Privacy Policy

1. Introduction

This Privacy Policy (“Policy”) explains how OgaRepair Limited (“OgaRepair”, the “Company”, “we”, “us” or “our”) collects, uses, discloses, stores and otherwise processes Personal Data in connection with OgaRepair’s website, mobile application and related digital interfaces, features and services (together, the “Platform”).

OgaRepair operates a technology-enabled marketplace that facilitates connections between individuals and entities seeking repair, maintenance, installation and related services (“Customers”) and independent artisans or service providers (“Artisans”). The Company provides the Platform and related tools to help Users discover one another, submit and respond to service requests, arrange Bookings, communicate, manage job progress and facilitate payments. Unless expressly agreed otherwise in writing, OgaRepair does not itself perform the repair or other services offered by Artisans.

This Policy applies to Customers, Artisans, prospective Users, visitors to the Platform and other individuals whose Personal Data we process in connection with the Platform. It should be read with the Platform’s Terms of Use and any other policy of the Company. If there is a conflict concerning the processing of Personal Data, this Policy governs that subject matter to the extent permitted by applicable law.

By using the Platform, you acknowledge that you have had the opportunity to read this Policy. Where consent is the appropriate lawful basis for a particular processing activity, we will seek your consent separately and in a manner required by applicable law. Merely using the Platform does not replace consent where consent is legally required.

2. Meaning of Key Terms

“Personal Data”

means information relating to an identified or identifiable individual.

“Processing”

includes collecting, recording, organising, storing, using, disclosing, transferring, restricting or deleting Personal Data.

“User”

means a Customer or Artisan, or another person accessing or using the Platform.

“Booking”

means a service request accepted or confirmed through the Platform in accordance with the applicable booking process.

“Third-Party Service Provider”

means an independent third party whose services support the Platform, including payment processing, identity verification, background checks, hosting or technical support.

Words not defined in this Policy have the meanings given to them in the Terms of Use or under applicable data protection law.

3. Personal Data We May Collect

The categories of Personal Data we collect depend on how you interact with the Platform and which features you use. We will seek to collect data that is adequate, relevant and limited to what is reasonably necessary for the relevant purpose.

4. How We Use Personal Data

Subject to applicable law and the lawful basis applicable to the relevant activity, we may process Personal Data to:

• create, authenticate, administer and secure User Accounts;
• onboard Artisans and carry out identity, background, qualification, reference or other verification checks;
• receive, assess, route and manage job requests, quotations, Callouts and Bookings;
• help Customers and Artisans communicate, approve changes, record job progress and coordinate service delivery;
• facilitate payments, payment status updates, refunds, reversals, commission deductions and payment disputes through relevant payment providers;
• provide customer support, handle complaints, investigate disputes and maintain transaction records;
• operate, maintain, troubleshoot, protect and improve the Platform and its features;
• use automated or AI-assisted tools, where available, to help Users prepare or clarify job descriptions and related service requests;
• detect, investigate and prevent fraud, misuse, security incidents, unlawful conduct and violations of the Terms of Use;
• send service-related communications, booking notifications, account notices, policy updates and security alerts;
• send marketing or promotional communications where permitted by law and, where required, with your consent;
• comply with legal, regulatory, tax, accounting, recordkeeping or lawful information-request obligations; and
• establish, exercise or defend legal claims and protect the rights, property, safety and legitimate interests of the Company, Users or others.

5. Lawful Bases for Processing

We will process Personal Data only where a lawful basis under the Nigeria Data Protection Act 2023 (“NDPA”) or other applicable data protection law is available. Depending on the circumstances, this may include:

• Contract: where processing is necessary to create or manage your Account, arrange a Booking, provide Platform functionality you request or take steps at your request before entering into a contract;
• Legal obligation: where processing is necessary to comply with a legal or regulatory requirement, including applicable tax, accounting, fraud-prevention or lawful recordkeeping obligations;
• Legitimate interests: where processing is necessary for a legitimate interest pursued by the Company or another party, such as securing the Platform, preventing fraud, improving services or handling disputes, provided those interests are not overridden by your rights and freedoms;
• Consent: where you have freely given valid consent for a specified purpose, such as certain optional communications, cookies or processing for which consent is legally required; and
• Other lawful bases recognised by applicable law, where the relevant conditions are satisfied.

The lawful basis depends on the specific processing activity. We will not rely on consent where another lawful basis is more appropriate, and where we rely on consent you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal, and we may continue processing where another lawful basis applies.

Where we request information that is necessary to provide a feature, verify an Artisan, complete a Booking or comply with law, failure to provide it may mean that we cannot provide the relevant feature or service. We will explain this where reasonably practicable.

6. AI-Assisted Features and Automated Processing

The Platform may use automated tools, including artificial intelligence, to help Customers prepare or clarify job descriptions or to support other Platform functions. Information submitted to such tools may include job details, photographs or other content supplied by a User. Users should avoid including unnecessary sensitive Personal Data or information about other people in prompts or uploads.

AI-assisted outputs may be incomplete or inaccurate and should be reviewed by the User. They do not replace an Artisan’s inspection or professional assessment. We will not make a decision producing legal or similarly significant effects about you solely by automated means unless permitted by applicable law and subject to any safeguards and rights that apply.

7. How We Share Personal Data

We may disclose or make Personal Data available to the following recipients, to the extent necessary and lawful:

• Customers and Artisans: relevant information needed to assess a job, provide a quotation, arrange a Callout or Booking, communicate, perform the Services or resolve a complaint. For example, an Artisan may receive the service location and job details for an accepted or relevant request.
• Payment service providers: information required to initiate, process, verify, reconcile or refund transactions and manage payment disputes. Paystack may be used for relevant payment services if enabled for the Platform.
• Identity and background verification providers: information needed to verify identity, qualifications, references or other onboarding criteria. Dojah may be used for identity verification if enabled for the relevant process.
• Technology and operational providers: hosting, cloud storage, analytics, communications, customer support, security, software, maintenance and other providers that help us operate the Platform.
• Professional advisers and insurers: lawyers, auditors, accountants, consultants and insurers where reasonably necessary for professional services, risk management or claims.
• Authorities and other persons: courts, regulators, law enforcement agencies or other persons where disclosure is required by law, necessary to respond to lawful process, or reasonably necessary to protect rights, safety, property or prevent fraud.
• Business transaction parties: prospective or actual purchasers, investors, financing providers or other parties involved in a merger, acquisition, restructuring or transfer of some or all of the Company’s business, subject to appropriate confidentiality and legal safeguards.

We do not sell Personal Data to third parties for their own independent marketing. We do not permit service providers processing Personal Data on our behalf to use it for unrelated purposes, subject to their role and applicable law. Where a third party processes data as an independent controller, its own privacy notice may also apply.

8. Use of User Information by Other Users

The Platform requires some information to be shared between Customers and Artisans so that they can assess, arrange and perform a Booking. Users must use another User’s Personal Data only for the relevant job, Booking, complaint or other authorised Platform purpose, and must not publish, sell, retain or disclose it for unrelated purposes without an appropriate lawful basis.

Artisans should use a Customer’s address, access instructions, photographs and other premises-related information only to the extent reasonably necessary to perform the agreed Services. Customers should use an Artisan’s contact, profile and verification-related information only for legitimate Platform-related purposes. Users must not upload another person’s Personal Data unless they are authorised to do so or otherwise permitted by law.

9. Cookies, Analytics and Similar Technologies

The website or App may use cookies, software development kits, local storage, analytics tools or similar technologies to enable core functionality, remember preferences, maintain security, understand Platform usage and diagnose technical issues. The technologies used will depend on the Platform’s actual configuration.

Where applicable law requires consent for non-essential cookies or similar technologies, we will request consent before using them and provide a way to manage preferences or withdraw consent. You may also be able to manage cookies through your browser.

10. Marketing and Service Communications

We may send communications necessary to operate your Account or a Booking, including verification messages, quotations, booking confirmations, schedule changes, payment notices, security alerts, support responses and material updates to our policies. These are service communications and may continue even if you opt out of marketing.

We may send promotional or marketing communications where permitted by applicable law. You can opt out using the unsubscribe method in the communication or by contacting us. We will respect your choice, subject to any communications that we are legally required or reasonably required to send for service, security or transaction purposes.

11. Data Retention

We retain Personal Data for a period of six (6) years from the date of collection or the end of the relevant relationship with the User, as applicable, for purposes including account administration, verification, Bookings, payment processing, complaint handling, security, legal compliance and the establishment, exercise or defence of legal claims. Different retention periods may apply where required by applicable law or where the nature of the Personal Data or the purpose for which it is processed necessitates a different period.

Upon expiry of the applicable retention period, we will take reasonable steps to delete, anonymise or securely dispose of the Personal Data, subject to applicable law and technical constraints. Closing an Account does not necessarily result in the immediate deletion of all Personal Data, and we may retain relevant records for the applicable six (6)-year period or longer where necessary to complete transactions, process refunds, prevent fraud, comply with legal obligations or resolve disputes.

12. Data Security

We will implement appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Depending on the risks and systems involved, measures may include access controls, authentication, encryption where appropriate, secure storage, backups, monitoring, staff confidentiality obligations, provider due diligence and incident response procedures.

No online platform or transmission method can be guaranteed to be completely secure. Users should protect their login credentials, use secure devices and promptly report suspected unauthorised access. Where a Personal Data breach occurs, the Company will assess and respond to it and make notifications to the Nigeria Data Protection Commission and affected individuals where and as required by applicable law.

13. Your Data Protection Rights

Subject to the conditions, exceptions and limitations under applicable law, you may have the right to:

• be informed about the processing of your Personal Data;
• request access to Personal Data we hold about you and obtain relevant information about its processing;
• request correction of inaccurate or incomplete Personal Data;
• request erasure of Personal Data where the legal conditions for erasure are satisfied;
• request restriction of processing in circumstances provided by law;
• receive certain Personal Data in a structured, commonly used and machine-readable format, or request its transmission to another controller, where the right to portability applies;
• object to processing based on legitimate interests or to direct marketing, in accordance with applicable law;
• withdraw consent where processing is based on consent;
• not be subject to a decision based solely on automated processing where the law provides that right, and request applicable safeguards or human intervention; and
• lodge a complaint with the Nigeria Data Protection Commission (NDPC).

These rights are not absolute and may be subject to legal exceptions. We may need to verify your identity and request sufficient information to locate the relevant records before responding. We will respond within the time required by applicable law. If we cannot comply with a request, we will explain the reason where legally required.

14. How to Exercise Your Rights or Contact Us

To make a privacy request, ask a question about this Policy, raise a concern or complain about our handling of Personal Data, contact us using the details below:

Please describe your request and provide sufficient information for us to identify you and understand the Personal Data concerned. Do not send full passwords, payment card details or unnecessary sensitive information in your request. We may ask for additional information where reasonably necessary to verify your identity and protect other people’s data.

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission through its official channels. You may also have rights to seek a judicial remedy under applicable law.

15. Third-Party Websites and Services

The Platform may contain links to or integrate with third-party websites, applications or services. This Policy does not govern the privacy practices of third parties acting independently. Please review their privacy notices before providing Personal Data to them. Our use of a provider does not mean that we control all of its processing activities. Where a provider processes Personal Data on our behalf, we will seek appropriate contractual and organisational safeguards as required by law.

16. Changes to this Policy

We may update this Policy to reflect changes to the Platform, our data practices, third-party providers, legal requirements or other legitimate operational needs. We will publish the updated Policy through the Platform or another appropriate channel and indicate the date it takes effect. Where a change requires notice or consent under applicable law, we will provide the required notice or obtain the required consent. We encourage Users to review this Policy periodically.

17. Interpretation and Applicable Law

This Policy shall be interpreted consistently with the Nigeria Data Protection Act 2023 and other applicable laws of the Federal Republic of Nigeria. Nothing in this Policy is intended to exclude or restrict a right that cannot lawfully be excluded or restricted.