1. Who is responsible
Newsoft PLC is the data controller for Abuja driver applications and the proposed data controller for Huber ride operations: it determines why and how the platform uses personal information. Huber’s intended address is huber.newsoftplc.net. Contact the privacy team at huber@newsoftplc.net.
This policy is designed around the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission’s General Application and Implementation Directive 2025. It explains the live driver application page, the demonstration dashboard and the intended passenger service separately.
2. Driver applications and current demo
The public driver page collects your name, email, phone number, Abuja / FCT area, vehicle make/model, year and registration plate, self-declared licence and insurance status, age confirmation and consent. Newsoft PLC stores these records in the hosting provider’s database to review your application and contact you about next steps, relying on your explicit consent. No marketing consent is requested.
Only authorised Huber administrators can view submitted records. This form does not collect NINs, BVNs, bank details, identity documents, police records, precise GPS locations or payments. Separate notices and an appropriate lawful basis will precede any later verification. Applying is not permission to start driving.
Application records expire 90 days after submission and are removed during the next application-session or admin-list processing cycle. Administrators can delete a record earlier. Email huber@newsoftplc.net with your reference to withdraw consent, request access, correct information or request deletion. Deletion from the active database does not itself erase hosting-provider recovery copies, which follow the provider’s retention and recovery rules; contact us for details.
An essential, HttpOnly session cookie lasts 30 minutes and authorises one application submission. A daily-varying hash of the requesting network address and application-session timestamps are stored for up to 24 hours, with expired rows cleared on the next session-processing cycle, to limit abuse. Hosting may also process IP addresses and technical logs. Data may be processed outside Nigeria by the hosting provider; a Nigerian domain does not determine storage location.
Bookings, sample driver applications inside the demo dashboard, reports, ratings, tips and payout records remain in the page’s memory and reset on reload. This does not apply to the public driver form described above. No real rides, document uploads, payments, authority checks, police requests or approval emails are processed.
The hosting and sign-in provider may process account information, essential cookies, IP addresses and technical logs under its own applicable privacy notices. The demo’s temporary state does not mean that hosting logs are absent. Opening an email link uses your email application and may send the information you choose to include.
Before passenger operations and sensitive verification, Newsoft PLC must finalise its retention schedule, provider arrangements, privacy impact assessment, secure verification channels and rights-request procedures. The commitments below describe the planned operating service; they do not certify that a production service is already in place.
3. Information and purposes
We will collect only information needed for the stated purpose, keep it accurate and avoid using it for an incompatible purpose without an appropriate legal basis and notice.
| Information | Purpose | Intended legal basis |
|---|---|---|
| Name, phone, email and account details | Accounts, bookings, support and driver work notices | Contract or steps requested before a contract |
| Pickup, destination, trip location and trip PIN | Matching, navigation, trip fulfilment and safety | Contract for essential trip processing; balanced legitimate interests for safety |
| Licence, identity, vehicle and clearance records | Driver eligibility and safety review | Documented basis for each check; specific consent where applicable |
| Payment references, cash fares, bank payout details and tips | Receipts, weekly settlements and cash commission deductions | Contract; legal obligation where a specific accounting or tax rule applies |
| Ratings, reports, support messages and technical logs | Service quality, dispute resolution and fraud prevention | Contract where needed for support; balanced legitimate interests for security and quality |
| Optional marketing preferences | Promotional messages | Separate opt-in consent, withdrawable at any time |
Providing required booking or eligibility information is necessary to offer that service. Declining optional marketing does not affect access. Device permission is a technical permission and does not replace the legal basis for processing. We will document the necessity and balance of any legitimate-interest use.
Tips are voluntary. Records distinguish fares, cash already received by drivers, commissions and tips so weekly statements can be checked. Payment providers handle payment credentials; Huber should receive only the references and limited details needed for reconciliation.
4. Driver verification and final police clearance
Driver onboarding includes an email address. The planned process verifies NIN through NIMC or an authorised channel, verifies the driving licence through FRSC or its authorised channel, and checks vehicle and insurance records. A Nigeria Police Force background check is the final clearance before management approves work and sends an approval notice to the driver.
Before each authority request, the driver will receive the purpose, required fields, recipient and legal basis. We will seek specific consent when applicable and use authorised processes. These checks are Huber’s proposed safety process; this policy does not assert that every check is legally mandatory.
Access to NIN, licence and clearance information will be restricted to authorised verification staff. Passengers will not receive these documents. We will prefer a verification outcome and reference over retaining full identity or background files. Biometric identification or other sensitive personal data requires an additional lawful condition and safeguards before use.
A driver may challenge inaccurate information or request human review of rejection, suspension or clearance decisions. Management must review the outcome before work approval; a rating alone will not automatically authorise or disqualify a driver.
5. Sharing information
Passengers and assigned drivers receive the details needed for their trip, such as first name, pickup, vehicle identification and relevant trip contact information. Drivers’ identity documents, bank details and police records are not shown to passengers. Shared trip links should disclose only the information needed by the trusted recipient and expire after their purpose ends.
Authorised hosting, communications, maps, payments and verification providers may process limited information under appropriate agreements. Issuing authorities and police may act under their own legal duties and privacy rules. Staff access will follow job responsibilities. Information may be disclosed for a valid legal demand or genuine emergency where a lawful basis applies, with the scope recorded and limited.
Huber will not sell personal information. Ratings shown to other users will exclude unnecessary identifying details. Public ratings will not display a passenger’s private contact information.
6. Location and cookies
The intended live service uses location for pickup, navigation and active trip safety. Continuous background tracking outside an active service requires a separate, clearly explained need and appropriate permission. You can enter a pickup manually where supported. Denying necessary location access may limit navigation or safety features.
The demo does not obtain GPS location or use advertising or analytics trackers. A sidebar preference cookie may remember the menu state; hosting and authentication may also require essential cookies. Any future optional analytics or advertising cookies will be explained and controlled before activation where consent is required.
7. Retention
The public driver form stores real application records under the 90-day rule in section 2. Sample application records inside the dashboard demo reset on reload. For the live service, we will keep personal information only as long as needed for its purpose, applicable legal requirements and genuine disputes, then securely delete or anonymise it.
The retention schedule will distinguish active accounts, rejected applications, verification evidence, detailed location history, incident reports and financial records. Raw identity material should be removed once verification and any necessary review are complete, retaining the minimum outcome and reference. Detailed location history should have a shorter retention period than financial receipts. A legal hold may delay deletion of relevant records, with access restricted.
You may request the applicable retention period or its determining criteria. Exact operational periods will be published before sensitive onboarding and ride processing begin.
8. Your rights
Subject to applicable legal conditions, you may request access, correction, erasure, restriction, portability, object to processing and withdraw consent. You may also request review of a decision based solely on automated processing that has a legal or similarly significant effect. Withdrawal does not undo lawful processing already carried out.
Email huber@newsoftplc.net with the subject “Privacy request”. Describe what you need and provide a contact method. Do not email your full NIN, licence image, password or payment PIN. We will verify identity proportionately, respond within the applicable statutory period and explain any lawful limitation or extension.
You can complain directly to the Nigeria Data Protection Commission. You do not have to contact Huber first.
9. Security and breaches
The live service will require encrypted communications, access controls, staff confidentiality, verification audit logs and incident response procedures proportionate to risk. Sensitive verification information must be separated from routine trip information. No system can guarantee absolute security.
We will assess and record personal data breaches. Where a breach is likely to create a risk to individuals’ rights and freedoms, we will notify the NDPC within 72 hours of becoming aware. Where it is likely to create a high risk, affected individuals will be informed immediately as required by law, with practical protective steps.
10. International transfers
A Nigerian domain does not establish that all data stays in Nigeria. Hosting and service providers may process information outside Nigeria. Before live transfers, we will identify the destination and recipient and establish an adequate level of protection or another permitted transfer ground under the Act, document safeguards and provide the relevant information on request.
11. Children
Huber account registration and driver onboarding are intended for adults aged 18 or over. Do not submit a child’s personal information through the platform. If we learn that a child’s information has been collected improperly, we will take appropriate steps to remove it or otherwise handle it lawfully.
12. Changes and contact
Material changes will be announced before new processing begins. The date at the top identifies the current version. A changed policy is not a substitute for obtaining new consent when required.
Privacy and platform contact: huber@newsoftplc.net.