Privacy Policy

Qoray Mobility and Energies Limited (QMEL) · Version 1.0 · Effective 30 June 2026

1. Introduction

Qoray Mobility and Energies Limited (QMEL, we, us or our) is committed to protecting the privacy and personal data of every individual who uses DriPA, the Driver Performance and Assurance Platform (the Platform). This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how we protect it, and what rights you have under the Nigeria Data Protection Act 2023 and applicable directives issued by the Nigeria Data Protection Commission (NDPC).

This Privacy Policy applies to the DriPA Driver Mobile Application, the Business and Operator Portal, the Super Admin Portal, our website, and all related services. By registering for or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

2. Who We Are

QMEL is the data controller responsible for personal data processed through the Platform. We act as a data controller in respect of driver identity, scoring, and earnings data, and may act as a joint controller or data processor in respect of certain trip data received from Operator platforms, depending on the specific data sharing arrangement in place.

3. Personal Data We Collect

3.1 Identity and Onboarding Data

Full name, date of birth, phone number, home address, and email address.
Bank Verification Number (BVN) or National Identification Number (NIN).
Government issued identification documents, and vehicle documentation, where applicable.
Information from approved operator applications approved and onboarded on the system.

3.2 Operator and Trip Data

Trip records, cancellations, ratings, and other performance data received from linked Operator platforms, such as Cabzero, once you connect your driver account.

3.3 Telematics and Location Data

Driving behaviour data collected through the telematics software development kit while the application is active during a trip, including speed, braking, acceleration, route, and approximate location.

3.4 Financial, Credit, and Earnings Data

Earnings, bonus, and compensation history generated within the Platform.
Where Credit pillar scoring is active, credit history information obtained from licensed credit bureaus and credit information providers, including CRC Credit Bureau, subject to your consent and applicable bureau terms.
Subscription and billing information for Operators and corporate clients, where applicable.

3.5 Technical and Usage Data

Device identifiers, application version, log data, crash reports, and general usage analytics collected to maintain and improve the Platform.

4. How We Use Your Personal Data

We process personal data for the following purposes, each grounded in a lawful basis recognised under the Nigeria Data Protection Act 2023, including performance of a contract with you, compliance with a legal obligation, our legitimate interests, or your consent, as applicable.

To verify your identity and activate your driver account, in compliance with our identity verification and Know Your Customer obligations.
To verify your operator account and drivers operating under your business.
To calculate your composite score, pillar scores, tier classification, and associated earnings multipliers.
To calculate and display compensation, bonuses, and payslip information.
To detect and prevent fraud, scoring manipulation, and other prohibited conduct.
To respond to disputes you raise regarding your score or earnings, and to maintain an audit trail of related decisions.
To send you score summaries, tier change alerts, payment notifications, and service related communications by push notification, SMS, or email.
To comply with applicable Nigerian law, including financial services, data protection, and regulatory reporting obligations.
To improve the Platform, including its scoring methodology, through aggregated and, where possible, de identified analysis.

5. How We Share Your Personal Data

We do not sell personal data. We share personal data only as reasonably necessary for the purposes described in this Policy, and always subject to appropriate contractual or regulatory safeguards, with the following categories of recipients.

Operator platforms with which you have linked your driver account, for the purpose of trip data exchange and performance verification.
The telematics service provider, for the purpose of collecting and processing driving behaviour data.
Licensed credit bureaus, including CRC Credit Bureau, where Credit pillar scoring is active and consent has been obtained.
Payment service providers for subscription billing and payment processing where applicable.
Regulatory authorities, law enforcement agencies, or courts, where required by Nigerian law or in response to a valid legal request.
Professional advisers, auditors, and technology service providers engaged by QMEL, subject to confidentiality and data protection obligations.

Where personal data is transferred outside Nigeria, for example to a cloud hosting or technology provider with infrastructure located abroad, we ensure that such transfers comply with the cross border data transfer requirements of the Nigeria Data Protection Act 2023, including the use of appropriate contractual safeguards or transfer to jurisdictions recognised as providing adequate protection.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, to comply with our legal, regulatory, and tax obligations, and to resolve disputes. Identity verification records and financial transaction records are generally retained for the period required under applicable Nigerian financial and tax regulations. Telematics data underlying historical score calculations is retained for the period necessary to support score history, dispute resolution, and audit requirements, after which it is securely deleted or anonymised.

7. Data Security

We apply administrative, technical, and physical safeguards designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data at rest using the AES 256 standard, encryption of data in transit using TLS version 1.2 or higher, role based access control restricting internal access to personal data on a need to know basis, and logging of administrative changes to scoring variables and account records. While we take these protections seriously, no system can guarantee absolute security, and you should also take reasonable steps to protect your own account credentials.

8. Your Rights

Under the Nigeria Data Protection Act 2023, you have the right to:

Be informed about how your personal data is processed.
Access the personal data we hold about you.
Request correction of inaccurate or incomplete personal data.
Request deletion of personal data, subject to our legal and regulatory retention obligations.
Object to or request restriction of certain processing activities, including processing based on legitimate interest.
Withdraw consent at any time where processing is based on consent, such as Credit pillar scoring, without affecting the lawfulness of processing carried out before withdrawal.
Lodge a complaint with the Nigeria Data Protection Commission if you believe your personal data has been processed unlawfully.

To exercise any of these rights, please contact us using the details provided in section 13 of this Policy. We will respond within the timeframe required under applicable law.

9. Automated Decision Making

Your composite score, pillar scores, and tier classification are generated through automated processing of trip, telematics, and, where applicable, credit data. Where this automated processing has a significant effect on your earnings multiplier, you have the right to request human review of the underlying decision through the in-app dispute process described in our Terms and Conditions, and to receive a clear explanation of the factors that contributed to your score.

10. Cookies and Similar Technologies

Our website and Platform may use cookies and similar technologies to remember your preferences, maintain session security, and gather aggregated usage analytics. You can manage cookie preferences through your browser or device settings. Disabling certain cookies may affect the functionality of the website or Platform.

11. Children's Data

The Platform is not intended for individuals under eighteen years of age, and we do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete that data promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, the Platform, or applicable law. Where changes are material, we will notify you through the Platform or by other appropriate means before the changes take effect, and we will update the effective date shown on the cover of this document.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact the QMEL customer support department through this email info@qoray.co and the contact channels published on the DriPA Platform and the QMEL corporate website. You may also contact the Nigeria Data Protection Commission directly regarding any unresolved data protection concern.