Privacy Policy

This policy covers personal information we handle when you:

• visit www.kojoragroup.com or use shipment tracking
• ask us to arrange a freight delivery
• are named on a shipment as the goods owner, receiver, or driver
• sign in to Kojora operations tools as a member of staff

A delivery request is a request for follow-up. It becomes a shipment only after Kojora confirms it. The Terms of Use and Conditions of Carriage explain that relationship.

The delivery request form asks for:

• your name
• your phone number
• a company name, if you choose to give one
• an email address, if you choose to give one
• what you want moved, including the route and timing you describe

Include only the details we need to discuss the move. A description of the goods can be sensitive if it mentions health, religion, or another private matter. Send that kind of detail only when the shipment cannot be arranged without it.

If you call or message us on WhatsApp, we receive what you choose to send, together with the phone number your app or network shows.

When a shipment is recorded, operations staff store the details needed to carry it. Those details can include:

• names, phone numbers, and any email addresses for the goods owner, the receiver, and the driver
• a description of the goods and any weight that was given
• pickup and destination names and map coordinates
• the vehicle registration, which is shown to staff and is not published on the customer tracking page
• status, delivery time, and the operational notes staff record

If you give us another person’s name or phone number, you need a proper reason to share it, and you should tell that person that Kojora will use it to arrange or deliver the shipment.

Someone with a valid owner tracking code can see the shipment reference, status, goods description, weight, route, the latest location on record, and status events. That view does not include phone numbers or email addresses.

A location record is a latitude, a longitude, the time it was recorded, and the source. The source is a staff entry, a driver update sent with a driver code for that trip, or a vehicle tracker if one is connected for that trip. We do not continuously track a person’s phone outside an active trip.

A location can be out of date. In the service settings, a location may be treated as stale about 30 minutes after it was recorded if no newer point has arrived. The map shows the latest point we have. It is information about the shipment, and it is not a promise of the vehicle’s exact position.

A vehicle’s position during a trip can also show where the assigned driver is at that time. We use that information to run the shipment and to show progress to someone with the owner tracking code.

Tracking codes are stored as a hash. We do not keep the raw code in the database. A code can be revoked. Unless a different period is set for that shipment, a code expires 30 days after it is issued.

To limit abuse, we keep a hashed form of the network address used for a tracking lookup, a delivery request, a driver location update, or a staff sign-in attempt. We do not store that address in plain text for this purpose. Those rate-limit records are removed after about two days.

Staff actions on a shipment can be written to an audit record. Those records are for security and operations. They are not written to contain raw tracking codes or passwords.

Operations staff have an account with a name, an email address, a role, and a sign-in credential. The credential is handled by our authentication provider. Staff passwords are not stored in the shipment database. A sign-in cookie keeps an authorised staff member signed in. See the Cookie Notice.

The public site does not use advertising or analytics cookies, and it does not use browser storage to build a profile of you. When you open a map, your browser requests map images from the tile provider. That provider receives your IP address and the map area requested. The providers used for maps are CARTO, OpenStreetMap, and Esri, depending on the map style you open.

Fonts are served with the website.

We use personal information to:

• respond to a delivery request and decide whether we can carry the goods
• confirm, perform, and close a shipment
• show tracking information to someone with a valid code
• contact you about that request or shipment
• keep the site and staff tools secure, including rate limits and audit records
• handle a claim, a complaint, or a legal duty such as tax or accounting

Under the Nigeria Data Protection Act 2023, we rely on these reasons:

• taking steps you asked for before a contract, and performing a shipment you and Kojora have confirmed
• a legitimate interest in securing the service, preventing abuse, and keeping operational records, where that interest is not overridden by your rights
• a legal obligation, where a law requires us to keep or disclose a record
• consent, where we ask for it separately. You can withdraw that consent, and we will stop the processing that depended on it.

We do not sell personal information. We do not use it for third-party advertising. A message about your request or shipment is service communication.

We share personal information with:

• Kojora staff who need it to handle the request or the shipment
• the driver and receiver, to the extent they need it to collect or deliver that shipment
• Supabase, which hosts the database and staff authentication
• Resend, which sends the delivery-request email to Kojora’s inbox
• a map tile provider, when your browser loads a map
• a professional adviser, insurer, or authority where we need that for a claim, a legal duty, or the safety of people and goods

Text messages are not sent by this service today. If SMS is switched on later, the message provider will receive the destination phone number and the delivery status. The raw tracking code is not stored in the message log.

WhatsApp is a separate service from Meta. If you choose a WhatsApp link, Meta receives the message you send under WhatsApp’s own terms. A phone call uses your mobile network.

Our database host and email provider may process information outside Nigeria, in the countries where they run their infrastructure. We use them to store shipment records and to deliver the request email to us. Where the Nigeria Data Protection Act requires a condition for a cross-border transfer, we rely on a condition the Act allows, including that the transfer is needed to respond to you or to perform the shipment. We choose providers that protect the information they process for us.

We keep delivery requests, shipment records, party contact details, and location history for as long as the request or shipment, a claim, or an accounting or legal duty requires. Our usual period is up to six years after the request is closed or the shipment is delivered, cancelled, or declined.

Rate-limit hashes are removed after about two days. Tracking codes expire on the date set for that shipment, usually 30 days, and can be revoked sooner. We keep the hash, not the code itself. Staff sign-in cookies last for the session and are cleared when the staff member signs out or the session ends.

The service is built to reduce exposure of personal information. Customer tracking omits contact details. Access codes are hashed. Staff tools require a sign-in, and staff session cookies are HTTP-only. In production those cookies are marked secure. Lookups and requests are rate-limited. Database access for shipment tables is restricted.

No online service can promise that information will never be lost or accessed without permission. Tell us promptly if you believe a tracking code or a staff account has been exposed.

Subject to the Nigeria Data Protection Act, you can ask us to:

• confirm whether we hold information about you and provide a copy
• correct information that is inaccurate
• delete information, or restrict how we use it, where the Act gives you that right
• object to processing based on legitimate interest
• receive information you provided, in a portable form, where the Act requires it
• withdraw consent, where processing is based on consent

We may need to confirm who you are before we act on a request. We may keep a record where a law, a claim, or the security of the service requires it. We aim to respond within one month.

You can complain to the Nigeria Data Protection Commission at ndpc.gov.ng. Please contact us first so we can look into the issue. Contacting us does not remove your right to go to the Commission or to a court.

The website and freight service are for adults and for businesses. We do not knowingly collect personal information from a child. If you believe we have, contact us and we will delete it.

If we change this policy, we will post the new version on this page and change the date above. Where a change needs your consent, we will ask for it.

Email [email protected] or call +234 913 364 5723. You can also reach us on the delivery request page.

Ask for our data protection contact at the same email address. If you need the registered office address for a formal notice, ask and we will provide the address on our CAC records.