Privacy Policy

1. Introduction

This Privacy Policy explains how Veesaa (“we”, “us”, or “our”) collects, uses, shares, and protects your personal data when you use Veesaa (the “Platform”), a community carpooling coordination service. Veesaa operates in Nigeria and Canada, and this Policy applies to users in both countries.

We are the data controller (in Canada, the organisation responsible for personal information) and we handle your personal data in accordance with the privacy laws that apply to you:

• Nigeria — the Nigeria Data Protection Act, 2023 (the “NDPA”), overseen by the Nigeria Data Protection Commission (the “NDPC”).
• Canada — the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and any applicable provincial privacy laws (including Quebec’s Law 25), overseen by the Office of the Privacy Commissioner of Canada (the “OPC”) and provincial regulators. (Canadian federal privacy law is undergoing reform; we will update this Policy as the law changes.)

This Policy forms part of our Terms of Use. By using the Platform, you acknowledge the practices described in this Policy. Where we rely on your consent, you may withdraw it at any time as described below.

2. Information we collect

Account and profile data. Your name, email address, phone number, password, profile photo, and the communities you have access to (each entered via a Community Code; you may hold more than one).

Location data. The starting location you provide, pickup or meeting points you set, and any saved locations. Location data is central to matching you with relevant trips, and we treat it with particular care (see Section 6).

Trip data. Trips you post as a Host or join as a Rider, including dates, times, pickup points, seats, your record of completed rides, and requests you send or receive.

Vehicle data (Hosts). Where you offer a trip, the vehicle type, model, and colour you provide so Riders can identify the ride.

Usage and device data. Information about how you access the Platform, including device and browser information, log data, and identifiers used to recognise a returning device (for example, to personalise your greeting).

Communications. Messages, requests, approvals, declines, reports, and notifications exchanged through the Platform.

We do not intentionally collect special categories of personal data, and we ask that you do not submit such data through the Platform.

3. How and why we use your information

We use your personal data to:

• create and manage your account and validate the Community Codes you enter (communities themselves are created and managed on a separate administrative system; the Platform only reads them and checks codes);
• match Hosts and Riders by showing trips relevant to your location and destination;
• enable Users to coordinate trips, including sharing the limited information necessary for a Host and a matched Rider to find one another;
• send service communications such as requests, approvals, confirmations, and reminders;
• maintain safety, investigate reports, and prevent misuse or fraud;
• recognise returning devices to personalise your experience;
• understand demand within a Community in aggregate, to support transport planning (see Section 5); and
• operate, maintain, and improve the Platform.

4. Lawful bases for processing

We process your personal data on the bases permitted by the laws that apply to you. Under the NDPA these are set out below; Canadian law (PIPEDA and applicable provincial law) is built primarily around knowledge and consent for the collection, use, and disclosure of personal information, supported by the requirement that purposes be ones a reasonable person would consider appropriate. The bases we rely on are:

• Performance of a service — to provide the matching and coordination functions you request.
• Consent — for example, for non-essential cookies, location data, or optional features; you may withdraw consent at any time. In Canada, consent is our primary basis, and for sensitive information (such as precise location) we seek clear, express consent.
• Legitimate interests — to keep the Platform safe, prevent abuse, and improve the service, balanced against your rights.
• Legal obligation — where we are required to process or disclose data by law.

5. How we share your information

With other Users. When you and another User are matched, we share the information necessary to make the trip work — for example, a Host’s name, photo, vehicle details, pickup point, and completed-rides count are shown to a matched Rider, and a Rider’s name, completed-rides count, and pickup point are shown to the Host. Only share information through the Platform that you are comfortable other Users seeing.

With Community Admins. Admins may see demand information about their Community in aggregate and at an area level (for example, how many Users in a given area need rides) to support transport planning. We do not provide Admins with individual location tracking of Users.

With service providers. We use trusted third parties to host the Platform, deliver notifications, and provide mapping. These providers process data only on our instructions and under appropriate safeguards.

For legal reasons. We may disclose data where required by law, regulation, legal process, or to protect the rights, safety, or property of any person.

6. Location data

Because location is sensitive, we limit how it is used and shared:

• We use your location to match you with relevant trips and to enable a pickup.
• Users see pickup and meeting points, not your home address. A Host’s starting location is not exposed to Riders.
• Admins receive only aggregated, area-level demand data, never precise individual location histories.

You can choose how much location detail you provide, though limiting it may reduce the quality of matches.

7. Cookies and similar technologies

The Platform uses cookies and similar technologies that are necessary to operate the service (for example, to keep you signed in and to recognise a returning device for your greeting). Where we use non-essential cookies, we will seek your consent. You can manage cookies through your browser settings, though disabling some may affect how the Platform works.

8. Data retention

We retain your personal data for as long as your account is active and as needed to provide the service. When you close your account, we delete or anonymise your personal data within a reasonable period, except where we are required to retain certain information to comply with legal obligations, resolve disputes, or maintain safety records.

9. Data security

We apply reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. However, no system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials and Community Code confidential.

10. Your rights

Whether you are in Nigeria or Canada, you have substantially similar rights over your personal data. You have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data in certain circumstances;
• object to or request restriction of certain processing;
• request portability of data you have provided;
• withdraw consent where processing is based on consent; and
• lodge a complaint with the relevant regulator — the Nigeria Data Protection Commission (NDPC) if you are in Nigeria, or the Office of the Privacy Commissioner of Canada (OPC) (or your provincial privacy regulator) if you are in Canada.

To exercise any of these rights, contact us at privacy@veesaa.co. We will respond within the period required by the law that applies to you. You will not have to pay a fee in most cases.

11. Children’s privacy

The Platform is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected such data, we will delete it.

12. Cross-border transfers

Because Veesaa operates in both Nigeria and Canada and uses service providers that may be located in other countries, your personal data may be transferred across borders — including between Nigeria and Canada, and to providers elsewhere. Where this happens, we take steps to ensure your data receives protection consistent with the NDPA (for Nigerian users) and PIPEDA and applicable provincial law (for Canadian users) before any transfer takes place, including appropriate contractual safeguards with the parties receiving the data. By using the Platform you understand that your data may be processed outside your country of residence.

13. Changes to this policy

We may update this Policy from time to time. Where changes are material, we will take reasonable steps to notify you. The “Last updated” date at the top shows when the Policy was last revised.

14. Contact us

For questions about this Policy or to exercise your rights, contact us at privacy@veesaa.co.

You may also contact the relevant privacy regulator if you have concerns about how your data is handled — the Nigeria Data Protection Commission (NDPC) in Nigeria, or the Office of the Privacy Commissioner of Canada (OPC) or your provincial privacy regulator in Canada.