Privacy Notice

This Privacy Notice (“Notice”) explains how [LeasHub operating entity / RC number] (“LeasHub,” “we,” “us”) collects, uses, discloses, and protects personal data in connection with the LeasHub mobility marketplace, available at leashub.org and through the LeasHub mobile applications.

This Notice is issued in accordance with the Nigeria Data Protection Act 2023 (“NDPA”) and the General Application and Implementation Directive 2025 issued by the Nigeria Data Protection Commission (“NDPC”) under the NDPA (the “GAID”).

LeasHub is a five-sided marketplace, and this Notice applies to everyone who uses it:

• Individual Partners — people who fund a Wallet and book vehicles for personal or business use.
• Enterprise Partners — organisations that book and manage transportation for their own Clients.
• Clients of an Enterprise Partner — the people an Enterprise Partner books a trip for. A Client may never register with LeasHub themselves; see Section 4.
• Fleet Owners — businesses that supply vehicles and salaried drivers to fulfil bookings.
• Drivers — individuals invited by a Fleet Owner to operate its vehicles.
• Admin users — LeasHub personnel operating the platform, across Super Admin, Operations, Finance, and Support roles.

An Enterprise Partner can share a Booking Link — a public page — with its own customers, who can submit their name, phone number, and trip details directly into LeasHub to request a booking, without ever registering as a LeasHub user themselves.

We use a Client's name and phone number only to fulfil the specific trip booked on their behalf — to identify them to the assigned driver and confirm pickup arrangements — on the basis of the Enterprise Partner's legitimate interest in delivering the service it has arranged, and our own legitimate interest in fulfilling that booking. We do not use it for any other purpose.

We only process personal data where we have a lawful basis to do so under Section 25 of the NDPA. The table below sets out our principal purposes and the corresponding basis.

Where we rely on legitimate interest, we have carried out, or will carry out, a Legitimate Interest Assessment in the form recommended by the GAID.

Each Partner has a dedicated virtual account, issued through Paystack, used solely to fund their Wallet. You can transfer funds from your own bank account into that dedicated account at any time; the transferred amount credits your Wallet automatically. You cannot withdraw from your Wallet — funds can only be spent on bookings, and the balance reduces only through a top-up, a booking deduction, or an overtime charge, each recorded as an individual transaction. Your balance is never edited as a standalone figure. LeasHub's Wallet deduction reflects LeasHub's own platform rate for the booking. A Partner's own selling price to their Client is a separate business decision LeasHub does not see or control.

We share personal data only where necessary, and with the following categories of recipient:

• Paystack, to process Wallet funding and payment confirmation;
• our email service provider, for OTP verification, invitations, and account notifications;
• our maps/location service provider, for pickup location and navigation;
• the Fleet Owner assigned to a booking, and the driver they assign to it, limited to what is needed to fulfil that trip;
• the Client's assigned driver, limited to pickup details and the Client's name and phone number for that trip;
• EMA's Operations Platform, where a Fleet Owner has enabled the Marketplace module — confirmed to include vehicle records, Fleet Owner identity, and related operational fields, linked to LeasHub via API;
• the infrastructure provider(s) hosting the LeasHub platform; and
• the NDPC, another regulator, or a law-enforcement body, where we are legally required to disclose data.

We do not sell your personal data.

LeasHub's platform is hosted in Lagos, Nigeria. Personal data is not, as a general matter, transferred outside Nigeria for hosting purposes.

Specific retention periods by data category are set out in LeasHub's Data Governance and Retention Policy.

Access to your personal data is scoped by role. Admin access is divided between Super Admin (full platform), Operations Admin (bookings, fleet, drivers, trips, issues), Finance Admin (Wallets, transactions, earnings, settlement), and Support (users, bookings, support issues) — each seeing only what their function requires. Sensitive administrative actions are logged in an audit trail recording the admin user, the action taken, the record affected, and the previous and new value where applicable.

Subject to the exceptions and conditions set out in the NDPA, you have the right to:

• be informed about how your personal data is processed (which this Notice addresses);
• request access to the personal data we hold about you;
• request that we correct inaccurate or incomplete personal data;
• request erasure or restriction of your personal data in certain circumstances;
• object to processing that is based on our legitimate interest;
• receive your personal data in a structured, commonly used, machine-readable format (data portability); and
• lodge a complaint with the NDPC.

If you are a Client who has not registered with LeasHub, you can still exercise these rights over the data submitted about you through a Booking Link — contact us using the details in Section 15.

To exercise any of these rights, contact us using the details in Section 15. If you are not satisfied with our response, you may raise a Standard Notice to Address Grievance (SNAG) with us in the form prescribed by the GAID, or lodge a complaint directly with the NDPC.

LeasHub is intended for use by adults capable of entering a booking, business, or driving engagement. We do not knowingly collect personal data from anyone under the age described in Section 31 of the NDPA without the consent required by that section.

We may update this Notice from time to time to reflect changes to LeasHub, our processing activities, or applicable law. Where a change is material, we will notify you through the platform before it takes effect.

You may lodge a complaint about our processing of your personal data with the Nigeria Data Protection Commission at any time. Contact details for the NDPC are published at ndpc.gov.ng. We encourage you to raise a concern with us first, using the details below, so that we can try to resolve it directly.

For any question about this Notice, or to exercise a right described in Section 11, contact us at the details above.