Privacy Policy — Motence

Motence Privacy Policy

Effective Date: 1 May 2026 Last Updated: 9 August 2026 Version: 1.9

Data Controller: Swiftliner Technologies Limited RC: 9571507 Lagos, Nigeria privacy@motence.com

#1. Introduction

Motence ("we", "us", "our") is a transport-operations and fare-collection platform operated by Swiftliner Technologies Limited, incorporated under the laws of the Federal Republic of Nigeria. We are committed to protecting the personal data of our users.

This Privacy Policy is prepared in accordance with the Nigeria Data Protection Act 2023 (NDPA), applicable regulations, directives, and guidance issued by the Nigeria Data Protection Commission (NDPC), and other applicable laws.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights as a data subject.

By registering for or using the Motence platform (mobile app, web portal, or API), you acknowledge that you have read and understood this policy.

#2. Data We Collect

#2.1 Identity Data

Full legal name (first name, last name, middle name)
Date of birth (from BVN verification)
Bank Verification Number (BVN) — collected during KYC verification for adults; stored only as a SHA-256 hash. The raw BVN is transmitted to our identity verification provider (Prembly) for name-match against NIBSS records and is never retained at rest by Motence. BVN verification is conducted solely for customer due diligence, fraud prevention, identity verification, anti-money laundering compliance, and regulatory obligations. BVN verification does not provide Motence access to your bank accounts.
National Identification Number (NIN) — collected when you verify NIN (adults after BVN, or minors after guardian linking). Stored only as a SHA-256 hash; the raw NIN is transmitted to our identity verification provider and never retained at rest. Adult NIN unlocks Policy Tier 2 limits. Minor NIN is mandatory before transport fare payments on Tier 9 accounts.
Profile photograph (stored on Cloudinary)
Email address
Phone number

#2.2 Financial Data

Travel Credit balance and ledger history
Funding, approved-bank-withdrawal, refund and reversal records
Fare Code and active-fare payment records (including run, vehicle, route where applicable, amount and payment method)
Approved operator payout-recipient and payout records, where you are an approved operator or driver
Dedicated Virtual Account details and incoming-payment attribution, where that funding method is offered to you
VAT amounts charged per transaction, the rate applied, and the jurisdiction under which they were calculated
VAT remittance records (aggregated; no individual identifiers beyond what is already in the transaction ledger)
Tax invoice records for institutional and business customers (invoice number, date, customer identity and tax identification number where supplied, fee amount, VAT rate, VAT amount)

Note on VAT: VAT is calculated on Motence's service fee only. It is never calculated on the amount you fund, withdraw, or pay as a transport fare. Transport fares are VAT-exempt supplies under the Nigeria Tax Act 2025.

#2.3 Device and Technical Data

Device type and operating system
IP address
Session tokens (hashed)
Geolocation data during active collection sessions (inspectors only; not stored permanently)
Driver online/offline availability status for institutional spaces (stored ephemerally in Redis while Online; used for fleet visibility and optional operational reporting — not continuous GPS tracking)

#2.4 Compliance and Identity Verification Data

BVN verification result and date
Enrollment bank (from BVN issuer, logged for NFIU audit purposes)
KYC tier status
Compliance flags (AML/fraud alert types and review status)
Suspicious transaction reports (where applicable)

#2.5 Communication Data

Support ticket messages
Broadcast notifications received
Email and in-app notification records

#2.6 Transport Operations Data

Vehicle identifier, vehicle type, declared driver/operator relationship and plate-visible vehicle photograph submitted for a vehicle application
Vehicle-review decision, reason and supporting audit record
Active-shift, Fare Code resolution, fare-confirmation, payout-reconciliation and fraud-review events

We use this information to create an auditable transport context for a fare and to prevent a Fare Code from becoming a personal payment destination. A rejected vehicle photograph is deleted from object storage after the review decision; the application decision and limited audit record are retained as necessary for security, dispute handling and legal obligations.

#3. How We Use Your Data

| Purpose | Legal Basis (NDPA s.25) | |---------|------------------------| | Account registration and identity verification | Contract performance | | Adding Travel Credit, paying verified active fares, eligible bank withdrawals and operator payouts | Contract performance | | Reviewing vehicle applications, active shifts, fare reconciliation and approved payout destinations | Contract performance and legitimate interests (fraud prevention and service integrity) | | AML/CFT screening and fraud monitoring | Legal obligation (CBN/NFIU regulations) | | BVN verification (Prembly API) | Legal obligation (CBN KYC requirements) | | VAT calculation, invoicing, and remittance to tax authorities | Legal obligation (Nigeria Tax Act 2025 and Nigeria Tax Administration Act 2025, which from 1 January 2026 replaced the Value Added Tax Act Cap V1 LFN 2004; equivalent legislation in applicable jurisdictions) | | Issuing tax invoices and transmitting invoice data through mandatory electronic invoicing systems | Legal obligation (Nigeria Tax Administration Act 2025) | | Sending operational notifications | Contract performance | | Responding to support requests | Contract performance | | Platform analytics (aggregated) | Legitimate interests | | Compliance reporting to regulators | Legal obligation | | Security monitoring and fraud prevention | Legitimate interests |

We do not use your personal data for automated profiling that produces legal or similarly significant effects without human oversight.

#4. Data Retention

| Category | Retention Period | |----------|-----------------| | Account and identity data | 7 years after account closure (CBN KYC requirements) | | Transaction ledger records | 7 years (CBN/NFIU requirements) | | BVN hash and verification records | 7 years after account closure | | Support ticket records | 2 years after closure | | Compliance flags and AML records | 7 years (NFIU AMLCFT Regulations 2022) | | VAT transaction records, tax invoices, and remittance logs | 7 years (Nigeria Revenue Service requirement; equivalent periods in applicable jurisdictions) | | Device/session data | 90 days | | Geolocation data (inspector GPS) | Not stored (ephemeral Redis only, 10-min TTL) | | Driver online/offline presence | Ephemeral Redis (typically ≤12h while Online); not written to permanent ledger |

Data may be retained for longer periods where required for legal proceedings, regulatory investigations, dispute resolution, enforcement of legal rights, or compliance with applicable law.

Full retention schedule: see data-retention-policy.md.

#5.1 Service Providers (Data Processors)

We engage the following processors under data processing agreements:

| Provider | Purpose | |----------|---------| | Prembly | BVN and NIN identity verification | | Paystack | Payment collection, eligible funding attribution, bank withdrawals and operator payouts, where enabled | | Cloudinary | Profile photo storage | | DigitalOcean | Cloud hosting (backend API and database) | | Vercel | Web dashboard hosting | | Resend | Transactional email delivery | | Firebase (Google) | Push notifications |

#5.2 Regulatory Authorities

We may disclose personal data to the following without your prior consent where required by law:

Central Bank of Nigeria (CBN)
Nigerian Financial Intelligence Unit (NFIU)
Nigeria Revenue Service (NRS, formerly the Federal Inland Revenue Service) — including transmission of tax invoice data through mandatory electronic invoicing systems where Motence is required to participate
Nigeria Data Protection Commission (NDPC)
Economic and Financial Crimes Commission (EFCC)

Where Motence receives a subpoena, court order, or lawful law enforcement request for user data, we will assess its validity, comply where legally required, and notify affected users where permitted by law.

#5.3 Institutional Partners (Spaces)

Space administrators and authorised transport-operations personnel can view:

Member names and roles within their space
Fare payment records and session history relevant to their operations

They may only access records reasonably necessary for fare verification, operational administration, reconciliation, security, and auditing purposes within their designated space. They cannot access account balances, BVN data, or personal financial information outside their approved role and scope.

#5.4 No Sale of Personal Data

We do not sell, rent, or lease personal data to third parties for marketing or commercial purposes.

#6. Cross-Border Data Transfers

Some of our service providers are based outside Nigeria (e.g., Stripe/Paystack in Ireland, Cloudinary in USA). Where we transfer personal data outside Nigeria, we ensure appropriate safeguards are in place in accordance with NDPA s.44, including:

Standard Contractual Clauses (SCCs) with processors
Adequacy assessments where applicable

#7. Data Security

We implement the following technical and organisational measures:

Encryption in transit: TLS 1.2+ for all API communications
Encryption at rest: Database-level encryption for sensitive fields
BVN and NIN hashing: Raw BVN and NIN are never stored — only SHA-256 hashes.
Access controls: Role-based access control (RBAC) with least-privilege principle
Audit logging: All data access events are logged with timestamps and user IDs
Pessimistic locking: Money-moving operations use database-level row locks
JWT security: Short-lived access tokens (15 min), refresh token rotation, cookie-free transport

#7.1 Data Breach Notification

Where a personal data breach is likely to result in a risk to the rights and freedoms of data subjects, Motence shall notify the Nigeria Data Protection Commission (NDPC) and affected individuals in accordance with NDPA s.40 and applicable law.

#7.2 Data Protection Impact Assessments

Motence may conduct Data Protection Impact Assessments (DPIAs) where processing activities are likely to result in a high risk to the rights and freedoms of individuals, including transit account operations, payment processing, KYC verification, and fraud monitoring.

#8. Your Rights as a Data Subject

Under the NDPA 2023, you have the following rights:

| Right | How to Exercise | |-------|----------------| | Right to access | Request a copy of your personal data via the app or privacy@motence.com | | Right to rectification | Update your profile in the app; legal name changes after KYC require admin review | | Right to erasure | Request account deletion — note: we are required to retain financial records for 7 years | | Right to restriction | Contact privacy@motence.com to restrict processing in specific circumstances | | Right to data portability | Request an export of your transaction history in machine-readable format | | Right to object | Object to processing based on legitimate interests | | Right to withdraw consent | Where processing is consent-based, withdraw at any time without affecting prior processing |

To exercise any of these rights, email privacy@motence.com with your full name, registered email address, and a description of your request. We will respond within 30 days.

If you believe we have mishandled your personal data, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

#9. Cookies and Tracking

The Motence mobile app does not use cookies. The Motence web admin dashboard uses:

Essential cookies: Session management and CSRF tokens
No tracking or advertising cookies

We do not use third-party analytics that profile individual users.

#10. Children's Data and Guardian-Controlled Minor Accounts

Motence operates guardian-controlled Tier 9 accounts for users under 18. These are not independent financial accounts — a verified adult guardian must link, fund, and may revoke the relationship.

Minor detection: Users flagged as minors via date of birth at registration or retroactively when NIN provider data shows age under 18.

Guardian linking: Minors generate a short-lived invite code. A guardian must complete the identity checks Motence requires, redeem the code, and give versioned digital consent. One active guardian per minor.

NIN for minors: Minors never undergo BVN verification. NIN verification is mandatory before transport fare payments and is only available after an active guardian relationship exists. NIN is stored as SHA-256 hash only.

Funding: Minors may receive Travel Credit only through authenticated internal guardian funding (GUARDIAN_FUNDING). No self-funding, card funding, bank/DVA credits, peer-to-peer receipts, general transfers or personal payment code is permitted.

Guardian revocation: Only the guardian or Motence admin may revoke; minors cannot. Revocation immediately pauses spending until a new guardian links.

Retention: Guardian consent, relationship, and revocation records retained for 7 years per financial/KYC policy.

Adult accounts: Standard KYC requires users to be 18+ for BVN verification. If we inadvertently collect independent minor data outside the guardian model, we will delete it promptly.

#11. Changes to This Policy

We may update this policy periodically. When we make material changes, we will:

Update the "Last Updated" date at the top of this document
Notify registered users via in-app notification and email
Publish the updated policy at motence.com/privacy

Your continued use of the platform after notification constitutes acceptance of the updated policy.

#12. Contact Us

Privacy and Data Subject Requests: Email: privacy@motence.com

Data Protection Officer (DPO): Swiftliner Technologies Limited Email: dpo@motence.com

General Support: Email: support@motence.com

For urgent data breach notifications or regulatory inquiries: Email: privacy@motence.com Subject line: [URGENT] Data Protection Matter

This policy is published in compliance with the Nigeria Data Protection Act 2023 (NDPA), applicable regulations and directives issued by the Nigeria Data Protection Commission (NDPC), and the CBN Know-Your-Customer (KYC) Requirements.