Biometric Data Notice

Version 3.0. Effective 2 November 2026.

In short

• To confirm it is really you, our provider Dojah can match a selfie to the photo on your ID. Face matching is biometric, so it needs your separate consent in an unticked box. We use it for this match and nothing else.
• You do not have to agree. The alternative is a manual review: two uploaded photos, including a photo of you holding your ID, looked at by trained staff. No face matching software is used. It still needs a photo of your face.
• We never sell your face data and never show it to your operator or crew.
• We delete your selfie and face template 30 days after the identity decision, or 7 days after you withdraw consent, unless an open fraud investigation, case or legal hold needs them. ID document records stay for 5 years.
• ID files are open only to Trust and Safety and Compliance staff, and every opening is logged.
• You can withdraw your consent at any time. That does not undo a check already completed.

This summary is for convenience only. The numbered clauses below govern.

---

1. About this notice

1.1 Pickup Technology Limited, RC 9548096, Lekki Phase 1, Lagos State, Nigeria, trading as Pickup Charter ("Pickup", "we", "us"), shows this notice in the app next to a separate, unticked consent box before the identity check camera opens. It forms part of our Privacy Policy, which has the full detail.

1.2 It applies to the Guest who verifies after booking (the Booker, or for a car or boat a Lead Traveller who is on Pickup), to anyone who changes their phone number in the app, and to chauffeurs, captains and crew who verify before they can be assigned to a trip.

2. What we capture

2.1 Your NIN, or a photo of your identity document (national identity card, NIN slip, international passport, driver's licence, voter's card, Ghana Card, Emirates ID or another national ID), and the details read from it.

2.2 A selfie taken in the app.

2.3 A face template: a set of measurements made from your selfie and from the photo on your document or the photo held against your NIN, so the two can be compared.

2.4 The match result and a match score.

2.5 Your selfie, face template and match result are biometric data, which the Nigeria Data Protection Act 2023 treats as sensitive personal data.

3. Who handles it

3.1 Pickup is the controller.

3.2 Your photos go to our private identity storage with Supabase, outside Nigeria. Our identity verification provider, Dojah, then runs the match for us as our processor, under a written contract. It checks documents issued in Nigeria and abroad, including international passports, and checks against the National Identity Management Commission record where you give your NIN. Dojah may not use your data for its own purposes, sell it, share it except to run the check, or use it to train its own models.

3.3 Inside Pickup, ID files are open only to Trust and Safety and Compliance staff, and every opening is logged. They open them through our staff console, hosted by Vercel.

3.4 Your operator and crew never see your ID document, selfie or face template. They see only that you are verified.

3.5 Dojah is the only provider that matches your face. Before any other provider handles your ID images or biometric data, we list it on our Sub-processors page, update this notice and tell you at least 30 days ahead.

4. Why we use it

4.1 Only to confirm that you are the person on the identity document, and so to prevent someone booking or working in your name.

4.2 We never use it for marketing, advertising, profiling, analytics or personalisation, to identify you anywhere else, or to train models. Neither does Dojah. We never sell it.

4.3 The automated check can approve you. It cannot reject you. A no match counts as a try, and you get up to 3 live tries a day. After a no match you can try again, use a different ID or send photos for review. A person decides any review, and you can give more information. Most reviews finish within 24 hours. Some take up to 3 working days.

5. Our legal basis

5.1 Your explicit consent, which you give by ticking the box next to this notice. It is separate from accepting our terms. We record that you gave it, and when.

5.2 If you withdraw consent, we may keep the match result and the ID document record we relied on, but not your selfie or face template beyond clause 6, because we need them to defend legal claims and to meet our duties to prevent fraud and financial crime.

6. How long we keep it

6.1 Your selfie and face template: deleted by us and by Dojah 30 days after the identity decision, or within 7 days of you withdrawing consent if that is sooner. The only exception is an open fraud investigation, case or legal hold about your check, and then only until it closes.

6.2 Your ID document records and the match result: kept for 5 years after your relationship with us ends, as anti money laundering law requires (clause 11 of the Privacy Policy).

7. If you do not want face matching

7.1 You can refuse. Leave the box unticked and choose Can't use the live scan? Send photos for review, or ask through Profile > Help or at privacy@pickupltd.com.

7.2 For a manual review you upload two photos: a photo of your ID, and a photo of you holding your ID, with your face and the ID in one picture. Trained staff look at them. No face matching software is used and no face template is made. This route still needs a photo of your face, and a person sees it. We delete the photo of you holding your ID 30 days after the decision. We keep the outcome, the ID document record and the name of the staff member. Most manual reviews finish within 24 hours. Some take up to 3 working days.

7.3 Refusing never changes your price or the trips you can book. A trip cannot start until the check is done, so submit it as soon as you can after booking. For a car or boat it is due 24 hours before the start, or before the trip starts if you book less than 24 hours ahead. For a jet it is due by the manifest deadline (24 hours before an international departure, 6 hours before a domestic one), or within 2 hours of booking if you book after that deadline, and never past wheels up. If you submit in time and our review is still running, you are not treated as cancelling. Otherwise a missed deadline counts as the Guest cancelling, and checkout warns you of this.

8. Withdrawing consent

8.1 You can withdraw at any time in Profile > Security > Identity check, through Profile > Help, or by writing to privacy@pickupltd.com.

8.2 We then delete your selfie and face template within 7 days, subject to clause 6.1, and stop using them. Withdrawal does not undo a check already completed. If you need to verify again, you can use the manual review.

9. Your rights and complaints

9.1 You can ask for a copy of your data, ask a person to review your result, or ask us to correct or delete data. See Data Protection: Your Rights.

9.2 Contact our Data Protection Officer at privacy@pickupltd.com. Pickup is registered with the Nigeria Data Protection Commission, registration number NDPC/DCP/14883. You may complain to the Nigeria Data Protection Commission at ndpc.gov.ng at any time.

10. The consent box

10.1 The box shown with this notice reads:

I agree that Pickup and its identity verification provider may capture my selfie and compare my face with the photo on my ID, only to confirm who I am, as set out in the Biometric Data Notice. I can choose a manual review instead and withdraw my consent at any time.

10.2 The box is never ticked for you. The camera does not open until you tick it.