Privacy Policy

Information We Collect

We collect information you provide directly, information generated automatically when you use our Services, and information obtained from third-party partners. The categories of personal data we collect are described below.

1.1 Information You Provide Directly

1.2 Information Collected Automatically

How We Use Your Information

We use your personal data only for the purposes described below. We do not sell your personal data to third parties for marketing purposes.

2.1 Service Delivery (Core Purpose)

• Processing and fulfilling your food orders and table reservations
• Communicating real-time order status updates (preparing, ready, served)
• Facilitating secure payment processing and Paystack-gateway settlement between customers and restaurant partners
• Maintaining your account, order history, and preferences
• Enabling restaurant managers to receive, manage, and fulfil orders placed through the platform

2.2 Safety & Fraud Prevention

• Verifying user identity and preventing unauthorised access to accounts
• Detecting, investigating, and preventing fraudulent transactions, chargebacks, and abuse
• Monitoring for suspicious activity patterns that indicate platform misuse
• Complying with financial regulations and payment processor requirements

2.3 Communications

• Transactional messages: Order confirmations, reservation confirmations, payment receipts, status updates — these are essential to our service and cannot be opted out of while you hold an active account
• Service notifications: Alerts about account security, policy changes, and platform updates
• Marketing communications: Promotional offers, new restaurant announcements, and platform features — only with your explicit consent, and you may opt out at any time

2.4 Platform Improvement

• Analysing usage patterns to identify and resolve bugs, performance issues, and usability bottlenecks
• Conducting aggregated, anonymised analytics to improve menu recommendations and restaurant discovery
• Testing new features with consenting users before full rollout

2.5 Legal & Regulatory Compliance

• Meeting obligations under the Nigeria Data Protection Regulation (NDPR) 2019
• Responding to lawful requests from Nigerian regulatory authorities and courts
• Maintaining records required under the Companies and Allied Matters Act (CAMA) and the Federal Inland Revenue Service (FIRS)
• Resolving disputes and enforcing our Terms of Service

Legal Basis for Processing

Under the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023, we are required to identify a valid legal basis for each category of personal data processing. Our legal bases are as follows:

Information Sharing & Disclosure

We share personal data only in the following limited circumstances:

4.1 With Restaurant Partners

When you place an order or make a reservation, we share the following information with the relevant restaurant partner to fulfil your request:

• Your first name and last initial (e.g., "Adaeze O.")
• Your order details, table number, and requested arrival time
• Reservation details (date, time, party size, special requests)
• Your phone number — only if the restaurant needs to contact you about your order or reservation

Restaurant partners are bound by our Partner Data Processing Agreement and are prohibited from using your data for any purpose other than fulfilling your order or reservation.

4.2 With Technology Service Providers

We engage third-party technology providers who process data on our behalf as data processors under binding data processing agreements. See Section 5 for the complete list.

4.3 For Legal and Regulatory Compliance

We may disclose your personal data without prior notice where required by:

• A valid court order, subpoena, or warrant issued by a Nigerian court of competent jurisdiction
• A lawful request from the Nigeria Data Protection Commission (NDPC), the Central Bank of Nigeria (CBN), the Economic and Financial Crimes Commission (EFCC), or any other competent Nigerian regulatory authority
• Our obligations under applicable anti-money laundering (AML) and counter-terrorism financing (CTF) regulations

4.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of our assets, your personal data may be transferred to the acquiring entity. We will notify you by email and/or prominent in-app notice at least 30 days before your data becomes subject to a materially different privacy policy, and you will have the right to delete your account during this period.

4.5 With Your Consent

We may share your data with third parties where you have given us explicit, specific, informed, and unambiguous consent to do so.

Third-Party Service Providers

We use the following sub-processors to operate our platform. Each is bound by a data processing agreement and is required to apply technical and organisational security measures equivalent to or exceeding our own standards.

Payment Processing & Financial Data

All payment transactions on PrioEat are processed by Paystack Payments Limited, a CBN-licensed payment service provider and a subsidiary of Stripe, Inc. Paystack operates at PCI-DSS Level 1 — the highest level of payment security certification in the industry.

What PrioEat Does NOT Store

• Full payment card numbers (PAN)
• Card verification values (CVV/CVC)
• Card PIN numbers
• Bank Account Numbers (BVN-linked or otherwise)

What PrioEat Stores

• Paystack payment reference numbers (alphanumeric transaction identifiers)
• Transaction amounts, platform fees, and timestamps
• Payment status (pending, collected, refunded)

Payment Model — 100% Online Settlement

PrioEat charges the full order amount (food subtotal plus PrioEat's platform fee) in-app at the time of ordering. Nothing is collected on arrival at the restaurant. Paystack splits the payment at the gateway between the restaurant's registered Paystack subaccount (food revenue, minus Paystack's processing fee) and PrioEat's main account (platform fee). For restaurants whose Paystack subaccount has not yet been provisioned, the food portion is held temporarily by PrioEat and disbursed to the restaurant on settlement day.

No Separate VAT Line

Menu prices are inclusive of any applicable tax the restaurant chooses to embed. PrioEat does not compute, display, or charge VAT as a separate line item. Restaurants remain responsible for their own tax obligations to Nigerian tax authorities.

Platform Fee

PrioEat charges a single platform fee per order: a ₦1,000 base plus 2.5% of the order value above ₦20,000 (subject to a configurable floor and ceiling). Member-tier customers (Bronze / Silver / Gold / Platinum) receive a percentage discount on this fee, applied automatically at checkout. The final fee — including any tier discount — is always shown before payment.

Cancellations & Refund Policy

If you cancel a paid order, or if a restaurant cancels your confirmed order, the full charged amount (food plus platform fee) is issued to you as PrioEat Credit — a balance held in your in-app Wallet, redeemable on a future order at the same restaurant. Credit issued by a restaurant that is later suspended automatically converts to platform-wide credit, usable at any active restaurant. PrioEat Credit does not expire. PrioEat does not process cash refunds or Paystack reversals to original payment methods; every refund is issued as PrioEat Credit only.

Push Notifications

PrioEat sends push notifications to keep you informed about your orders and reservations. These notifications are powered by Google Firebase Cloud Messaging (FCM).

Types of Notifications We Send

• Order status updates: "Your order is being prepared", "Your order is ready", "Your table is ready"
• Reservation reminders: Confirmation and day-of reminder for upcoming reservations
• Payment confirmations: Receipt of successful payment processing
• Platform announcements: New restaurant partners, promotional offers (only if you have opted in)

Managing Notifications

You may manage push notification permissions at any time through your device's system settings (iOS: Settings → PrioEat → Notifications; Android: Settings → Apps → PrioEat → Notifications). Disabling notifications will not affect your ability to use the app, but you will not receive real-time order updates until notifications are re-enabled.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. Our retention schedules are as follows:

Upon account deletion, we will anonymise or securely delete your personal data within 30 days, except where retention is required by law (as noted above). Anonymised, aggregated data that cannot be used to identify you may be retained indefinitely for statistical purposes.

Data Security

We implement industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security programme includes:

Technical Measures

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• Encryption at rest: Database data is encrypted at rest using AES-256 by our infrastructure provider (Supabase/AWS)
• Row-Level Security (RLS): Our database enforces granular access controls — each user can only access their own data; restaurant managers can only access data for their own restaurant
• Authentication: Passwords are hashed using bcrypt with a unique salt. We never store plaintext passwords
• API security: All API endpoints require authenticated JWT tokens. Our service role key (with elevated database access) is never exposed in client-side code
• Payment security: No card data is processed or stored on PrioEat infrastructure — all payment data flows exclusively through Paystack's PCI-DSS Level 1 certified systems

Organisational Measures

• Access to production systems is restricted to authorised personnel on a need-to-know basis
• All platform administrators are authenticated individually with audited access logs
• We conduct regular reviews of access permissions and security configurations

Your Rights & Choices

Under the Nigeria Data Protection Act (NDPA) 2023, you have the following rights with respect to your personal data. We will respond to all valid requests within 30 days of receipt (extendable to 60 days for complex requests, with notice to you).

To exercise any of the above rights, please contact our Data Protection Officer at privacy@prioeat.com with the subject line "Data Rights Request — [Your Full Name]". We may require identity verification before processing your request.

Cookies & Tracking Technologies

Our mobile application does not use cookies. Our website (prioeatng.com) uses a limited set of cookies as described below.

We do not use advertising cookies, third-party tracking pixels, or any cross-site tracking technologies. You may clear cookies at any time through your browser settings; however, this will log you out of active sessions.

Children's Privacy

PrioEat is not directed at, and does not knowingly collect personal data from, children under the age of 13 years (or under 16 years where a higher age applies under local law). Our Services are intended for use by persons aged 13 and above; persons under 18 should use the platform only with parental or guardian supervision.

If we become aware that we have inadvertently collected personal data from a child under 13, we will take immediate steps to delete that information from our systems. If you believe we may have collected data from a child under 13, please contact us immediately at privacy@prioeat.com.

Our mobile application is rated 4+ on the Apple App Store and Everyone on Google Play. This rating reflects the absence of objectionable content, violence, or adult themes in our application.

International Data Transfers

PrioEat is based in Nigeria, and our primary operations are conducted within Nigeria. However, some of our technology service providers (notably Supabase, Firebase, and Vercel) are headquartered in or operate infrastructure in the United States.

When we transfer personal data outside Nigeria, we ensure that adequate safeguards are in place in accordance with the NDPA 2023 and the NDPC Transfer of Personal Data Across Borders Regulations 2023. Safeguards used include:

• Standard Contractual Clauses (SCCs) — binding contractual obligations on the receiving entity to protect your data to Nigerian standards
• Adequacy determinations — where the NDPC has determined that the destination country provides an adequate level of protection
• Binding Corporate Rules — where applicable within corporate group structures

You may obtain a copy of the specific safeguards applicable to any international transfer by contacting our Data Protection Officer.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Send you an in-app notification and/or email notification at least 14 days before the new policy takes effect (for material changes)
• For changes that significantly expand our collection or use of your personal data, we will seek your renewed consent

Your continued use of our Services after the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the updated policy, you must discontinue use of our Services and may request deletion of your account.

All previous versions of this Privacy Policy are archived and available upon request.

Governing Law & Dispute Resolution

This Privacy Policy is governed by and construed in accordance with the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and all applicable regulations issued by the Nigeria Data Protection Commission (NDPC).

Any dispute arising from this Privacy Policy or our data processing practices shall be subject to the exclusive jurisdiction of the courts of the Federal Capital Territory, Abuja, Nigeria, without prejudice to your right to lodge a complaint with the NDPC.

Regulatory Oversight

PrioEat Technologies Limited operates under the regulatory oversight of the Nigeria Data Protection Commission (NDPC). Our Data Protection Compliance Organisation (DPCO) registration and our annual Data Protection Audit reports are available upon request.

Contact & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us through any of the channels below. We take all privacy enquiries seriously and will respond within 5 business days.