Data Protection: Your Rights
A plain language guide to your data rights, how to make a request, and how long we take to respond.
Updated 2 November 2026 · 8 min read
Version 3.0. Effective 2 November 2026.
In short
Your data is yours. You can ask us what we hold, fix it, delete it, take it elsewhere, or tell us to stop using it. Email privacy@pickupltd.com or write to us through Profile > Help in the app. It is free. Some rights have limits: we must keep some records by law, and an active booking, a crew trip or an open case you opened stops you deleting your account. To delete, see Delete your account. We reply within the times below.
This guide explains the rights in clause 12 of our Privacy Policy. If the two differ, the Privacy Policy applies.
This summary is for convenience only. The numbered sections below, and the Privacy Policy, govern.
1. Your rights
| Right | What it means for you | Law |
|---|---|---|
| Know | We tell you what we collect and why. This page and the Privacy Policy do that. | NDPA s.27 |
| Access | Get a copy of the personal data we hold about you, with why we use it, who receives it and how long we keep it. | NDPA s.34 |
| Correct | Fix anything wrong or incomplete. Most details you can edit in the app. | NDPA s.34 |
| Delete | Ask us to erase data we no longer have a lawful reason to keep. | NDPA s.34 |
| Restrict | Ask us to pause using your data while we check accuracy or consider an objection. | NDPA s.34 |
| Object | Tell us to stop using your data where we rely on legitimate interest. Marketing stops absolutely. | NDPA s.36 |
| Move | Get the data you gave us in a machine readable file, or have it sent to another company. | NDPA s.38 |
| Withdraw consent | Change your mind about anything based on consent, such as marketing, analytics, the AI help chat, Pickup Tag discovery or face matching at the ID check. Withdrawing is as easy as agreeing. | NDPA s.35 |
| Human review | Ask a person to review any automated result, such as a no match at the identity check or a fraud risk flag, give your side, and get the main reasons. Automated scores never decide alone. | NDPA s.37 |
| Complain | Complain to the Nigeria Data Protection Commission at any time. | NDPA s.46 |
These rights also belong to Travellers, Operator directors and Assigned Crew, not only Guests.
Operators. The Operator on your Booking is responsible for its own use of the details it receives for your trip. You can make a request to the Operator directly, or send it to us and we will pass it on and help.
2. How to make a request
2.1 Where. Email privacy@pickupltd.com, for the attention of our Data Protection Officer, or write to us through Profile > Help in the app. A request takes effect when we receive it. We reply in the app or to the email address on your account.
2.2 What to tell us.
(a) Which right you are using. (b) Your name and the email or phone number on your account. (c) Any Booking reference the request concerns.
2.3 Identity check. We confirm it is you before we disclose or change anything. Usually a code sent to your account email is enough. We never send codes by SMS or WhatsApp, and we never ask you to read a code out to us. We ask for more only if we need to, and we use it only to confirm the request.
2.4 On someone else's behalf. Send written authority from that person, or proof of legal authority such as a power of attorney. Parents and guardians should see clause 14 of the Privacy Policy.
2.5 Travellers and jet passengers. If someone else booked your trip or entered your passenger details, you can still make a request about your own data. Tell us the Booking reference if you know it.
2.6 Cost. Free. If a request is clearly unfounded or excessive, or repeats one we have just answered, we may charge a reasonable fee based on our costs or decline, and we will explain why.
3. Response times
| Step | Time |
|---|---|
| We acknowledge your request | Within 7 days |
| We complete your request | Within 30 days of receiving it, or of confirming your identity if we need to |
| Complex or multiple requests | We may extend by up to two further months. We tell you within the first 30 days, with the reason and the new date |
| Marketing opt out | Takes effect immediately for new messages; within 7 days for anything already scheduled |
| Guests in the UK or EU, who may also have rights under UK GDPR or EU GDPR | One month, extendable by two further months, with notice |
4. When we cannot do everything you ask
4.1 Records we must keep. Tax, anti money laundering and limitation rules require us to keep some records (see clause 11 of the Privacy Policy). Financial, booking, tax and anti money laundering records stay for 5 years. If you ask for deletion, we delete what we can, keep what we must with your identity removed where possible, and tell you which is which.
4.2 Open matters. If a dispute, safety incident or lawful authority request is open, we keep relevant records until it closes.
4.3 Other people's data. We will not give you another person's personal data unless they agree or the law allows it.
4.4 Crime prevention. If telling you would prejudice the prevention or detection of crime, the law may stop us from explaining. Where it does not, we always give reasons.
4.5 Private flags and reviews. If an Operator or crew member has raised a private flag about your conduct, you can ask for the data we hold about it. We may withhold details that would identify the person who raised it, or put someone at risk, and we tell you when we do. Reviews Operators write about you are shown to you once they are released.
5. Quick actions in the app
- Edit your details: Profile > Personal details. Tap your name, phone number, email, photo or home address.
- Remove a saved card or bank account: Profile > Wallet and payments.
- Remove an emergency contact: Profile > Emergency contacts.
- Remove a travel companion: Profile > Travel companions.
- Withdraw consent to face matching: Profile > Security > Identity check, or ask through Profile > Help, or email privacy@pickupltd.com. We delete your selfie and face template within 7 days, unless an open fraud investigation, case or legal hold requires us to keep them. You can verify by manual review instead. See the Biometric Data Notice.
- Remove an assistance need: Profile > Personal details, under Accessibility needs.
- Signed in devices: Profile > Security > Devices. Sign out of any device you do not recognise.
- Face ID or fingerprint unlock: turn it off in Profile > Security or your phone's settings. It never leaves your phone.
- Location, camera and notifications: your phone's settings. The app works without location permission.
- Marketing: switch off News and offers from Pickup in Profile > Notifications, and Personalised marketing in Profile > Privacy and your data > Tracking, use the unsubscribe link in any marketing email, or ask us through Profile > Help.
- Analytics and the AI help chat: Profile > Privacy and your data > Tracking.
- Pickup Tag discovery: Let friends find me by my Pickup Tag in Profile > Privacy and your data.
- Trip notifications: your phone's settings, or Profile > Notifications.
- Cookies on the website: nothing to set. The website uses no optional cookies, as the Cookie Policy explains.
- Get a copy of your data: Profile > Privacy and your data > Request a copy of your data, or email privacy@pickupltd.com. We send it within 30 days as a machine readable file to the email address on your account.
- Delete your account: Profile > Security > Delete my account, then enter the code we email you and type DELETE. Operators close the operator account first, and crew close the crew record first. It takes effect at once, cannot be undone, and loses any wallet credit. You cannot delete it with an active booking, a crew trip you are assigned to or an open case you opened. The screen tells you which applies. If you cannot use the app, email privacy@pickupltd.com from your registered address with the subject "Delete my account". Deleting the app from your phone does not delete your account. See Delete your account and clause 11 of the Privacy Policy for what we delete, what we keep and for how long.
- See who handles your data for us: our Sub-processors page.
- Biometric data: see the Biometric Data Notice.
Menu names may change slightly as the app is updated. If you cannot find an option, ask us through Profile > Help or at privacy@pickupltd.com.
6. If you are not happy
6.1 Reply to our response within 30 days and ask for review. Our Dispute Resolution page sets out each step. A person not involved in the first answer reviews it and replies within 14 days.
6.2 Complain to the Nigeria Data Protection Commission at ndpc.gov.ng at any time.
6.3 UK and EU Guests may also complain to the UK Information Commissioner's Office or their EU data protection authority.
7. Changes
7.1 We update this guide whenever the Privacy Policy changes, with the same notice the Privacy Policy gives. If the two differ, the Privacy Policy applies.
Questions about this document?
Email legal@pickupltd.com or write to Pickup Technology Limited, Lekki Phase 1, Lagos State, Nigeria. For help with a booking, use Help in the app.
Contact legal