Your information at Rota Fleet

Effective 17 October 2026

Who we are

Rota Fleet Limited (LTD), RC 9587368, provides the carrier workspace and Rota Rider app. Our business address is 17 Nasir El Rufai Crescent, Guzape, Abuja. Contact hello@rotafleet.com about privacy or your information.

This notice covers these platform services, including information about carriers, staff, riders, senders and delivery recipients. The public website and waitlist have a separate website privacy notice.

Information we handle and why

We use account identifiers, names, email addresses, phone numbers, workspace membership and staff roles to authenticate users and administer access. If you choose Google sign-in, Google provides identity information such as your account identifier, email and basic profile. This does not give Rota access to Gmail messages or Google contacts.

Carrier operations can include pickup and drop-off addresses, contacts, parcel descriptions, rider assignments, delivery progress, notes, chat messages, shared images, completion photos, fleet records and payment entries. Carriers determine which operational information they enter and its business purpose; they are responsible for giving affected customers and workers appropriate privacy information. We process that information to provide the carrier’s requested services.

We use subscription references and payment status to administer plans; Paystack handles subscription payment details. Recording a delivery fee or cash receipt in Rota does not itself collect money. We also process support requests, access and activity records, technical diagnostics, notification tokens and browser subscriptions to run, secure and support the service.

Account and subscription processing supports our service agreement. Security and support processing serves the legitimate interests of operating a reliable service, subject to people’s rights. We process information to comply with legal obligations where applicable and seek consent where required. A carrier must establish an appropriate lawful basis for the workforce and customer processing it instructs, including location use; a device permission alone does not settle that obligation.

Rider location

An eligible rider chooses to go on duty and grants device permissions. The app can collect precise coordinates, accuracy and sample time while on duty, including between deliveries and while in the background or with the screen locked. Updates depend on connectivity, permissions and operating-system behavior; they are not guaranteed to be continuous.

Going off duty stops local collection. If offline, the app queues the server update for reconnection. Riders can also revoke device permissions. Duty sessions expire unless renewed through the supported flow, and changes may take time to appear on other devices.

Going off duty does not erase the last location already received. The operational location table holds one latest position, rather than a route history. Authorized carrier owners, operations managers and dispatchers may see it as a last-known position after duty ends. A later accepted sample replaces it, and eligibility changes apply revocation and cleanup rules. There is no automatic age-based expiry for this position. Separate duty audit records and backups can remain.

Access and service providers

Workspace access depends on role and carrier membership. Riders see delivery information according to their current assignment and access status. Their completed-job history omits customer phone numbers and street addresses. Carrier records can remain after rider access ends; revocation cannot retract information already seen or copied.

Providers supporting the platform include Vercel, Supabase, Resend, Google Maps, Expo, Apple and Google notification services, and Paystack for paid subscriptions. They process information needed for their respective hosting, authentication, storage, email, maps, notification and payment functions. Opening Maps, a dialler, SMS or WhatsApp is your choice and may pass the selected address, route or phone number to that service.

Notifications use generic alert wording and opening them requires an access check. Alerts already delivered to a device may remain there. We may disclose information when lawfully required, to protect people or the service, or in a business transfer subject to applicable protections.

Retention and international processing

Account information is used while the account is active and handled through the deletion process below when closure is requested. Carrier delivery records, messages, images and audit records are retained for the carrier’s operational needs and any applicable legal or dispute requirements. Retention is reviewed when a deletion or closure request is handled; the platform does not currently apply a single automatic expiry period to all of these categories. A plan’s history display limit is not deletion of the underlying records.

We assess what is still necessary, who controls the records, applicable obligations and outstanding disputes when deciding what to retain. We explain retained categories and the reason to a deletion requester. Backup copies follow the provider’s backup lifecycle and may not disappear immediately when a live record is removed; access remains restricted.

The production database is hosted in London. Hosting, email, maps, push and payment providers may process information in other countries. Processing is subject to applicable data-protection requirements; contact us for information about relevant providers and transfer arrangements.

Your choices and rights

You can manage location and notification permissions in device settings. Contact your carrier about the operational records it controls, or contact us at hello@rotafleet.com to request access, correction, deletion or other applicable rights. Depending on the law, these include objection, restriction, portability and withdrawal of consent. You may complain to the Nigeria Data Protection Commission or another competent regulator.

Request account deletion here, including if your rider access is paused. We verify your identity and manually process requests within 30 days. We remove personal account and access data and explain any carrier-controlled or legally required records retained. Workspace ownership and paid subscriptions may need to be resolved with you. If you cannot sign in, contact us for identity-verification assistance.

Security and changes

We use access controls, encrypted connections and private storage controls. No system is completely secure; protect your account and device and report suspected misuse. We update this notice when processing changes and provide additional notice where required.