Version 1.0 | Nigeria
ECHOCHOP LTD, incorporated in Nigeria and registered with the Corporate Affairs Commission under RC 9541284. Correspondence address: 6, Yinka Afolabi Street, Ayobo, Lagos State, Nigeria. Support: support@echochop.com. Formal notices: legal@echochop.com. We are responsible for personal information used to operate the EchoChop marketplace. This notice explains our handling of information about customers, vendors, riders and people who contact us. It is separate from the agreements governing purchases, selling and delivery work; reading it is not blanket consent to all processing.
1 Information we collect
Account and contact information includes names, email addresses, phone numbers, account identifiers, sign-in details managed through our authentication service, profile information and account status. For vendors and riders, we also receive relevant business, identity, eligibility, licence, vehicle, insurance and payout information supplied during onboarding or through authorised staff. We may receive this information from the account holder, their authorised business representative or staff completing onboarding.
Order information includes products, choices, quantities, prices, charges, delivery and pickup addresses, access notes, order status, handover records, reviews, complaints and refunds. Delivery records can include the assigned rider, location updates, timing and delivery-code verification. Chat messages and support correspondence are retained as communications records; authorised staff may access relevant records to resolve issues.
Payment information includes transaction references, payment status, amounts, refunds, settlement records and relevant bank account details for payouts. Payment providers process payment credentials through their own services. Do not send card security codes, banking passwords or payment PINs through order notes, chat or support.
Technical information includes device and app identifiers, operating system, app version, network and request information, notification tokens, security events, crash reports and performance diagnostics. The information generated depends on the platform, permissions and features used.
2 Location and device permissions
Customers may provide a delivery address and map pin or allow device location to help find an address and available services. Precise location is not the same as an address confirmation. You can enter an address manually where that option is available.
For riders, location is used while operating the relevant online, dispatch, navigation and delivery functions. It helps identify nearby offers, coordinate collection, show progress and investigate problems. Location updates may continue while a supported delivery function runs in the background if the device and permissions allow. Order participants receive the location information relevant to their delivery, not unrestricted access to all riders.
You can manage location and notification permissions in device settings. Disabling a permission may prevent a dependent function from working, particularly rider assignment or tracking. Changing a permission stops or limits future access as controlled by the device; it does not automatically erase records already collected. Files or photographs you choose to upload are processed for the purpose shown when requested.
Purposes lawful grounds and sharing
3 Why we use information
We use account, order, contact and payment information to provide the services you request and perform the relevant contract, including account administration, ordering, fulfilment, payments, refunds and support. Information needed to assess a vendor or rider application may be used to take steps at that person’s request before entering a contract.
We use appropriate transaction, tax and regulatory records to comply with legal obligations. We rely on legitimate interests, balanced against your rights, for proportionate fraud prevention, account security, troubleshooting, service reliability, audit and dispute handling where another lawful ground does not apply. We do not treat legitimate interests as permission for unlimited collection or reuse.
Where consent is required, including for optional marketing or particular sensitive-data processing, we request it separately and explain the choice. You may withdraw consent without affecting the lawfulness of processing before withdrawal. Necessary order or security messages are separate from promotional communications. In an emergency, information may be used where necessary and lawful to protect a person’s vital interests.
Providing information required for an account, delivery, eligibility check or payment is necessary to supply that function. If you do not provide it, we may be unable to provide the service. Optional information should not be required for an unrelated function.
4 Dietary and other sensitive information
A dietary note, allergy disclosure or support message can reveal health or religious information. Share only what is needed for the order or issue. Such details may need to reach the vendor preparing the food and, where necessary, the person delivering it. A note does not guarantee that a vendor can meet an allergy requirement.
Sensitive personal data requires an appropriate additional legal condition. Where explicit consent is required, it must be requested separately before that processing. We will not infer blanket consent from accepting marketplace terms. Do not place identity documents, medical records or other unnecessary sensitive material in a public review or ordinary order chat.
5 Who receives information
Vendors receive the order and information needed for preparation, fulfilment and support. Assigned riders or delivery providers receive relevant pickup, recipient, address and delivery instructions. Customers receive appropriate vendor and assigned-rider details and delivery progress. Public reviews and vendor listings are visible to people using those features; do not include private contact details in public content.
Authorised EchoChop staff access information according to their operational duties. Service providers support authentication, hosting, databases, file storage, notifications, email, mapping, navigation, payment processing, diagnostics and customer support. The platform uses Google Firebase services, Google mapping and navigation services, Flutterwave payment services and Microsoft 365 business email where those functions apply. Payment providers and some other recipients may also have their own legal responsibilities and privacy notices.
We may disclose necessary information to professional advisers, insurers, regulators, law enforcement or courts where there is a lawful basis. A business transfer may involve necessary information subject to lawful safeguards and appropriate notice. We do not authorise vendors or riders to reuse customer details for unrelated marketing.
Retention international processing and your rights
6 International processing
EchoChop uses technology and support services that may process information outside Nigeria, including cloud services in the United Kingdom and services operated internationally by our providers. The destination depends on the service and configuration. Before a restricted international transfer, we must establish the lawful transfer basis, assess the destination and apply safeguards required by Nigerian law, such as recognised contractual protection where appropriate.
Contact support@echochop.com to request information about the destinations and safeguards relevant to your data. We will provide meaningful information and, where available and appropriate, a copy or description of the safeguards, with necessary protection for confidential or security-sensitive details. Use of the app alone is not blanket consent to unrestricted international transfers.
7 How long information is kept
We keep information only for as long as needed for its purpose and applicable legal requirements. Account records are retained for the service relationship and necessary closure administration. Transaction, payout and tax records may need to remain for applicable statutory accounting periods. Complaints, disputes and safety records may be retained until resolution and for an applicable legal claims period.
Location history, chat and technical logs are assessed against the operational, safety, security and dispute purpose that justifies retention; they are not kept indefinitely simply because storage is available. We delete or anonymise information when no longer required, subject to justified legal holds and managed backup cycles. Closing an account does not require deletion of records we must lawfully retain. You may ask which retention period or criterion applies to a particular record.
8 Security
We apply proportionate technical and organisational controls, including authentication, role-based access and restrictions on sensitive operations, to protect personal information. No system can promise absolute security. Keep your sign-in details private and report suspected unauthorised access promptly. Where a personal-data breach meets legal reporting thresholds, we will notify the competent authority and affected people as required by law.
9 Your choices and rights
Subject to applicable conditions and exceptions, you can request information about processing, access to your data, correction, erasure, restriction, portability and objection to processing. You may withdraw consent where processing relies on it and object to direct marketing. You also have protections concerning solely automated decisions that produce legal or similarly significant effects.
Send requests to support@echochop.com, with enough information to locate your account and describe the request. We may seek proportionate identity or authority verification and will not request your password or payment PIN. We will respond within the applicable legal timeframe, explain any lawful restriction and tell you how to challenge it. Rights requests do not automatically require account closure.
You may complain to the Nigeria Data Protection Commission through its official website, https://ndpc.gov.ng, without first obtaining our permission. You may also seek other remedies available under law.
Automated functions children and contact
10 Automated service functions
The app uses automated rules to determine service-area eligibility, display available products, calculate order totals, allocate delivery offers and apply temporary dispatch eligibility rules. Inputs can include selected address, enabled markets, vendor status, stock, rider availability and location. An unsuccessful or expired offer is not a guarantee of future work.
These functions can affect the services or offers you see. If you believe an automated result is incorrect or unfair, contact support with the relevant account or order reference and request review. Where a solely automated decision has legal or similarly significant effects, applicable rights to safeguards and human intervention remain protected. We will explain the relevant decision sufficiently to support a meaningful challenge, while protecting other people’s information and system security.
11 Children
EchoChop accounts and contracting services are intended for adults aged 18 or over. An adult placing an order for someone else is responsible for the order and should provide only necessary recipient information. We do not intentionally invite children to submit identity, payment or marketing information through independent accounts. Contact us if you believe a child has provided personal information inappropriately so we can assess the situation and take suitable action, subject to legal obligations.
12 Marketing links and related services
Optional marketing choices can be changed through the available communication controls or by contacting support. Device notification permission is not, by itself, agreement to every marketing use. Essential service messages may continue while needed to operate an account or order.
If you follow a link to a payment provider, mapping service or another website, that service may collect information under its own notice. This notice covers EchoChop’s handling of information and does not replace another organisation’s responsibilities. Any additional collection for a new feature must be explained when that information is requested.
13 Changes and contact
We will make the current notice accessible and explain material changes before new processing takes place where required. If a change needs fresh consent, we will request it separately. An updated notice does not retrospectively authorise a use that lacked a lawful basis.
Privacy enquiries and requests: support@echochop.com. Formal correspondence: privacy@echochop.com. Postal correspondence: ECHOCHOP LTD, 6, Yinka Afolabi Street, Ayobo, Lagos State, Nigeria. Please state “Privacy” in the subject so the enquiry can be directed to the responsible person.