Privacy Policy

This Privacy Policy explains how Viklance Orbit LTD, the data controller for the OrbitRuna platform, collects, uses, shares, and protects your personal data when you use our website, customer portal, and runner portal. This policy is written to comply with the Nigeria Data Protection Act and the Nigeria Data Protection Regulation ("NDPR").

All users: name, email address, phone number, and password (stored securely as a hash, never in plain text).

Customers: if you register a business account, your company name, business address, and CAC/RC registration number. When you place an order, we collect your delivery address, order details, item and vendor information, messages and files you exchange with your runner through the order thread, and your wallet and transaction history.

Runners: to complete verification, we collect your bank account details (for payouts), a government-issued ID document, a verification photo, guarantor information (name, contact, and address of a person who vouches for you), and your operating area and mode of transport.

Automatically collected data: we do not currently use analytics or tracking cookies. The only data collected automatically relates to standard technical request logs needed to operate the Service securely.

We process your personal data on the following legal bases:

• Performance of a contract: to create your account, process your orders, and deliver the Service you signed up for.
• Consent: where you actively agree, such as by accepting this policy at signup.
• Legitimate interest: to prevent fraud, verify runners, and keep the platform safe for all users.
• Legal obligation: to carry out identity and background checks on runners in connection with handling of funds, consistent with applicable Nigerian law.

We use your data to fulfill your orders, process payments, verify and pay runners, respond to customer support requests and complaints, and send you service communications such as order updates and receipts.

We share the minimum data necessary with the following categories of service providers, each bound by contractual obligations to protect your data:

• A licensed third-party payment processor, to process payments and refunds.
• An email delivery provider, to send transactional emails such as verification links, receipts, and order notifications.
• A secure cloud storage provider, to store uploaded files such as order attachments and runner verification documents.
• A database hosting provider, to store your account and order data securely.

Vendors and runners assigned to your order only see the information necessary to fulfill it, such as the delivery address and item details. They do not have access to your full account, payment, or contact details beyond what is shared through the in-app order thread.

OrbitRuna will never share your payment details or account information directly with a runner outside the in-app order thread. Likewise, you should never share such details with a runner off the platform, and a runner should never ask you to. Any such exchange is outside our protection; see our Terms and Conditions, Section 11.

We do not sell your personal data to any third party.

We retain your account and order data for as long as your account is active. After you close your account, we retain your data for an additional 10 years where required to meet financial record-keeping obligations under Nigerian law, after which it is securely deleted. Runner verification documents (ID and guarantor information) are retained for the duration of the runner relationship plus the same period, to meet the same obligations.

Under the NDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data, subject to our legal retention obligations.
• Restrict or object to certain processing of your data.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time, which may limit your ability to use parts of the Service that depend on that consent.

To exercise any of these rights, contact us using the details in Section 13.

We protect your data using industry-standard measures, including password hashing, encrypted data transmission, and restricted access to sensitive documents such as runner ID and bank details. Only authorized personnel who need it to perform their role can access this information.

Some of the service providers described in Section 5 may process or store data outside Nigeria. Where this occurs, we take reasonable steps to ensure your data continues to receive a level of protection consistent with the NDPR, including contractual safeguards with those providers.

The Service is not intended for anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can remove it.

We use only essential session and authentication cookies required to keep you securely logged in. We do not currently use third-party tracking or advertising cookies. If this changes, we will update this policy accordingly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through an in-app notice. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

For any questions or requests regarding your personal data, contact us at orbitruna@gmail.com or WhatsApp +234 811 453 8964.