01Who we are
Route is operated by Flex Mobility Limited, 5 Bujumbura Street, Wuse 2, Abuja. Flex Mobility Limited is the data controller for the personal data described here. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC).
Questions about this policy can go to ride@route.taxi, marked “Data protection”.
02What we collect
| Type | Examples | From |
|---|---|---|
| Account | Phone number, optional email, profile photo, saved places, emergency contacts | You |
| Identity | NIN, legal name and date of birth from the NIN record, live selfie and face-match result | You and our identity verification provider |
| Driver documents | Driver’s licence, city permits, proof of address, background-check consent, guarantor’s name, phone and relationship | You and your guarantor |
| Vehicle | Make, model, plate, photos, vehicle papers, insurance; for EVs, declared range and battery level at handover | You, or Route for Route vehicles |
| Location | Pickup and drop-off, live location during trips and while a driver is online, GPS trace of each trip | Your device; the tracking device fixed to every Route car and keke |
| Trips | Requests, routes, times, distance, fares, PINs, cancellations, ratings and feedback | The apps |
| Wallet and payments | Virtual account number, top-ups, holds, charges, payouts, bank account name and number for withdrawals | You and our payment partner |
| Communications | Messages relayed through Route’s WhatsApp line, call logs (who, when, how long), support chats | You and the other party |
| Safety | SOS alerts, incident reports, strikes, route-deviation checks | You, the other party, our systems |
| Device | Device model, app version, crash data, and signals used to detect fake GPS, emulators or rooted devices | Your device |
| Passengers booked by others | Name and phone number entered by the booker | The rider who booked |
03How we use it
- To provide Route (performing our contract with you): creating accounts, matching riders and drivers, navigation, working out fares, running wallets and payouts, receipts and support.
- To keep people safe (legitimate interests and, in emergencies, vital interests): identity checks, shift selfies, trip PINs, SOS, trip sharing, investigating incidents, and preventing fraud and account sharing.
- To run the vehicle programmes (contract): assessing rental and Drive-to-Own applications, tracking payments, confirming charging at approved stations, and locating vehicles for retrieval.
- To meet legal duties (legal obligation): e-hailing licence conditions, tax and accounting records, responding to lawful requests.
- To improve Route (legitimate interests): understanding demand, planning charging stations and fixing problems, using aggregated or de-identified data where we can.
- Marketing (consent): only if you opt in. You can opt out at any time.
04Location data
Riders share location to set pickups, and during trips so that the trip can be tracked and shared. Drivers’ apps send location while they are online: about every 10 seconds when waiting, and about every 4 seconds on a trip, including in the background. Final fares are worked out from the trip’s GPS trace.
Tracking device on Route vehicles: a tracking device is fixed to every Route car and keke. It records the vehicle’s location, movement and trips at all times, whether or not the driver is online, for as long as Route owns the vehicle, including during Drive-to-Own until ownership transfers. We use it to locate the vehicle, confirm charging at approved stations, investigate incidents and recover the vehicle on default. When ownership transfers, we stop using it to monitor the vehicle.
Drivers can stop location sharing by going offline. Riders can turn off location in their phone settings, but will then need to enter pickups by hand.
05Identity and face data
We use your NIN and a live selfie to confirm you are who you say you are. Our licensed verification provider compares your selfie with the photo on your NIN record and returns a match result. Drivers also take a selfie at the start of every shift, which is compared with their onboarding photo.
Because face data is sensitive, we use it only for verification and fraud prevention, limit who can see it, and never use it for advertising. If automatic matching fails three times, a trained member of our team reviews the case by hand.
06Who we share it with
We don’t sell your personal data. We share only what is needed:
- The other party on a trip: riders see the driver’s first name, photo, rating, vehicle and plate; drivers see the rider’s first name and rating. Phone numbers are never shared.
- Service providers working for us under contract: identity verification, payments and virtual accounts, WhatsApp and SMS messaging, in-app and proxy calling, maps and routing, cloud hosting, and customer support tools.
- Guarantors and insurers, where needed for a rental or Drive-to-Own agreement or a claim.
- Regulators and authorities, such as transport regulators that license e-hailing in our cities, and the police or courts when the law requires or to protect someone’s safety.
- People you choose, such as anyone you send a trip-sharing link to, or your emergency contacts.
- A buyer or successor, if Route’s business is reorganised or sold, under the same protections.
07Transfers outside Nigeria
Some of our providers, such as maps and messaging services, may process data outside Nigeria. When that happens, we make sure the transfer is permitted under the NDPA, for example because the country has adequate protection or the provider has agreed to appropriate safeguards.
08How long we keep it
- Account and profile data: while your account is open. When you delete your account, we delete your profile, photos, documents, saved places, ratings and blocks.
- Trips, receipts and safety reports: kept after deletion for as long as the law requires for tax, accounting, regulatory and safety purposes.
- Relayed messages: kept for a limited period for safety and disputes, then deleted.
- Call logs: kept for safety and disputes. We do not record call audio.
- Vehicle programme records: kept for the life of the agreement and as long afterwards as the law requires.
You can sign up again later with the same phone number and NIN.
09How we protect it
We use encryption in transit, access controls and logging, two-person approval for refunds, and regular reviews of who can see what. Identity documents and face data are restricted to the teams that need them. No system is completely secure; if a breach affects your data, we will tell you and the NDPC as the law requires.
10Your rights
Under the NDPA you have the right to:
- be told how your data is used, and get a copy of it;
- have inaccurate data corrected;
- have your data deleted, subject to records we must keep by law;
- restrict or object to some processing, including direct marketing;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent;
- not be subject to a decision based solely on automated processing that significantly affects you; you can ask for a person to review it;
- complain to the Nigeria Data Protection Commission.
You can delete your account in the app. For any other request, email ride@route.taxi. We may need to confirm your identity first, and we aim to respond within 30 days.
11Children
Route accounts are for people aged 18 and over. A rider may book a trip for a younger passenger and is responsible for it; we collect only the passenger’s name and phone number for that trip.
12Marketing and messages
Trip messages, such as driver accepted, arrived, receipts, and safety alerts, are always on because they are part of the service. Marketing messages are optional and can be turned off in Settings at any time.
13Changes to this policy
We may update this policy as Route changes. If a change is significant, we will tell you in the app or by WhatsApp before it takes effect. The date at the top shows when it was last updated.
14Contact and complaints
To ask a question, make a request or raise a concern, contact us. If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission.