Effective: 20 October 2026 (v2026-10-20)
VemoRide ("we", "us", "our") operates the vemoride.com platform and mobile experience. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our services, whether as a customer renting a car, a partner listing vehicles, or a driver fulfilling trips.
By using VemoRide, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the platform.
This policy is written to comply with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission's General Application and Implementation Directive 2025 (GAID), which took effect on 19 September 2025 and replaced the Nigeria Data Protection Regulation 2019. VemoRide is the data controller for the personal data described here. Our regulator is the Nigeria Data Protection Commission (NDPC).
Partners and drivers must verify their identity before they can list a vehicle or accept trips. A customer may also verify, and is asked to when a booking requires it, so the same description applies to everyone who completes the check. We use Mono Technologies Nigeria Limited ("Mono") and its Lookup service to perform it.
What we send to Mono. Only what the chosen register requires to answer. For a National Identification Number, the eleven digits and nothing else. For an international passport, the passport number, surname and date of birth. For a driver's licence, the licence number, both names and date of birth. We never send a phone number, an email address, booking history, payment details, messages or location data. We do not request or receive bank account data through Mono; the bank account option is switched off in our integration.
What the person does. They enter the document number on our own screen and consent there. There is no facial scan, no liveness capture and no redirect to a third-party screen. No photograph or biometric image of the individual is captured, requested or received at any point in this check.
What we receive and keep. The register's reply can contain the full record held against the document, which for a NIN may include a photograph and a specimen signature. We compare only the name on it against the name on the account, and we keep none of the rest: no photograph, no signature, and no copy of the register's record. What we store is the document number the individual gave us, whether the check passed, which register answered, and the date and time. Our diagnostic logs record the names of the fields the register returned and never their values, so the record does not survive in our logs either.
Why we are allowed to do this. Our lawful bases under section 25 of the NDPA are: the consent the individual gives before verification begins; the performance of our contract with partners and drivers, who cannot be onboarded without it; and our legitimate interest, and our passengers' safety interest, in knowing who is driving a vehicle booked through VemoRide. Verification is not used for advertising, profiling, credit scoring, or automated decisions beyond the pass or fail of the identity check itself, which a person may ask us to review manually.
Who else sees it. Nobody outside VemoRide and Mono. Verification data is not shared with customers, partners, or other drivers. Internally it is visible only to administrators who approve partner and driver accounts, and their access is logged.
How long we keep it. The audit record is kept for as long as the account is active and for 2 years after the account is closed, so that a disputed verification can still be explained, after which it is deleted. Where a verification fails, we keep only the fact that an attempt was made.
Where it is processed. Mono processes verification in Nigeria. Our own systems store the audit record with the infrastructure providers named in section 4, which is a transfer outside Nigeria as described in section 9.
Withdrawing consent. An individual may withdraw consent or ask us to delete the verification record at any time by writing to privacy@vemoride.com. Because verified identity is a condition of listing a vehicle or driving, withdrawing it means we can no longer offer that role, and the account reverts to customer access or is closed at the individual's choice.
We do not sell your personal information. We share it only as follows:
Section 25 of the NDPA requires us to have a lawful basis for each purpose. Ours are:
When you ask us to verify your mobile number, VemoRide, a trading name of Vemo Trio Global Limited, sends you a one-time code by SMS. We collect the mobile number you enter, the time the code was requested, and whether the number was confirmed. We use these only to confirm that the number belongs to you and to keep a record that the check was done.
We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.
The number is passed to our messaging provider, Twilio, for the sole purpose of delivering the code to you. It is not passed to anyone else, and we do not use it to send you marketing.
This section explains what we do when a government body, a regulator, a court or the police ask us to hand over information about someone who uses VemoRide. It applies to every such request, whatever its source and however it arrives, and it binds us as much as it informs you. VemoRide is operated by Vemo Trio Global Limited (RC 9883827), a company registered in Nigeria, so we are subject to the Nigeria Data Protection Act 2023 and the oversight of the Nigeria Data Protection Commission. Where the person concerned is in the United Kingdom or the European Economic Area, we treat ourselves as bound by the UK or EU GDPR as the case may be.
Every request is handled by the company director, who is also our data protection contact, at admin@vemoride.com. Nobody else at VemoRide may disclose personal data to a public authority, and nobody may do so informally: a verbal request, a phone call or a message to a member of staff is not acted on, and the person making it is asked to put it in writing. A request concerning the director is referred to external counsel before anything is disclosed.
We check every request for legality first. This review is mandatory and happens before any data is gathered, let alone sent, even when the request looks routine or urgent. We verify the requesting body and the officer through a channel independent of the request itself, because forged demands are a known way of obtaining personal data. We ask which statute, warrant, court order or regulatory instrument it is made under and expect it to be cited; a request citing no legal basis is treated as voluntary, which we are entitled to refuse and ordinarily do. We check that the power reaches both us and the data sought, that the request names the person or account and the information wanted rather than a category of users or continuous future access, and that the intrusion is proportionate to the stated purpose. Where a request is unclear or overbroad we go back and ask before we comply.
We challenge requests we believe to be unlawful. Where the review concludes that a request is unlawful, exceeds the body's powers or is disproportionate, we do not comply with it. Depending on the defect we refuse it in writing with our reasons, ask for it to be narrowed so a lawful part can be answered, require it to be put on a proper footing such as a warrant or court order, instruct Nigerian counsel and apply to the appropriate court to have it set aside or varied, and report it to the Nigeria Data Protection Commission or to the relevant supervisory authority. We bear the cost of doing so. That complying would be quicker or cheaper than objecting is not a reason to comply.
We disclose the minimum necessary. Where a request is lawful and we are obliged to answer it, we answer it narrowly: only the specific fields it covers, never a whole account record and never a database export, confined to the period it covers. We do not volunteer data that was not asked for even when it is to hand. We redact third parties, because a booking has two sides and a request about one person reaches records that also describe another, such as the other party to the trip. We do not disclose payment details or identity document images unless specifically compelled, we prefer a narrow written answer to handing over underlying records, and we send it by a secure channel to a verified official address. We do not grant any public authority direct, standing or automated access to our systems, and we never have.
We record every request. We keep a written log of each one we receive, whether or not we comply, recording the date and how it arrived, the requesting body and named officer and how we verified them, the legal basis cited, the account concerned, the data sought, our legal reasoning including who carried out the review and any advice taken, the decision, exactly which fields were disclosed and when, the grounds and outcome of any refusal or challenge, and whether you were notified. The log is kept for seven years, so that a pattern of requests can be seen rather than only individual ones and so that a decision can be explained long afterwards.
We tell you unless we are forbidden to. If we disclose your personal data to a public authority we will notify you, with what was asked for, what we disclosed and the legal basis, so that you can take your own advice. We will not do so where a court order or statute imposes secrecy, or where there is a specific and credible risk to someone's life or safety; where such a prohibition is time limited we notify you once it lapses. A demand for secrecy with no legal basis for it is itself reviewed as part of the request.
Emergencies. Where a request is made on the basis of an immediate risk to life or of serious physical harm, we may disclose the minimum needed to address that risk before the full review is complete, because safety outweighs the delay. The review is then completed immediately afterwards, the disclosure is logged in the same way, and if the review finds it was not in fact an emergency we say so to the requesting body and record it.
A request from a private party, including a lawyer, an employer, an insurer or a family member, is refused unless it is backed by a court order, in which case it is handled as if it came from the court. As at the effective date of this policy we have received no requests from public authorities and have disclosed no user data to any.
We implement appropriate technical and organizational measures to protect your data:
Depending on your jurisdiction, you may have the right to:
These rights are given to you by sections 34 to 37 of the NDPA and apply wherever you are in Nigeria, not only "depending on your jurisdiction". You also have the right not to be subject to a decision based solely on automated processing that significantly affects you, and to ask that such a decision be reviewed by a person.
To exercise any of these rights, contact us at privacy@vemoride.com or through the VemoRide Support messaging feature. We will respond within 30 days, and we do not charge for a reasonable request.
If you are not satisfied. Write to us first, at privacy@vemoride.com, marking your message as a data protection complaint, and we will treat it as a grievance under the GAID's Standard Notice to Address Grievance procedure. If we do not resolve it to your satisfaction, you may complain to the Nigeria Data Protection Commission, which supervises our compliance, at ndpc.gov.ng. You do not need our permission to do so.
Data protection contact. Our data protection contact is reachable at privacy@vemoride.com and at the address in section 11. Where the GAID requires us to appoint a Data Protection Officer, that role is held by the officer named in our filings with the Commission, and correspondence sent to privacy@vemoride.com reaches them.
If a breach of personal data occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as section 40 of the NDPA requires, and we will tell you directly and without undue delay where the risk to you is high. Our notice will describe what happened, what data was involved, what we have done about it, and what you can do to protect yourself.
VemoRide is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Your data may be processed in countries other than Nigeria, because our database, file storage, hosting and email delivery providers (Supabase, Hostinger and Resend, named in section 4) operate in the United States and Europe. Identity verification through Mono is processed within Nigeria.
Under sections 41 to 43 of the NDPA, a transfer outside Nigeria requires an adequate basis. We rely on the contractual data protection terms in each provider's data processing agreement, which oblige them to process data only on our instructions, to keep it secure, and to assist us in meeting our obligations to you. We transfer only what the service needs: an email address to send a message, and encrypted application data to store it. If you would like to know which provider holds a particular category of your data, ask us and we will tell you.
We may update this Privacy Policy from time to time. The "Effective Date" at the top indicates the latest revision. Continued use of VemoRide after changes constitutes acceptance. For material changes, we will notify you via email or an in-app notification.
If you have questions about this Privacy Policy or your data: