 years old to create an account or make a Booking. If we learn that we have collected a child’s personal data contrary to applicable law or this age requirement, we will restrict the account and delete the data where it is lawful and appropriate to do so.

The Platform may link to third-party websites or services, including payment providers. Cotean does not control their privacy practices. Review the relevant provider’s privacy notice before you use its service. This Policy applies to Cotean’s processing. It does not replace a third party’s own notice where that party acts as an independent controller.

We may update this Policy to reflect a change in the Platform, in how we process personal data, or in the law. We will update the effective date and give notice of a material change by an appropriate means. Where the law requires it, we will obtain consent, or take another step the law requires, before the change takes effect.