Privacy Policy

This Privacy Policy explains how Hubber Technologies Limited (“Hubber”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you use the Hubber mobile application, hubber.com.ng and related services (the “ Platform”).

We are the data controller for the personal data described here. We process personal data in accordance with the Nigeria Data Protection Act, 2023 (the “NDPA”) and the guidance of the Nigeria Data Protection Commission (the “NDPC”).

This policy should be read alongside our Terms & Conditions and our Cookie Policy.

This policy applies to:

• Resellers who source and sell products through the Platform.
• Suppliers who list products on the Platform.
• Customers whose delivery and contact details are processed so an order can be fulfilled.
• Visitors to our website and applicants for accounts.

Data you give us. Your name, phone number, email address, date of birth, residential or business address, profile photo and the content of messages you send us.

Identity and verification data. Your National Identification Number (NIN) or other government-issued identification, Bank Verification Number (BVN), a photograph or selfie used for liveness checks where applicable, and for businesses, CAC registration details and Tax Identification Number (TIN). We collect this to meet our obligations under the Money Laundering (Prevention and Prohibition) Act, 2022 and applicable regulatory requirements.

Financial data. Bank account name, number and bank, payout history, wallet balance and transaction records. We do not store full card numbers, card PINs or CVVs — card details are handled directly by payment service providers licensed by the Central Bank of Nigeria.

Order and delivery data. Products ordered, prices, order status, delivery addresses, recipient names and phone numbers, delivery notes and proof of delivery.

Customer data you provide. Where you are a Reseller, the name, phone number and delivery address of the Customer you are fulfilling an order for.

Technical and usage data. Device model, operating system, app version, IP address, approximate location derived from IP, device identifiers, crash reports, pages and screens viewed, and actions taken on the Platform.

Communications. Records of your messages with our support team, in-app chat, emails, and call recordings where we tell you a call is being recorded.

• Directly from you when you register, verify, order or contact us.
• Automatically as you use the Platform, through cookies and similar technologies.
• From identity verification providers and official databases, where we check the identification details you give us.
• From payment service providers and banks, in relation to payments, settlements and chargebacks.
• From logistics partners, in relation to delivery status, delivery attempts and proof of delivery.
• From a Reseller, where they submit their Customer's delivery details in order to fulfil an order.

Under the NDPA we must have a lawful basis for each use of personal data. Ours are set out below.

To perform our contract with you — creating and managing your account; processing and fulfilling orders; arranging delivery; processing payments, wallet balances and payouts; handling returns, refunds and disputes; providing customer support.

To comply with a legal obligation — verifying identity; anti-money laundering and counter-terrorism financing screening; tax record-keeping and reporting; responding to lawful requests from courts, regulators and law enforcement.

For our legitimate interests — preventing and detecting fraud and abuse; securing the Platform; analysing usage to improve our products; managing risk; enforcing our terms and recovering amounts owed. We balance these interests against your rights and only rely on this basis where the processing is proportionate.

With your consent — marketing and promotional messages; non-essential cookies and analytics; access to device features such as your camera, photo library or contacts. You can withdraw consent at any time.

To protect vital interests or the public interest — in rare cases involving safety, unlawful conduct or an emergency.

We use automated systems to screen transactions and accounts for fraud, money laundering and breaches of our terms, and to set limits such as access to payment on delivery. These systems may automatically flag, delay, limit or decline a transaction, or restrict an account.

Where an automated decision significantly affects you, you have the right to be told about it, to ask for human review, and to contest the outcome. Contact us at hubber@hubber.com.ng to do so.

We share personal data only where necessary, with:

• Suppliers — the delivery details needed to pack and dispatch an order. Suppliers do not receive your financial data.
• Logistics partners — recipient name, phone number, delivery address and, for payment on delivery, the amount to collect.
• Payment service providers and banks — to process payments, verify accounts and settle payouts.
• Identity verification providers — to confirm the identification details you give us.
• Communications providers — to send OTPs, SMS, email and in-app notifications.
• Technology providers — hosting, storage, analytics, crash reporting and customer support tooling, acting as our data processors under written contract.
• Professional advisers — lawyers, auditors and insurers, where needed.
• Authorities — regulators, law enforcement and courts, where we are required or legally permitted to disclose.
• A buyer or successor — in connection with a merger, acquisition or sale of assets, subject to this policy.

We do not sell your personal data. We do not share it with third parties for their own independent marketing.

Where you receive another person's personal data through the Platform — for example a Customer's delivery details — you are a data controller in your own right under the NDPA. You must:

• Use the data only to fulfil that order and provide related customer service.
• Keep it confidential and secure.
• Not sell it, share it, or add it to a marketing list without a lawful basis.
• Not retain it longer than you need it.
• Comply with the NDPA, including responding to requests from the people whose data you hold.

Misusing Customer data is a serious breach of our Terms & Conditions and may lead to suspension, termination and a report to the NDPC.

Some of our service providers — for example cloud hosting, analytics and communications tools — store or process data outside Nigeria.

Where we transfer personal data abroad, we do so in line with the NDPA: to a country the NDPC recognises as providing adequate protection, or under contractual safeguards requiring the recipient to protect the data to a standard comparable to the NDPA, or where another lawful ground for transfer applies.

We keep personal data only as long as we need it for the purposes described in this policy, and then delete or anonymise it.

• Account data — while your account is active, and for a period afterwards to handle disputes and legal claims.
• Transaction, order and financial records — retained for the period required by Nigerian tax, accounting and anti-money laundering law, which is generally at least five years after the transaction or the end of the business relationship.
• Identity verification records — retained for the period required under anti-money laundering law.
• Support communications — typically retained for up to two years.
• Marketing preferences — retained until you withdraw consent, plus a record of the withdrawal itself.

Closing your account does not automatically erase records we are legally required to keep.

Under the NDPA you have the right to:

• Be informed about how your personal data is used.
• Request access to the personal data we hold about you.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to delete data, where we no longer have a lawful reason to keep it.
• Ask us to restrict processing while a concern is being resolved.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Request a copy of data you gave us in a portable, machine-readable format.
• Withdraw consent at any time, where we rely on consent.
• Not be subject to a decision based solely on automated processing that significantly affects you, without human review.
• Lodge a complaint with the NDPC.

To exercise a right, email hubber@hubber.com.ng. We will respond within 30 days. We may ask you to verify your identity first, and we may decline a request where the law allows — if we do, we will explain why.

Exercising your rights is free. We may charge a reasonable fee, or decline, if a request is manifestly unfounded or excessive.

Service messages — OTPs, order and delivery updates, payment and wallet notifications, dispute updates and security alerts — are necessary to operate your account and cannot be switched off while your account is active.

Marketing messages are sent only where you have consented. You can withdraw consent at any time using the opt-out in any marketing message, in your account settings, or by emailing us. Withdrawing consent does not affect service messages.

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls and role-based permissions, one-time password authentication, logging and monitoring, and staff confidentiality obligations.

No system is completely secure. You play an important part: keep your credentials confidential, and never share your OTP with anyone, including anyone claiming to be Hubber staff. We will never ask you for your password, OTP, card PIN or full card details.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the NDPC within 72 hours of becoming aware of it, and will inform you where the breach is likely to result in a high risk to you.

The Platform is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We use cookies and similar technologies on our website and in our app. Our Cookie Policy explains what they do and how to control them.

The Platform may link to third-party websites and services, and may integrate payment, logistics and communications providers that operate under their own privacy policies. We are not responsible for their practices, and we recommend that you read their policies before sharing data with them.

We may update this policy from time to time. Where a change materially affects how we use your personal data, we will take reasonable steps to notify you in advance through the Platform, by email or by SMS. The “last updated” date at the top of this page shows when it was last revised.

For any privacy question, or to exercise your rights, contact our data protection contact:

Hubber Technologies Limited
[insert registered office address], Lagos, Nigeria
hubber@hubber.com.ng

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC).