Privacy Policy

1. Who we are

Drivathon ("Drivathon", "we", "us" or "our") operates an endurance driving challenge and road-safety platform that lets individuals test and improve their driving knowledge, lets professionals teach and earn, and lets organisations assign tests and track compliance. Drivathon is operated from Nigeria and serves users in Nigeria and internationally.

For the purposes of applicable data protection law, including the Nigeria Data Protection Act 2023 (NDPA) and, where relevant, the EU/UK General Data Protection Regulation (GDPR), Drivathon is the data controller of the personal information described in this Policy. If you do not agree with this Policy, please do not use the Platform.

2. Information we collect

We collect the following categories of information:

• Account information — your name, email address, phone number, password (stored in encrypted/hashed form), role (individual, provider, organisation or partner) and country.
• Profile information — details you add to your profile, such as your organisation or driving school, bio, photo, qualifications and areas of expertise.
• Assessment and contest data — the tests, CBT exams and contests you take, your answers, scores, attempts, timing, and results history.
• Organisation and compliance data — if you belong to an organisation, the tests assigned to you, deadlines, completion status and compliance results, which may be visible to your organisation administrators.
• Provider and educational content — modules, lessons, videos, links, resources and other content you publish, and bookings or subscriptions related to it.
• Payment information — wallet balances, transactions, top-ups and payouts. Card and bank details are collected and processed directly by our payment partners; we do not store full card numbers on our servers.
• Usage and device data — log data, IP address, device and browser type, pages viewed, actions taken, and approximate location derived from your IP.
• Communications — messages you send us, support requests, and feedback.

3. How we use your information

• To create and manage your account and provide the Platform's features.
• To deliver and score assessments, contests and CBT exams, and to keep your results history.
• To let organisations assign tests and track the compliance of their members.
• To enable providers to publish content, take bookings and receive payouts.
• To process payments, top-ups, wallet balances and payouts.
• To communicate with you about your account, transactions, updates and support.
• To personalise your experience and recommend relevant content.
• To monitor, secure and improve the Platform, and to prevent fraud and abuse.
• To comply with our legal obligations and enforce our Terms & Conditions.

4. Legal bases for processing

Where the NDPA, GDPR or similar laws apply, we rely on one or more of the following legal bases: performance of our contract with you (to provide the Platform); your consent (for example, to send marketing messages, which you can withdraw at any time); our legitimate interests (such as securing and improving the Platform); and compliance with legal obligations.

5. How we share information

We do not sell your personal information. We share it only as described below:

• With organisations — if you take part as a member of an organisation, your assigned-test results and compliance status are shared with that organisation's administrators.
• With providers and other users — limited profile information is shown where necessary to enable bookings, coaching, marketplace transactions and contests.
• With payment processors — such as Flutterwave and Paystack, to process payments and payouts securely.
• With service providers — hosting, analytics, email, storage and similar vendors who process data on our behalf under confidentiality obligations.
• For legal reasons — where required by law, regulation, legal process, or to protect the rights, safety and property of Drivathon, our users or the public.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this Policy.

6. Payments

Payments, top-ups and payouts are handled through trusted third-party payment gateways. When you make a payment, your card or bank details are transmitted directly to the payment processor over an encrypted connection. We receive confirmation of the transaction and store transaction records (such as amount, date and status) but do not store your full card details. Your use of a payment processor is also governed by that processor's own terms and privacy policy.

7. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Platform and understand how it is used. You can control cookies through your browser settings; disabling some cookies may affect how the Platform works.

8. Data retention

We keep your personal information for as long as your account is active and for as long as needed to provide the Platform, comply with our legal obligations, resolve disputes and enforce our agreements. Assessment results and compliance records may be retained where an organisation or law requires it. When information is no longer needed, we delete or anonymise it.

9. Data security

We use appropriate technical and organisational measures to protect your information, including encrypted connections, hashed passwords and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to notify you and the relevant authority of a breach where the law requires.

10. Your rights

Subject to applicable law, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your information.
• Object to or restrict certain processing.
• Request a copy of your information in a portable format.
• Withdraw consent at any time, without affecting prior processing.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local data protection authority.

To exercise any of these rights, contact us using the details below. You can also update much of your information directly from your account settings.

11. Children's privacy

The Platform is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

12. International transfers

Because we operate internationally and use service providers in different countries, your information may be transferred to and processed outside your country of residence. Where we transfer personal data internationally, we take steps to ensure it is protected in line with this Policy and applicable law.

13. Third-party links

The Platform may contain links to third-party websites and services that we do not control. This Policy does not apply to those third parties, and we encourage you to read their privacy policies.

14. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you. Your continued use of the Platform after changes take effect means you accept the updated Policy.