CARGORUN 9JA
PRIVACY POLICY

Effective Date: 26 October 2026
Last Updated: 26 October 2026
Legal Entity: Cargorun Limited
Trading Name: CARGORUN 9JA
CAC Registration Number: RC 731832
Registered Business Address: 30, Ugowe Street, off Saint Saviour Road, Benin City, Edo State, Nigeria
Official Website: https://cargorun9ja.com
Privacy Contact: Support@cargorun9ja.com

1. INTRODUCTION

Cargorun Limited, trading as CARGORUN 9JA ("CargoRun", "we", "us", or "our"), respects the privacy of individuals who use our services.

This Privacy Policy explains how we collect, use, store, disclose, protect, and otherwise process personal data when you access or use our website, mobile applications, rider application, business portal, administrative systems, and associated delivery and logistics services (collectively, the "Services").

This Policy applies to customers, delivery riders, business customers, representatives of business customers, prospective users, and other individuals whose personal data we process in connection with our Services.

We process personal data in accordance with applicable Nigerian data protection laws, including the Nigeria Data Protection Act 2023 ("NDPA"), and other applicable legal requirements.

This Policy should be read alongside our Terms and Conditions, Delivery Policy, and any additional privacy notices presented for particular features.

By using our Services, you acknowledge that you have had an opportunity to read this Policy. Where consent is legally required, we will obtain it separately through an appropriate and affirmative mechanism. Merely accessing or using our Services does not constitute consent where the law requires a separate consent.

2. OUR ROLE AND RESPONSIBILITY

Cargorun Limited generally acts as a data controller when it determines the purposes and means of processing personal data for its own delivery, account administration, payment reconciliation, security, and business operations.

In certain arrangements, CargoRun may act as a data processor when processing personal data strictly on behalf of a business customer or another data controller.

The legal role CargoRun performs will depend on the particular processing activity and the applicable contractual arrangements.

We will take reasonable measures to ensure that personal data is processed lawfully, fairly, transparently, securely, and only for specified and legitimate purposes.

3. PERSONAL DATA WE COLLECT

The categories of personal data collected depend on your relationship with CargoRun, the features you use, and the information necessary to provide the relevant Services.

3.1 Identity and Account Information

We may collect:
• Full name and username.
• Phone number and email address.
• Date of birth or age-verification information, where necessary.
• Residential, business, pickup, and delivery addresses.
• Profile photographs and other information voluntarily supplied.
• Account identifiers and authentication records.
• Account preferences and relevant registration details.

We use this information to create and manage accounts, provide Services, communicate with users, and protect account security.

3.2 Customer and Delivery Information

When a customer requests a delivery, we may collect:
• Pickup and destination addresses.
• Pickup and delivery contact details.
• Descriptions of packages and delivery instructions.
• Delivery schedules and order history.
• Order identifiers and delivery status.
• Proof-of-delivery information, including OTP confirmation where applicable.
• Relevant complaints, claims, and customer-support records.

This information enables us to arrange deliveries, communicate with customers and riders, investigate disputes, and maintain delivery records.

3.3 Rider Identity and Verification Information

To verify rider eligibility and protect the integrity of our platform, we may collect, where necessary and lawfully justified:
• Government-issued identification details and documents.
• Rider photographs.
• Driver's licence information, where applicable.
• Vehicle registration and ownership or authorization documents.
• Relevant insurance and vehicle documentation.
• Verification outcomes and records of checks.
• Information relating to suspected impersonation, fraud, or misuse.

We will apply appropriate access restrictions and retention controls to identification documents and related information.

We will not collect or process a Bank Verification Number (BVN), biometric information, or other particularly sensitive identification information merely because it is available. Any such processing must have a documented necessity, lawful basis, and appropriate safeguards.

3.4 Location and GPS Information

CargoRun may process location information from customer and rider devices when relevant to the Services.

For customers, location information may include pickup coordinates, delivery coordinates, or device location where the customer grants permission and uses a location-dependent feature.

For riders, location information may include:
• GPS coordinates during an active delivery.
• Rider position and route progress.
• Pickup and delivery arrival information.
• Estimated arrival times and relevant route data.
• Location information used to investigate delivery discrepancies or suspected fraud.

Background location tracking: The rider application may collect location information in the background while a rider is actively completing an assigned delivery, where the rider has granted the required device permissions and the feature is enabled.

Background tracking is intended to support active delivery tracking, dispatch operations, route monitoring, safety, and delivery verification. It is not intended to provide continuous tracking of riders outside active delivery operations.

We will not intentionally continue delivery-related background tracking after the relevant delivery-tracking purpose ends, except where a separate, lawful and disclosed purpose justifies a limited further use of previously collected information.

Users may manage location permissions through their device settings. Disabling permissions may limit the availability of certain features.

GPS information can be affected by signal interference, device settings, environmental conditions, mapping inaccuracies, and network interruptions. We therefore cannot guarantee that every location reading or estimated arrival time will be exact.

3.5 Payment, Wallet, and Transaction Information

CargoRun may maintain records concerning:
• Wallet balances and account transactions.
• Wallet funding and withdrawal records, where supported.
• Payment confirmations and transaction references.
• Delivery charges, service fees, and applicable commissions.
• Refunds, reversals, and payment disputes.
• Cash-on-delivery collections and reconciliations.
• Rider earnings, deductions, and outstanding balances.
• Promotional credits, referral rewards, and loyalty points.

Payment card details and other payment credentials may be handled by third-party payment providers. The information actually received or stored by CargoRun will depend on the payment integration used.

We do not represent that we never receive or store payment credentials unless the deployed systems and payment-provider arrangements confirm that position.

3.6 Device and Technical Information

We may collect technical information such as:
• Device type and operating system.
• Application version and configuration.
• IP address and relevant connection information.
• Device identifiers, where permitted and necessary.
• Application logs, crash reports, and diagnostic information.
• Authentication events and security logs.
• Information concerning application performance and feature usage.

We use this information to maintain the Services, troubleshoot technical issues, improve reliability, and detect unauthorized activity.

3.7 Communications and Support Records

We may process messages, support requests, complaints, incident reports, and other communications exchanged with CargoRun or through supported platform features.

Where applicable and appropriately disclosed, we may retain relevant records to resolve disputes, investigate suspected misconduct, provide customer support, and maintain operational accountability.

3.8 Business Customer Information

For business accounts, we may collect business names, contact details, account administrator information, authorized-user records, delivery histories, invoices, subscription records, and relevant transaction information.

We use this information to administer business accounts, manage deliveries, provide reporting, and fulfil contractual and legal obligations.

3.9 Information Obtained from Third Parties

Where legally permitted and necessary, we may obtain relevant information from payment providers, identity-verification providers, business customers, authorized representatives, and other service providers.

Where the law requires us to notify individuals about information obtained indirectly, we will provide the relevant information unless a lawful exception applies.

4. PURPOSES AND LAWFUL BASES FOR PROCESSING

CargoRun processes personal data only where an applicable lawful basis exists.

Depending on the particular activity, the lawful basis may include performance of a contract, compliance with a legal obligation, consent, protection of vital interests, public interest where legally applicable, or legitimate interests pursued in a manner consistent with applicable law and individuals' rights.

We may process personal data for the following purposes:

Purpose: Account creation and management
Examples of relevant data: Identity and contact information
Potential lawful basis: Contract or pre-contractual steps

Purpose: Delivery fulfilment
Examples of relevant data: Addresses, order records, rider location
Potential lawful basis: Contract

Purpose: Payment processing and reconciliation
Examples of relevant data: Transaction and wallet records
Potential lawful basis: Contract or legal obligation

Purpose: Rider onboarding and verification
Examples of relevant data: Identification and vehicle documents
Potential lawful basis: Contract, legal obligation, or another documented lawful basis

Purpose: Delivery tracking and dispatch
Examples of relevant data: GPS and route information
Potential lawful basis: Contract or, where appropriate, consent

Purpose: Security and fraud prevention
Examples of relevant data: Authentication, transaction, and relevant location records
Potential lawful basis: Legitimate interests or legal obligation, as applicable

Purpose: Customer support and dispute resolution
Examples of relevant data: Communications and delivery records
Potential lawful basis: Contract, legitimate interests, or legal obligation

Purpose: Legal and regulatory compliance
Examples of relevant data: Relevant account and transaction records
Potential lawful basis: Legal obligation

Purpose: Optional marketing
Examples of relevant data: Contact details and preferences
Potential lawful basis: Consent or another lawful basis where expressly permitted

Purpose: Analytics and service improvement
Examples of relevant data: Usage and diagnostic information
Potential lawful basis: Documented lawful basis appropriate to the activity

The table is illustrative rather than an assertion that one lawful basis applies to every instance of a given activity. CargoRun will determine and document the appropriate lawful basis for each material processing purpose.

Where consent is relied upon, it must be freely given, specific, informed, and capable of withdrawal without invalidating processing lawfully carried out before withdrawal.

Where processing is based on legitimate interests, CargoRun will assess the relevant interests, necessity, and potential impact on affected individuals.

5. AUTOMATED PROCESSING AND ARTIFICIAL INTELLIGENCE

CargoRun may use automated systems to support delivery operations and platform security.

These systems may include:
• Nearby-rider identification and dispatch.
• Route selection and estimated arrival calculations.
• Delivery-price calculations.
• Transaction monitoring and fraud indicators.
• Operational reporting and service optimization.

Such systems may use relevant information, including location, delivery details, transaction records, and platform activity.

Automated outputs may be inaccurate or incomplete. Where appropriate, we may review or correct the information and allow users to raise concerns.

Where a decision is based solely on automated processing and produces legal or similarly significant effects, CargoRun will comply with applicable requirements, including any applicable rights to human intervention, expression of the individual's position, and contesting the decision.

Where consent is required for a particular automated decision, we will obtain it through an appropriate process.

We do not intend to use automated systems as an unrestricted authority to make significant decisions about individuals without the safeguards required by law.

6. HOW WE SHARE PERSONAL DATA

CargoRun does not sell personal data to third parties.

We may disclose or make relevant personal data available to the following recipients where necessary and lawful.

6.1 Customers and Delivery Riders

We may share the minimum information reasonably necessary to complete a delivery.

For example, an assigned rider may receive pickup and delivery addresses, relevant customer contact information, package instructions, and information necessary to complete the delivery.

Customers may receive relevant rider identification, delivery progress, and contact information.

Users should understand that information shared with another participant for delivery fulfilment may be visible to that participant for the purposes of the transaction.

6.2 Business Customers

Where a business customer arranges deliveries through CargoRun, relevant order information may be shared with authorized business representatives to administer orders, track deliveries, and reconcile transactions.

6.3 Payment Providers

We may share relevant information with payment processors and financial service providers to facilitate payments, wallet funding, transaction verification, refunds, fraud prevention, and reconciliation.

Paystack has been identified as a planned or intended provider. Its actual role and integration must be confirmed before this Policy is published.

6.4 Mapping and Navigation Providers

We may use mapping providers to support route planning, navigation, distance calculations, and location-based services.

Google Maps Platform and Mapbox have been identified as intended or potential providers. The final list of active providers must reflect the production implementation.

6.5 Telecommunications and Messaging Providers

We may use providers such as Termii or other telecommunications service providers to send OTPs, account verification messages, delivery notifications, and service communications.

Such providers may process relevant phone numbers, message content, delivery metadata, and verification records to provide their services.

6.6 Hosting, Infrastructure, and Technical Providers

We may engage providers for cloud hosting, storage, system monitoring, analytics, customer support, security, and application diagnostics.

These providers may process personal data on our behalf under appropriate contractual and security arrangements.

6.7 Professional Advisers and Service Providers

We may share relevant information with lawyers, auditors, insurers, consultants, and other professional advisers where necessary for legitimate business purposes and subject to applicable confidentiality and data protection requirements.

6.8 Legal and Regulatory Disclosures

We may disclose information where required by applicable law, a valid court order, or a lawful request from an authorized authority.

We may also disclose relevant information where reasonably necessary to protect individuals, investigate suspected fraud, establish or defend legal claims, or enforce our contractual rights, subject to applicable law.

6.9 Corporate Transactions

In connection with a merger, acquisition, restructuring, financing, or sale of relevant business assets, personal data may be disclosed or transferred where necessary and lawful, subject to appropriate safeguards.

6.10 Independent Data Controllers

Certain third-party providers may act as independent data controllers for their own processing activities. Their processing will be governed by their own applicable privacy notices and legal obligations.

CargoRun will not claim that a provider's independent status automatically eliminates any responsibilities CargoRun may have for its own processing or disclosures.

7. INTERNATIONAL DATA TRANSFERS

Some service providers may store or process personal data outside Nigeria.

Where personal data is transferred internationally, CargoRun will comply with the applicable requirements of Nigerian data protection law, including any required assessment, safeguards, contractual protections, or consent.

We will not assume that an international transfer is lawful merely because a third-party provider is widely used or operates a reputable service.

Where required, additional information about the transfer and its safeguards will be provided to affected individuals.

8. DATA RETENTION AND DELETION

CargoRun retains personal data only for as long as necessary to fulfil the relevant purpose, subject to applicable legal, regulatory, contractual, security, and dispute-resolution requirements.

Retention periods will depend on the type of information and the reason it is processed. Examples include:
• Account information: for the duration of the account and a reasonable period thereafter where needed for legitimate purposes.
• Delivery records: for the period necessary to fulfil, verify, and resolve issues concerning deliveries.
• Payment and accounting records: for the period required by applicable financial, tax, accounting, and regulatory obligations.
• Rider verification records: for the duration of the relevant relationship and any additional lawful retention period.
• GPS records: for the period necessary for active delivery operations, dispute resolution, security, and other documented lawful purposes.
• Support and complaint records: for the period reasonably necessary to resolve and document the matter.
• Security logs: for a period proportionate to the relevant security and operational needs.

These categories are not fixed retention promises. CargoRun will establish and maintain a retention schedule appropriate to the information actually collected.

When personal data is no longer required, we will take reasonable steps to delete it, anonymize it, or securely dispose of it.

Deletion may be delayed or limited where retention is required by law, necessary to establish or defend legal claims, or otherwise lawfully justified.

Where appropriate, information retained in backups may be deleted or overwritten through established backup-retention processes rather than immediately disappearing from every backup copy.

9. DATA SECURITY

CargoRun will implement reasonable technical and organizational measures designed to protect personal data against unauthorized or unlawful processing, access, disclosure, alteration, loss, destruction, or damage.

Measures may include:
• Authentication and access controls.
• Role-based permissions.
• Appropriate encryption and secure transmission.
• Secure management of credentials and system secrets.
• Audit logging and security monitoring.
• Payment-provider security controls.
• Software maintenance and vulnerability management.
• Staff confidentiality and access procedures.
• Incident response and recovery arrangements.
• Appropriate due diligence and contractual safeguards for service providers.

The measures applied will depend on the nature of the information, the risks involved, and the technical environment.

No electronic system, internet connection, storage environment, or transmission method can be guaranteed to be completely secure. Accordingly, although CargoRun will take reasonable steps to protect personal data, we cannot guarantee that unauthorized access or every security incident will always be prevented.

Nothing in this section excuses CargoRun from complying with applicable security, accountability, breach-response, or notification obligations.

10. PERSONAL DATA BREACHES AND SECURITY INCIDENTS

If CargoRun becomes aware of a personal data breach, we will assess the incident and take reasonable steps to contain, investigate, mitigate, and remediate its effects.

Where required by applicable law, CargoRun will notify the Nigeria Data Protection Commission within the applicable statutory period and communicate the incident to affected individuals where the relevant legal threshold is met.

Under the applicable statutory framework, notification to the Commission may be required within 72 hours of awareness of a breach likely to result in a risk to individuals' rights and freedoms. Affected individuals must also be informed where a breach is likely to result in a high risk to their rights and freedoms, subject to the applicable statutory rules.

We may cooperate with relevant providers, investigators, regulators, and law enforcement authorities as appropriate.

We will not represent that a breach has no legal consequences merely because the incident originated with a third-party provider.

11. THIRD-PARTY SERVICES AND CIRCUMSTANCES OUTSIDE OUR CONTROL

CargoRun relies on certain external services and infrastructure, which may include payment systems, telecommunications networks, mapping services, cloud hosting, internet connectivity, and device operating systems.

Such services may experience interruptions, inaccuracies, delays, failures, security incidents, or changes outside CargoRun's direct control.

For example:
• A telecommunications provider may delay an OTP.
• A mapping service may provide inaccurate directions.
• A payment provider may delay a transaction confirmation.
• A network outage may interrupt live tracking.
• A device may transmit inaccurate location information.
• An external infrastructure failure may temporarily prevent access to the Services.

CargoRun will take reasonable steps to select and manage relevant providers and respond appropriately to issues affecting our Services.

To the extent permitted by law, CargoRun does not guarantee the uninterrupted operation, absolute accuracy, or availability of services operated independently by third parties.

Nothing in this Policy excludes or limits any duty, liability, or remedy that cannot lawfully be excluded or limited, including applicable obligations arising from CargoRun's own processing of personal data.

Where a third-party incident affects personal data for which CargoRun is responsible, we will continue to fulfil our applicable legal obligations.

12. SERVICE INTERRUPTIONS AND EXCEPTIONAL EVENTS

The Services may be affected by circumstances beyond our reasonable control, including natural disasters, widespread power or telecommunications failures, civil unrest, government restrictions, and major disruptions to external infrastructure.

CargoRun will take reasonable steps to mitigate such disruptions and restore affected services where practicable.

This section does not excuse performance of obligations that remain enforceable under applicable law or permit CargoRun to disregard the privacy rights of affected individuals.

Any contractual allocation of liability for such events will be addressed in our applicable Terms and Conditions and interpreted consistently with mandatory law.

13. YOUR PRIVACY RIGHTS

Subject to applicable law and any lawful limitations, individuals whose personal data we process may have the right to:
1. Be informed about the processing of their personal data.
2. Request access to personal data concerning them.
3. Request correction of inaccurate or incomplete personal data.
4. Request deletion where applicable.
5. Object to certain processing activities.
6. Request restriction of processing in applicable circumstances.
7. Withdraw consent where processing relies on consent.
8. Exercise applicable data portability rights.
9. Challenge qualifying decisions based solely on automated processing.
10. Request human intervention where legally applicable.
11. Lodge a complaint with the Nigeria Data Protection Commission.

These rights are subject to applicable statutory conditions, exemptions, and limitations. They do not automatically require deletion of records that CargoRun is legally obliged or otherwise lawfully entitled to retain.

To exercise a right, contact Support@cargorun9ja.com with the subject line "Privacy Request."

Please describe your request and provide sufficient information for us to understand and verify it. We may request additional information reasonably necessary to confirm your identity and prevent unauthorized disclosure.

We will respond within the applicable legal timeframe.

We will not unlawfully discriminate against individuals for exercising their privacy rights.

14. CHILDREN AND MINORS

CargoRun's minimum intended user age is 13 years. However, the ability of a person under 18 to use particular Services, create an account, book deliveries independently, or consent to the processing of personal data is subject to applicable Nigerian law and any relevant safeguarding requirements.

Under the NDPA and the applicable child-protection framework, special requirements may apply to processing children's personal data, including parental or legal guardian consent where consent is the relevant lawful basis and appropriate age and consent verification mechanisms.

The NDPA also provides for specific regulatory treatment of children aged 13 and above using information society services at their own request. This does not constitute blanket authorization for every form of processing or every type of account activity involving a minor.

Before permitting independent use by minors, CargoRun will implement the safeguards and account restrictions required by applicable law.

Where parental or guardian consent is legally required, we will obtain and verify it through an appropriate process. We will not rely on a general statement in this Policy as a substitute for obtaining required consent.

If we become aware that personal data has been collected or processed in a manner inconsistent with applicable child-protection requirements, we will take appropriate steps to investigate and address the issue.

15. COOKIES AND SIMILAR TECHNOLOGIES

Where our website or other Services use cookies, software development kits, analytics tools, or similar technologies, we may use them for essential functionality, security, preference management, diagnostics, and service improvement.

Where legally required, we will obtain appropriate consent before using non-essential cookies or similar technologies.

Users may manage available cookie preferences through the relevant controls or their browser settings. Disabling certain technologies may affect the availability of some features.

The specific technologies used will depend on the production website and application configuration.

16. DIRECT MARKETING AND NOTIFICATIONS

CargoRun may send essential service communications, including OTPs, account alerts, delivery updates, transaction notifications, security alerts, and important policy changes.

Where we send promotional communications, we will comply with applicable consent, privacy, and electronic communications requirements.

Where required, users will be provided with a clear method to opt out of marketing communications.

Opting out of marketing will not necessarily stop essential transactional, security, or legally required communications.

17. USER RESPONSIBILITIES AND ACCOUNT SECURITY

Users should take reasonable precautions to protect their accounts and devices, including keeping credentials confidential, using secure devices, and promptly reporting suspected unauthorized access.

Users should provide accurate information when creating accounts, arranging deliveries, submitting verification documents, or updating account details.

Where a user supplies inaccurate information, shares credentials, or compromises an account, the resulting circumstances may affect the operation of the Services.

However, this section does not transfer all security responsibility to users or excuse CargoRun from its own obligations under applicable law.

18. ACCOUNT CLOSURE AND PRIVACY REQUESTS

Users may request account closure through the available account controls or by contacting Support@cargorun9ja.com.

Account closure does not automatically require the immediate deletion of every associated record.

CargoRun may retain certain records where necessary to fulfil legal obligations, complete pending transactions, resolve disputes, prevent fraud, maintain appropriate accounting records, or establish or defend legal claims.

Where continued retention is no longer necessary or lawful, we will take appropriate steps to delete or anonymize the relevant information.

Where processing relies on consent and the consent is withdrawn, we will stop the relevant processing unless another lawful basis permits it to continue.

19. CHANGES TO THIS PRIVACY POLICY

CargoRun may update this Policy to reflect changes in our Services, technology, operational practices, legal requirements, or data protection arrangements.

The latest version will be published on our official website at https://cargorun9ja.com or another clearly identified official location.

We will update the "Last Updated" date when revisions are made.

Where legally required, we will provide appropriate notice or obtain consent before implementing a material change.

A revised Policy will not retrospectively remove rights or legal obligations that applied before the revision.

20. COMPLAINTS AND REGULATORY CONTACT

If you have concerns about how CargoRun processes your personal data, please contact us first using the details in Section 21.

You may also have the right to lodge a complaint with the Nigeria Data Protection Commission or seek another available remedy under applicable law.

Nothing in this Policy requires you to waive a statutory right or prevents you from approaching a competent regulatory authority or court.

21. CONTACT INFORMATION

For privacy requests, data protection concerns, account-related privacy questions, or complaints, please contact:

Cargorun Limited (trading as CARGORUN 9JA)
Address: 30, Ugowe Street, off Saint Saviour Road, Benin City, Edo State, Nigeria
Website: https://cargorun9ja.com
Email: Support@cargorun9ja.com

Please use the subject line "Privacy Request" or "Data Protection Complaint" where appropriate.

We may ask you to provide reasonable information to verify your identity and clarify your request.

22. GOVERNING LAW AND INTERPRETATION

This Policy is governed by the applicable laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 and other applicable data protection requirements.

Nothing in this Policy is intended to exclude or restrict any right, remedy, obligation, or liability that cannot lawfully be excluded or restricted.

If any provision of this Policy is found to be invalid or unenforceable, the remaining provisions will continue to apply to the extent permitted by law.

Where a provision conflicts with a mandatory legal requirement, the mandatory requirement will prevail.

END OF PRIVACY POLICY

Document status: Prepared for legal review. The responsible legal entity, registration details, actual production data practices, retention schedule, third-party integrations, international transfers, and requirements relating to minors must be verified before publication.