Privacy Policy
Last updated: 4 July 2026
1. Who We Are
Dropa is operated by BBI International Limited ("BBI", "we", "us", or "our"). We provide a white-label logistics platform that helps African courier and dispatch companies manage their operations.
BBI International Limited is the data controller for all personal information collected through the Dropa platform. For any privacy question or to exercise your rights under the Nigeria Data Protection Act 2023, contact us at support@getdropa.com.
2. Who This Policy Applies To
This Privacy Policy applies to four groups of people whose personal data we process:
Marketing site visitors: Anyone who browses the Dropa marketing pages at getdropa.com (features, pricing, why-dropa, contact, and similar).
Customers and senders: People who book deliveries, track packages, or create an account through a tenant storefront (the branded delivery pages at getdropa.com/tenant/[company-name]/ or [company-name].getdropa.com).
Tenant operators: Logistics and courier businesses that register on the Dropa Operator Portal (app.getdropa.com) to run their operations using our platform.
Riders: Delivery riders whose profiles and activity are recorded in the platform as part of a tenant operator's fleet, and who use the Dropa Rider mobile application.
3. What Personal Data We Collect
─ MARKETING SITE VISITORS ─
Analytics data (Google Analytics 4): When you browse the marketing pages, we automatically collect the pages you viewed, how long you spent on them, how you arrived (e.g. from a search engine or a link), your approximate geographic region derived from your IP address (GA4 truncates your IP before storage - your full IP is not retained), and your device type, operating system, and browser.
Session recording and heatmaps (Microsoft Clarity): Clarity captures anonymised replays of how visitors navigate the marketing pages - where you click, scroll, and hover. Clarity also generates aggregate heatmaps. Session replay captures your on-page activity in considerably more detail than standard analytics. Clarity uses cookies and browser local storage.
─ CUSTOMERS AND SENDERS ─
Registration: First name, last name, email address, and a hashed password. If you sign up via Google, we receive your name and email from Google. We never store your Google password.
Profile: Full name, phone number, email address.
Delivery booking (guest or registered): Sender first name, last name, phone number (required), email address (optional for guests); recipient name and phone number; pickup address and dropoff address (entered via Google Maps Places API); package notes; delivery type (local, interstate, international); delivery speed preference; and requested pickup time if scheduled.
Payment: When you choose to pay online, your email address and order amount are passed to Paystack. Paystack handles all card numbers, bank details, and sensitive payment credentials directly on its own secure platform - we never see or store your card or bank account details.
Order records: Tracking ID, delivery status updates, pickup and dropoff addresses, timestamps, distances, and payment method.
─ TENANT OPERATORS ─
Account registration: Company name, company URL slug, administrator's first name, last name, email address, and a hashed password.
Business verification (KYC): To enable payouts and activate the full platform, operators undergo a KYC process. We collect: business legal name, business type (sole proprietor, limited company, partnership, NGO, or other), CAC registration number (optional), Tax Identification Number / TIN (optional), business address, city, and state; the representative's first name, last name, email address, phone number, Bank Verification Number (BVN), government ID type, and government ID number. Supporting documents are also uploaded: a CAC certificate of incorporation, a representative government ID, a proof of address (utility bill), and a bank statement.
Business settings: Business name, physical address, opening hours, social media links, store location, booking-page branding, pricing zones, and custom domain settings.
Staff accounts: Names and email addresses of staff members added by the operator to access the portal.
─ RIDERS ─
Authentication: Phone number (used to send a one-time password via SMS). Riders do not set a password.
Onboarding / KYC: Government ID type and a photo of the government ID; guarantor's full name, phone number, and relationship to the rider; vehicle document (vehicle registration or proof of ownership); and a liveness selfie photograph.
Payout details: Bank name, bank account number, and bank account name (verified via account resolution before saving).
Real-time location: During an active delivery, the Rider app transmits GPS coordinates (latitude, longitude, accuracy, heading, and speed) to our backend at regular intervals. This data is used to track delivery progress and share live location with the customer and the tenant operator. Location tracking occurs only when a delivery job is active.
Job and earnings records: Delivery assignments, job status updates, completion rates, cash collected, cash remitted, and cash balance.
Device and notification data: Push notification tokens are collected to send job alerts and delivery updates to riders' devices.
4. Sensitive Personal Data
Some of the data we collect is particularly sensitive and receives heightened care:
Bank Verification Number (BVN) - operator KYC: BVN is a unique identifier linked to your financial and biometric records in the Nigerian banking system. We collect it as part of KYC to verify the identity of the operator's authorised representative as required by financial regulations applicable to payment processing. BVN data is transmitted over encrypted connections and is accessible only to authorised compliance personnel. We do not use BVN for any purpose other than identity verification.
Government identity documents - operators and riders: We collect photos and numbers of government-issued IDs (NIN, passport, driver's license, voter's card) for KYC verification. These documents are stored securely and used solely for identity and compliance verification.
Liveness selfie - riders: A selfie photograph is collected as part of KYC to confirm that the person submitting documents is present and genuine. This constitutes biometric data under the NDPA. It is used exclusively for identity verification and is retained only as long as necessary for compliance purposes.
Real-time GPS location - riders: Continuous location data during active deliveries is used to enable live tracking, dispatch, and delivery confirmation. Riders are informed when location tracking is active, and tracking stops when a delivery job ends.
We process sensitive personal data only where necessary, rely on explicit consent or legal compliance as the basis for doing so, and apply appropriate technical and organisational safeguards.
5. How We Use Your Data and Our Legal Basis
We use your data only for the purposes described below. For each, we identify our legal basis under the Nigeria Data Protection Act 2023.
To provide the delivery booking service to senders and customers: Processing booking, profile, and payment data to create and fulfil orders, send tracking updates, and provide support. Legal basis: performance of a contract.
To process payments and payouts: Passing sender payment details to Paystack, and managing operator payouts through Paystack. Legal basis: performance of a contract.
To send order confirmations and delivery status updates: Using phone number and email to notify senders, customers, and operators about delivery progress. Legal basis: performance of a contract.
To enable rider job dispatch and live tracking: Collecting and sharing rider location data during active deliveries. Legal basis: performance of a contract; legitimate interest in enabling safe and efficient delivery operations.
To verify the identity of operators and riders (KYC): Processing KYC data to comply with financial and regulatory requirements applicable to payment services. Legal basis: compliance with a legal obligation; and where sensitive data (BVN, biometrics) is involved, explicit consent obtained at the point of collection.
To operate and maintain operator accounts: Processing registration and settings data so operators can configure and run their logistics business. Legal basis: performance of a contract.
To improve the marketing site: Using GA4 and Clarity analytics data to understand how visitors interact with the site and improve the product. Legal basis: legitimate interest, given limited privacy impact (anonymised recordings, no stored full IP).
To comply with legal obligations: Retaining records where required by Nigerian law or a lawful authority order. Legal basis: compliance with a legal obligation.
We do not sell your personal data, use it for targeted advertising, or share it for any purpose not described in this policy.
6. Third-Party Data Processors
We share your data only with the processors listed below, each of whom receives only the data necessary for their specific function. All are bound by data-processing agreements:
Google LLC - Receives analytics data via Google Analytics 4 (pages, approximate location, device info); address queries via the Google Maps Places API during delivery booking; and - if you sign up via Google OAuth - your name and email for authentication. Google is headquartered in the United States.
Microsoft Corporation (Clarity) - Receives session recording, heatmap, and behavioural data from marketing site visitors. Microsoft is headquartered in the United States.
Paystack Inc. - Processes online payments from senders and customers, handles payouts to operators, and resolves rider bank accounts for payout setup. We pass email and order amounts to Paystack; Paystack collects and secures card and bank details directly and is PCI-DSS certified. Paystack is a Nigerian company with infrastructure also operating in the United States.
Vercel Inc. - Hosts the marketing site and the Operator Portal, and may process server request logs and IP addresses as part of standard hosting operations. Vercel is headquartered in the United States.
Mapbox Inc. - Powers the map view in the Rider mobile application. Mapbox may receive map interaction data and general location context to render map tiles. Mapbox is headquartered in the United States.
[PUSH NOTIFICATION PROVIDER - confirm: likely Expo / Firebase Cloud Messaging] - Delivers job alerts and status updates to riders' mobile devices. [Update once confirmed.]
[SMS / OTP PROVIDER - confirm provider used for rider OTP delivery, e.g. Termii, Twilio] - Delivers one-time passwords to rider phone numbers for authentication. [Update once confirmed.]
[FILE STORAGE PROVIDER - confirm: likely AWS S3 or Cloudinary] - Stores documents and images uploaded during KYC (government IDs, selfies, vehicle documents, business documents). [Update once confirmed.]
[BACKEND HOSTING PROVIDER - confirm provider and region for the API server] - Hosts the backend API that processes all orders, KYC, rider data, and account information. [Update once confirmed.]
8. How Long We Keep Your Data
We retain personal data only as long as necessary for the purposes described in this policy, or as required by law.
Sender and customer accounts: Retained while your account is active. On deletion request, personal data is removed within [CONFIRM - e.g. 30 days], except where retention is required by law.
Guest delivery data (sender/recipient details): Retained for [CONFIRM - e.g. 12 months] after delivery completion to handle support requests and disputes.
Operator accounts and KYC: Account data is retained while the operator account is active. KYC documents are retained for [CONFIRM - financial record-keeping requirements under Nigerian law typically require 5–7 years, verify with your lawyer].
Rider profiles and KYC: Retained while the rider is active and for [CONFIRM POST-DEPARTURE PERIOD] after deactivation. Biometric data (liveness selfie) is retained only as long as necessary for verification, then deleted.
Rider location data: Delivery-session GPS data is retained for [CONFIRM - e.g. 90 days] after delivery completion for dispute resolution, then deleted.
Google Analytics data: Retained per the retention period configured in the GA4 property. [CONFIRM - check Admin → Data Settings → Data Retention in GA4 and update this line with the actual period.]
Microsoft Clarity recordings: Retained for up to 30 days by default.
9. Your Rights Under the NDPA
The Nigeria Data Protection Act 2023 gives you the following rights over your personal data:
Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Ask us to correct inaccurate or incomplete data. (You can also update your name, phone, and other profile information directly in your account.)
Right to erasure: Ask us to delete your data where we no longer have a legitimate reason to retain it. Note that some data must be kept to comply with legal obligations (for example, KYC records required by financial regulations).
Right to object: Object to processing based on legitimate interest - for example, analytics tracking on the marketing site.
Right to data portability: Request your data in a structured, machine-readable format.
Right to withdraw consent: Where we rely on your consent (for example, for sensitive data processing such as the liveness selfie), you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, email us at support@getdropa.com. We will acknowledge your request within 5 business days and respond in full within 30 days. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
10. International Data Transfers
Several of our data processors - Google, Microsoft, Vercel, and Mapbox - are headquartered in the United States. When you use the Dropa platform, certain personal data is transferred to and processed in the United States and potentially other countries.
Under the NDPA, transfers outside Nigeria require that the receiving country or organisation ensures an adequate level of data protection. Each of our international processors operates under internationally recognised data protection frameworks (including standards substantially equivalent to the EU General Data Protection Regulation) and contractual data processing safeguards are in place with each.
Paystack, while primarily a Nigerian entity, also operates infrastructure in the United States and is subject to PCI-DSS and applicable financial regulations.
For KYC data that includes particularly sensitive information (BVN, identity documents, liveness data), we rely on your explicit consent as the transfer basis, in addition to the contractual safeguards described above.
We monitor guidance from the NDPC on cross-border transfer requirements and will update our practices accordingly.
11. Children's Privacy
Our platform is not directed at children under the age of 13 and we do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us at support@getdropa.com and we will delete the information promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we do, we will revise the "Last updated" date at the top of this page.
For changes that materially affect how we use your data, we will make reasonable efforts to notify you - for example, through a notice in the app, on the Operator Portal, or on the Site. Your continued use of the platform after any update constitutes acknowledgment of the revised policy.
13. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your rights, or want to raise a concern, please contact:
BBI International Limited (trading as Dropa)
27, Atiba Osborne, Mende, Maryland, Lagos, Nigeria
CAC Number: RC-9047809
Privacy enquiries: support@getdropa.com
General enquiries: support@getdropa.com
Phone: +234 813 127 1411