Privacy Policy
Last updated: 10/10/2025
Company: Hungry Express Limited (“we”, “us”, “our”)
Contact: admin@hungryexpress.org
07052407777 | Ibadan, Nigeria
We comply with the Nigeria Data Protection Act, 2023 (NDPA) and guidance from the Nigeria Data Protection Commission (NDPC). Under the NDPA, a child is anyone under 18, and processing a child’s data typically requires verified parent/guardian consent, subject to limited exceptions
Scope
This policy applies to our website, apps, and related services (the “Services”). It explains what data we collect, how we use it, how we share it, legal bases, your rights, and how to contact us.
Who controls your data?
Controller: Hungry Express Limited, Ibadan, Nigeria.
Contact: hungryexpressonline@gmail.com
What we collect
-
Account Data: name, email, phone, password (hashed), profile photo (optional).
-
Order & Delivery Data: items ordered, notes, addresses, delivery instructions, timestamps, order IDs.
-
Payment Data: tokenized payment info and status from our payment processor (we do not store full card numbers).
-
Device & Usage Data: device identifiers, app version, OS, IP address, log data, approximate location for delivery, cookies/SDK events (e.g., session and analytics).
-
Support Data: messages, call recordings/chats (if applicable), and metadata.
-
Vendor and Rider Program Data: business details, contact persons, bank/settlement info where provided.
How we use your data (purposes)
Provide the Services: account creation, authentication, ordering, payments, delivery, receipts.
Customer support and safety: troubleshooting, fraud prevention, and enforcing policies.
Service quality: analytics, performance, and product improvement.
Communications: service messages (e.g., order status); optional marketing with your consent (you can opt out).
Legal: complying with laws, responding to lawful requests, resolving disputes, and maintaining records.
Our legal bases under the NDPA
We process personal data where one or more of the following apply:
Consent (e.g., optional marketing, cookies beyond strictly necessary; child data must have verified parental/guardian consent).
Performance of a contract (to provide ordering, payments, and delivery).
Legal obligation (e.g., tax, accounting, regulatory).
Vital interests (e.g., urgent health/safety).
Legitimate interests (e.g., securing our systems, preventing fraud, improving the Services)—balanced against your rights and expectations.
(These bases reflect typical NDPA grounds and controller obligations.)
Children’s privacy
We do not knowingly allow children to use the Services without the involvement and verified consent of a parent or legal guardian.
Parents/guardians may request access, correction, or deletion of a child’s data via the contact below. Under the NDPA, under-18s are “children”.
Cookies, SDKs, and similar technologies
We use cookies and SDKs for core functions (sign-in, security), preferences, analytics, and—if you opt in—marketing.
You can manage preferences in your device and browser. (Note: disabling essential cookies may affect functionality.)
Sharing your data
We share limited data with:
Vendors & Riders: to prepare and deliver your order (e.g., first name, initials, order items, delivery address and area, phone for coordination).
Payment processors: to process payments and prevent fraud.
Service providers: cloud hosting, analytics, customer support tools, SMS, email, and mapping.
Authorities or third parties: where required by law or to protect rights, safety, and security.
We require appropriate confidentiality, security, and data-protection commitments from service providers.
International transfers
If we transfer personal data outside Nigeria, we will use lawful transfer mechanisms and safeguards (e.g., contractual protections, risk assessments, and technical controls) consistent with the NDPA and NDPC guidance.
Retention
We keep personal data only as long as necessary for the purposes above or as required by law (for example, order/transaction records for tax and accounting).
When no longer needed, we delete or irreversibly anonymize the data.
Security
We use administrative, technical, and physical safeguards (access controls, encryption in transit, logging, least-privilege, and staff training) to protect personal data. No system is 100% secure, but we work to continuously improve.
Your privacy rights
Subject to the NDPA, you may have the right to:
Be informed about processing (this policy and notices).
Access your data and obtain a copy.
Rectify inaccurate or incomplete data.
Erase data (right to deletion) in applicable circumstances.
Restrict or object to processing in applicable circumstances (e.g., direct marketing).
Portability of certain data.
We will respond to verified requests within 30 days (or as allowed by law).
You can also withdraw consent at any time (it won’t affect prior lawful processing). For requests, email hungryexpressonline@gmail.com
Complaints
If you have concerns, please contact us first. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC)
Vendors, Riders, and Corporate Clients
Where Vendors, Riders, or corporate clients provide personal data to us (e.g., staff contact and payment/settlement details), they must ensure they have a lawful basis and provide required notices to their personnel.
We process such data as a controller (or in some cases as a processor according to a data-processing agreement).
Changes to this Policy
We may update this policy to reflect changes in law or our Services. We’ll post the updated version with a new “Last updated” date.
Contact
Data requests & privacy questions: hungryexpressonline@gmail.com
Phone: 07052407777
Address: No. 1 Foremilk Close, Kolapo Ishola Estate, Ibadan, Nigeria