Privacy Policy
How we collect, use, and protect your personal data on the Whipcare platform.
Effective Date: July 1, 2026
Governed by the Nigeria Data Protection Act 2023 (NDPA 2023)
Your privacy matters to us. This Privacy Policy explains what personal data Whipcare collects, why we collect it, how we use and protect it, who we share it with, and what rights you have under the Nigeria Data Protection Act 2023 (NDPA 2023). Please read it fully. By using the Whipcare platform, you agree to the practices described in this Policy.
Contents
• 1. Who We Are
• 2. Who This Policy Covers
• 3. What Data We Collect
• 4. Why We Collect It — Lawful Bases
• 5. How We Use Your Data
• 6. Who We Share Your Data With
• 7. How Long We Keep Your Data
• 8. How We Protect Your Data
• 9. Your Rights Under NDPA 2023
• 10. Cookies & Tracking
• 11. Children's Privacy
• 12. Cross-Border Data Transfers
• 13. Data Breach Response
• 14. Service Provider Data Obligations
• 15. Changes to This Policy
• 16. Contact Us & Complaints
1. Who We Are
Whipcare is a verified vehicle health and service marketplace operated by ZacWurld Technologies Limited ("Whipcare", "we", "us", "our"). We are the Data Controller for personal data processed through the Whipcare platform.
Contact: zacwurld@gmail.com · www.whipcare.app · Lagos, Nigeria
2. Who This Policy Covers
This Privacy Policy applies to all individuals whose personal data Whipcare processes, including:
- • Car Owners — individuals who book vehicle services through the platform
- • Fleet Operators — companies and individuals managing vehicle fleets on the platform
- • Service Providers — mechanics, workshops, towing agents, car wash operators, and detailers registered on Whipcare
- • Visitors — anyone who visits the Whipcare website or app without registering
- • Business contacts — representatives of companies we work with or communicate with
3. What Data We Collect
| Data Category | What It Includes | Who It Applies To |
|---|---|---|
| Identity Data | Full name, date of birth, gender, nationality, government-issued ID number (NIN), BVN | Car Owners, Fleet Operators, Service Providers |
| Contact Data | Email address, phone number, WhatsApp number, residential address | All registered users |
| Vehicle Data | Vehicle registration number, make, model, year, mileage, service history, health score, known faults, photos | Car Owners, Fleet Operators |
| Location Data | Location at the time of booking (to match nearby providers), delivery or pickup address for towing | Car Owners, Fleet Operators |
| Service Data | Booking records, job status, service scope, photos (pre-service and post-service), dispute records, ratings and reviews | All registered users |
| Payment & Financial Data | Escrow transaction records, payment amounts, payment status, payout records. We do not store full card numbers — payment processing is handled by our third-party payment processor. | Car Owners, Fleet Operators, Service Providers |
| Verification Data | Professional qualifications, workshop photos, tool verification records, insurance documents, client references | Service Providers |
| Usage Data | IP address, device type, operating system, app version, pages visited, time spent, clicks and interactions | All users including Visitors |
| Communications Data | In-app messages between car owners and providers, support tickets, email correspondence with Whipcare | All registered users |
| Inferred Data | Vehicle health scores, predicted maintenance needs, and other data points derived from your service history and usage patterns | Car Owners, Fleet Operators |
4. Why We Collect It — Lawful Bases
Under the NDPA 2023, we must have a lawful basis for processing your personal data. We rely on the following:
| Lawful Basis | When We Rely On It |
|---|---|
| Contract | Processing necessary to provide our services: creating your account, processing bookings, managing escrow payments, matching you with service providers, handling disputes. |
| Legitimate Interests | Fraud prevention and platform security, improving our services, communicating service updates, maintaining vehicle service history records, detecting and preventing misuse of the platform. |
| Legal Obligation | NDPA 2023 compliance, responding to lawful requests from regulatory authorities, maintaining financial records for tax and regulatory purposes. |
| Consent | Marketing communications (you can withdraw consent at any time), optional analytics and personalisation features, optional data sharing with third parties for service improvement. |
5. How We Use Your Data
| Purpose | Data Used | Lawful Basis |
|---|---|---|
| Creating and managing your account | Identity, Contact | Contract |
| Matching car owners with verified service providers | Location, Vehicle, Identity | Contract |
| Processing bookings and managing escrow | Service, Payment | Contract |
| Provider verification and onboarding | Verification, Identity, Contact | Contract |
| Dispute resolution | Service, Communications, Payment | Contract / Legitimate Interests |
| Vehicle health scoring and predictive maintenance | Vehicle, Service, Inferred | Contract / Legitimate Interests |
| Sending booking confirmations and service updates | Contact, Service | Contract |
| Platform security and fraud prevention | Usage, Identity, Payment | Legitimate Interests |
| Improving platform features and user experience | Usage (anonymised) | Legitimate Interests |
| Sending marketing communications | Contact | Consent |
| Complying with legal and regulatory obligations | All categories as required | Legal Obligation |
6. Who We Share Your Data With
6.1 Service Providers
When you make a booking, we share the minimum data necessary for the Service Provider to complete the job: your name, phone number, vehicle details, and booking location. Service Providers are bound by our Provider Service Level Agreement and may not use this data for any purpose other than completing your booking.
6.2 Payment Processors
We use third-party payment processors to manage escrow transactions. Your payment data is processed by these providers under their own security standards. We do not store full card numbers.
6.3 Fleet Operators
If you are a driver presenting a vehicle for service under a fleet account, the fleet operator may see your name and the service record for that vehicle.
6.4 Regulatory Authorities
We may disclose personal data to the Nigeria Data Protection Commission (NDPC), law enforcement, or other regulatory bodies where required by law or where disclosure is necessary to prevent fraud or protect safety.
6.5 Business Transfers
In the event of a merger, acquisition, or sale of Whipcare, your personal data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.
6.6 We Do Not Sell Your Data
Whipcare does not sell, rent, or trade your personal data to third parties for marketing or commercial purposes. We do not share your data with advertisers.
7. How Long We Keep Your Data
| Data Type | Retention Period | Reason |
|---|---|---|
| Account and identity data | Duration of account + 2 years after closure | Fraud prevention and legal claims |
| Vehicle service history | 5 years from last service record | Legitimate interest in vehicle health tracking; legal basis for disputes |
| Payment and financial records | 7 years | Regulatory and tax obligations |
| Dispute records | 3 years from resolution | Legal claims and platform integrity |
| API and access logs | 90 days | Security monitoring and fraud detection |
| Marketing preferences | Until consent withdrawn or account closed | Consent-based |
| Provider verification documents | Duration of provider registration + 2 years | Contractual and legal obligations |
When data is no longer needed, we delete or anonymise it securely. You may request earlier deletion — see Section 9.
8. How We Protect Your Data
Whipcare implements the following security measures to protect your personal data:
- • Encryption of sensitive data in transit (HTTPS/TLS) and at rest (AES-256) for vehicle data, payment metadata, and identity documents
- • Access controls limiting which team members can access personal data, based on the principle of least privilege
- • Authentication controls including short-lived session tokens and multi-factor authentication on administrative systems
- • Regular security audits and vulnerability assessments of our platform and API endpoints
- • Contractual data protection obligations with all third-party processors
- • Staff awareness of data protection obligations under NDPA 2023
No system is completely secure. While we take reasonable and appropriate measures to protect your data, we cannot guarantee absolute security. If you suspect your account has been compromised, contact us immediately at zacwurld@gmail.com.
9. Your Rights Under NDPA 2023
As a data subject under the Nigeria Data Protection Act 2023, you have the following rights regarding your personal data held by Whipcare:
| Right | What It Means | How to Exercise It |
|---|---|---|
| Right of Access | You can request a copy of all personal data we hold about you. | Email zacwurld@gmail.com with subject: Data Access Request. We will respond within 30 days. |
| Right to Rectification | You can request correction of inaccurate or incomplete data. | Update your profile in-app, or email us with the specific correction needed. |
| Right to Erasure | You can request deletion of your personal data where we no longer have a lawful basis to hold it. | Email zacwurld@gmail.com with subject: Data Deletion Request. Some data may be retained for legal or regulatory reasons. |
| Right to Restriction | You can request that we restrict processing of your data in certain circumstances (e.g. while you contest its accuracy). | Email zacwurld@gmail.com explaining the specific restriction requested. |
| Right to Data Portability | You can request your data in a structured, commonly used format (e.g. CSV) for transfer to another service. | Email zacwurld@gmail.com with subject: Data Portability Request. |
| Right to Object | You can object to processing based on legitimate interests or for direct marketing at any time. | Use the unsubscribe link in any marketing email, or email us directly. |
| Right to Withdraw Consent | Where processing is based on consent, you can withdraw it at any time without affecting prior processing. | Update your notification preferences in-app or email us. |
We will respond to all rights requests within 30 days. Where a request is complex, we may extend this by a further 30 days with notice. We will not charge a fee for requests unless they are manifestly unfounded or excessive.
10. Cookies & Tracking
10.1 The Whipcare app and website use cookies and similar tracking technologies to: keep you logged in, remember your preferences, understand how you use the platform, and improve our service.
| Cookie Type | Purpose | Can You Control It? |
|---|---|---|
| Essential | Required for the platform to function (session management, security). | No — these are necessary for the service. |
| Functional | Remember your preferences and settings. | Yes — disable in browser or app settings. |
| Analytics | Understand usage patterns to improve the platform (anonymised). | Yes — opt out in your account settings. |
| Marketing | Serve relevant communications (only with consent). | Yes — withdraw consent at any time. |
11. Children's Privacy
Whipcare is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us at zacwurld@gmail.com.
12. Cross-Border Data Transfers
Whipcare primarily stores and processes data in Nigeria. Where we use international third-party services (such as cloud infrastructure or payment processors), your data may be transferred to and processed in countries outside Nigeria.
Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or equivalent mechanisms that provide a level of protection consistent with the NDPA 2023. We do not transfer data to countries that do not provide adequate data protection without appropriate safeguards.
13. Data Breach Response
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Whipcare will:
- • Notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach
- • Notify you directly without undue delay if the breach is likely to result in a high risk to your rights and freedoms
- • Describe the nature of the breach, the categories and approximate number of data subjects affected, and the likely consequences
- • Describe the measures taken or proposed to address the breach, including measures to mitigate its effects
If you suspect a data breach involving your Whipcare account, contact us immediately at zacwurld@gmail.com with subject: Security Incident.
14. Service Provider Data Obligations
Service Providers registered on Whipcare receive access to car owner personal data (name, phone, location, vehicle details) as part of the booking process. This data is provided to enable completion of the booked service only. Service Providers are required to:
- • Use car owner data only for the purpose of completing the booked job
- • Not store, copy, or share car owner personal data outside the Whipcare platform
- • Not contact car owners using platform-obtained data for any purpose not related to the active booking
- • Delete any written notes containing car owner personal data within 24 hours of job completion
- • Report any suspected data breach or unauthorised access to Whipcare immediately
Breach of these obligations by a Service Provider may result in immediate suspension, permanent deactivation, and potential legal action under the NDPA 2023. Whipcare may pursue the Service Provider for indemnification of any costs arising from their data breach.
15. Changes to This Policy
Whipcare may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. We will notify you of material changes via the app and by email at least 14 days before they take effect. The 'Effective Date' at the top of this Policy indicates when it was last updated.
Your continued use of the platform after the effective date of any update constitutes acceptance of the revised Policy. If you disagree with changes, you may close your account before they take effect.
16. Contact Us & Complaints
If you have questions, concerns, or complaints about how Whipcare handles your personal data, or if you wish to exercise any of your rights under the NDPA 2023, please contact us:
| Contact Type | Details |
|---|---|
| Data protection enquiries | zacwurld@gmail.com — Subject: Privacy / Data Protection |
| Rights requests (access, deletion, portability) | zacwurld@gmail.com — Subject: Data Rights Request |
| Data breach reports | zacwurld@gmail.com — Subject: Security Incident |
| General complaints | zacwurld@gmail.com |
| Regulatory body | Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng |
| Platform | www.whipcare.app |
If you are not satisfied with our response to a data protection complaint, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
Whipcare — The Operating System for Vehicle Health in Africa
ZacWurld Technologies Limited · Lagos, Nigeria · Effective July 1, 2026