Effective date: 4 October 2026
What changed on 4 October 2026: we added a paragraph to section 6, "Credit still owed after you close your account", explaining the code we keep so that credit still owed after an account is deleted can be claimed.
Data controller: My Dish Logistics Ltd (RC 1785427), trading as MyDish Logistics, Apologetics Center, Opposite T.C.N.N Secondary School, Guratop, off Bukuru, Jos, Plateau State, Nigeria.
Contact: Support@mydishlogistics.com · WhatsApp 09061375621
1. Who we are
MyDish Logistics ("MDL", "we", "us") operates a delivery marketplace connecting customers, vendors (kitchens/businesses) and riders in Jos and surrounding areas of Plateau State, Nigeria. This policy explains what personal data we collect, why, how we handle it, and your rights under the Nigeria Data Protection Act 2023 (NDPA).
2. Data we collect
From customers: phone number (for sign-in and order contact); delivery address and location coordinates you provide or share for delivery; order details; recipient details you enter when sending an order as a gift; food allergies you choose to record, used only to hide or mark dishes a vendor has declared contain them when you browse — they are not shared with vendors; a message you attach to a gift or a request.
From vendors: business identity and contact details; menu/catalogue information; bank account details for settlement (processed via our payment processor).
From riders: name and contact details; vehicle information; identity/KYC verification documents; a photo of your face, which we compare with your ID to confirm it is you; bank account details for payouts. If you deliver using our website and agree to it, we record your location during an active delivery and delete it after 90 days. The app does not.
About other people: details you give us about other people — someone you send an order or gift to, your emergency contact, a customer you book for. Only give us details you are entitled to share.
Photographs: when you upload a photograph, we remove the extra information stored inside the image file — such as where and when it was taken, and which phone took it — before we keep it. Depending on how you upload it, this happens in your browser before the photograph is sent, or on our server as it arrives, where that information passes through briefly and is never saved. This does not yet apply to delivery photos taken in the MyDish app.
Automatically: a notification token and your phone's operating system; crash reports, which include a random app-installation ID and technical details of your phone.
3. Why we use it (lawful basis, NDPA)
- To provide the service — take, dispatch, deliver and track orders (performance of a contract / legitimate interest in operating the service).
- To process payments and settlements (contract).
- To verify riders and keep the platform safe (legitimate interest; legal obligation where applicable).
- Rider delivery-location data — only on explicit consent, only during an active delivery leg; a rider who does not consent delivers normally and contributes no location trace.
- To communicate with you about orders and support.
4. Third-party services we use
To run the service we use trusted third parties, and each receives only what it needs for its part:
- Paystack — to process payments and settlements (payment and bank details).
- Google Maps / mapping services — for geocoding, distance and delivery routing (addresses/coordinates).
- Africa's Talking / SMS provider — to send one-time codes and notifications (phone number). Africa's Talking (SMS).
- Twilio (WhatsApp messaging); and Supabase and Vercel as infrastructure/hosting processors that store and serve data on our behalf under data-processing terms.
- Sentry — to receive crash and error reports. Cloudflare — to check that a sign-in or application comes from a person. Expo and Google Firebase — to deliver notifications to your phone (a device token). Resend — to send email. We do not sell your personal data.
5. How we protect and separate data
We apply security measures including encryption in transit, access controls, and role-based restrictions. Operational data (used to run your orders) is kept separate from our analytics. In our analytics, addresses are stored as a code rather than as text, locations are rounded to about 25 metres, and the demand figures shown to riders only cover areas where at least five people have ordered.
6. How long we keep it
We keep personal data only as long as needed for the purposes above and as required by law. Delivery location traces used for service quality are kept for a limited period and then deleted or irreversibly anonymised. Delivery location data (GPS pings) is retained for up to 90 days and then deleted or irreversibly anonymised. Other operational records are generally retained for up to 24 months. Records of your orders, earnings and tax are kept for 6 years, as the law requires, and they stay linked to you during that time.
Credit still owed after you close your account. If gift credit, or credit you bought that we could not refund to the card you paid with, is still owed to you when your account is deleted, we keep a record of what is owed so that you can still claim it. To recognise you when you do, we keep a keyed, one-way code made from your phone number, not the number itself. Without the key, which we keep apart from the database that holds the code, the code cannot be turned back into your number. We use it only to check whether a number given to us matches it: to recognise the person the credit belongs to, and to stop anyone else from claiming it. We keep the code for as long as the credit is still owed to you. Once it has been settled, we keep it for six years from the deletion of your account.
7. Your rights
The Nigeria Data Protection Act 2023 (NDPA) gives you rights over your personal data, and the Nigeria Data Protection Commission's General Application and Implementation Directive (GAID) sets out how they apply. You have the right to: see the personal data we hold about you; have it corrected if it is wrong; have it erased, unless the law requires us to keep it; have its use restricted where the law allows; object to how we use it; receive the data you gave us in a form you can take elsewhere; and withdraw any consent you have given, at any time. You have these rights whether or not you have a MyDish account. To use them, write to Support@mydishlogistics.com. If you have an account, you can also see, correct, download and delete much of your data in the app. Before we act on a request, we check that it comes from you, in proportion to what the request would reveal, and we never send identity documents by email. If you are not satisfied with how we handle your personal data, you can complain to the Nigeria Data Protection Commission (NDPC), the authority that supervises data protection in Nigeria, through its website, ndpc.gov.ng, or by email to info@ndpc.gov.ng.
8. Children
The service is not directed to children under 18. The Service is intended for users aged 18 and over.
9. Changes
We may update this policy; material changes will be notified in-app or on our website, and the effective date above will change.
10. Contact
Support@mydishlogistics.com · WhatsApp 09061375621 · My Dish Logistics Ltd, Jos, Plateau State, Nigeria.