Privacy & Data Policy

Data Collection

We collect only what is needed to run logistics: identity and contact details, pickup and delivery addresses, payment references and transaction metadata (not full card numbers stored on our servers where a gateway handles payment), shipment and waybill data, rider assignment and location during active deliveries, and communications metadata needed for support and disputes.

• Booking and delivery execution
• Verification, fraud prevention, and audit trails
• Customer support and dispute resolution

Data Usage

Personal data is used strictly for operational delivery workflows, rider matching, real-time tracking during active jobs, customer notifications, security monitoring, and compliance. We do not sell personal data. Analytics, where used, favours aggregated or minimised datasets.

Processing is aligned with the Nigeria Data Protection Act 2023 and NDPR, including lawful bases where applicable (contract, legal obligation, legitimate interests balanced against your rights).

User Rights

You may exercise the following rights, subject to verification and legal limits:

• Access to the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure where applicable, and withdrawal of consent where processing is consent-based
• Objection to certain processing and, where feasible, data portability
• Lodging a complaint with the Nigeria Data Protection Commission or other competent authority

Requests: CustomerServices@imata-logistics.com

Data Retention & Deletion

Retention periods depend on legal, tax, and operational needs. Delivery and financial records may be kept for auditing and regulatory periods (often up to several years). Operational logs may roll off sooner. Aggregated or anonymised data may be retained where it no longer identifies you.

Account Deletion

Registered customers may request deletion of their IMATA account from their authenticated profile. The customer must confirm by typing delete my account and then submitting Delete My Account. This confirmation is designed to prevent accidental deletion.

Once deletion is confirmed, the account is immediately disabled, active sessions are ended, and the account is removed from normal customer processing and marketing. The account is placed into a restricted deletion archive. IMATA does not claim that every record is destroyed at the moment you press Delete Account.

The standard restricted account deletion period for customer profile data is three months. During that period, archived account information is restricted, excluded from active customer processing, and not used for marketing. At the end of the period, eligible profile information — including customer profile photographs — is permanently deleted or irreversibly anonymised, unless a legal hold or other lawful exception applies.

Closing an account does not erase IMATA's business, delivery, financial, compliance or evidentiary records. Those records remain in restricted archive and are not shown as an active customer profile. See Business and operational records.

The three-month profile archive and the twelve-month business-record baseline are IMATA operational policies. They are not a guarantee under the GDPR that every category of personal data is erased on those exact dates, and they do not override a longer lawful retention duty under Nigerian law. Where information is retained, IMATA will restrict its use and retain only what is necessary.

Deleting an account does not prevent a person from registering again. A new registration creates a new account. The previous account is not restored. Email verification, current Terms, and this Privacy Policy apply to the new account.

Backups are retained according to IMATA's backup policy. Deletion from the live system does not instantly remove every historical copy from every backup. Backups are not restored into production in a way that silently resurrects a deleted customer account.

Rider, enterprise, and other non-customer accounts should contact Customer Trust Operations. Email CustomerServices@imata-logistics.comwith the subject line "Account Deletion Request" and include your registered email and account type.

Typically deleted or anonymised when eligible (three-month profile cycle): login credentials, customer profile fields where lawful, customer profile photographs, sessions, and saved addresses where no retention duty applies.

Business and operational records

Account deletion is not business-record deletion. The following remain stored in restricted archive and are not destroyed as part of the three-month customer profile purge:

• Waybills, parcel evidence and proof of delivery
• Receipts, invoices, payment and ledger records
• Know-your-customer and identity-verification documents
• Operational rider photographs used for delivery identification and safety
• Audit, security, fraud-investigation and dispute records

The operational archive baseline for these records is twelve calendar months from the applicable record date. Financial, tax, KYC and similar records may be kept for several years where a longer lawful duty applies. A legal hold, active dispute, fraud investigation or regulatory requirement prevents destruction until it is released. Full policy: Account Deletion and Data Retention Policy.

Enterprise contact for corporate data questions. Customer rights requests: CustomerServices@imata-logistics.com.