Privacy Policy

1. Who we are

GioBiz is run by Henmack Integrated Technologies Ltd (RC 9537539), Lagos, Nigeria. In this policy, "we" means that company.

• General contact: support@giobiz.com
• Privacy questions and requests: support@giobiz.com (subject: Privacy)

2. What we collect

Your account

• Email address, phone number, WhatsApp number (optional) and your password (we store it in a protected form, never as plain text)
• Your name or business name, business address, state and city, and your role (for example owner, staff, rider, logistics company, warehouse)
• If you sign in with Google: your Google account email and name, which Google sends us
• Staff names, roles, staff ID and staff PIN (the PIN is stored only in a scrambled, salted form)

Your business records

• Products, prices, stock, photos and logos
• Sales and orders: items, amounts, order source, payment status and times
• Your customers' names, phone numbers and delivery addresses, and credit (owe-me) records
• Activity logs: which staff member did what, and when
• Payout bank account details you enter (account number and bank — never card details)

People who order from a shop link

If you order from a shop's GioBiz link without an account, we receive the name, phone number and delivery address you type, and the order itself. We hold these for the shop (see section 6.3, "Shops and their customers").

Identity checks

Some roles and paid features need an identity check (for example riders, verified sellers and some business accounts).

• Automatic check (Dojah). You give your NIN and take a selfie. We send the NIN and the selfie to our identity provider, Dojah, which checks the NIN and whether the face matches. We keep the result: the verified name and date of birth Dojah returns, a face-match score, a masked ID number (not the full number) and Dojah's reference.
• Check by a person. Where an ID or driver's licence is checked by our team instead, we keep the photo of the document and your selfie in private storage that only our review team can open.
• Riders may also tell us their ID type and the last 4 digits of the ID number when they sign up.
• Workers checked by an employer. Before a business checks a worker's identity, the worker is sent a code by email and must agree first.

A selfie and face-match score are sensitive personal data under the NDPA. We only process them with your clear agreement at the moment you start the check. You can refuse, but then the role or feature that needs the check will not be available.

Location

• Riders on a delivery: the rider's live GPS position is shared from their phone while they are working on deliveries (roughly every 30 seconds). For live tracking we keep the rider's latest position, with their name, phone, status and the shipment they are carrying; each new position replaces the last. A location saved as proof of pickup or delivery may stay with that shipment. The business that the delivery belongs to can see it on its map.
• Addresses and map points: pickup and delivery addresses, and the map coordinates for them, are stored with each shipment.
• Address search: when you type an address, what you type is sent to our map providers to suggest matches and work out routes — Photon (run by komoot, Germany) and Mapbox (USA).

We only ask a phone for its location where it is needed for a delivery, never on first open.

Messages and chat

• We store the messages you send in GioBiz chat and Messages, and any files you attach (attachments are kept in private storage).
• Business owners can read their own staff's chats. An owner can open, read-only, a chat that involves one of their own staff, after entering their PIN. Every time an owner opens a staff chat it is recorded in a log that cannot be edited. If you are staff, treat your work chats as visible to your employer.
• Hidden copies. An owner or manager can add a person to a message as a hidden copy (like "BCC" in email). Other people in the conversation do not see that person. Every hidden copy is recorded, with who added it and when.

Jobs and Talent

If you use Jobs or Talent as a job seeker: your profile, work experience, languages, job preferences, the CV documents you upload, your answers to job questions and whether you agree to be contacted. If you are an employer: your job posts and, where you use payroll, your workers' pay records.

Property, Services and Maride Rider Pool deliveries

• Property: listings, photos, requests and offers you make.
• Services: service requests and offers you make.
• Maride Rider Pool deliveries: sender and receiver names, phone numbers and addresses for each booking.

What we collect when you apply to MaRide

MaRide is a delivery partner on GioBiz. When you apply to work with MaRide — as a rider, or as a logistics company — GioBiz runs the application and the checks. Below is everything the application asks for or keeps, why, and who can see it. MaRide's own panel sees only what is named here.

If you apply as a rider

GioBiz checks your identity first; MaRide gives the final approval after.

• Your name, phone number, email and Rider ID. These are already on your GioBiz rider account, so the application shows them and does not ask again. Why: to know who applied and to contact you. Who sees it: GioBiz's review team. MaRide's panel sees your name, phone number and Rider ID — not your email.
• Your date of birth. You must be 18 or older to ride for MaRide, checked on the day you send the application; if you are under 18 that day, the application is refused. Why: riders must be adults. Who sees it: GioBiz's review team. It is never shown to customers or on MaRide's panel.
• Your NIN, a photo of your ID, and a live photo of your face (a selfie). Before the camera opens we tell you a live photo is needed and ask you to agree; you only continue if you agree. The photos are taken live with your phone's camera — on a computer you get a link or a QR code to finish on your phone. How it is checked today: a GioBiz staff member compares your ID photo and your selfie by hand. When automatic checks are switched on, your NIN and selfie are also sent once to our identity provider, Dojah, and MaRide pays for that check — never you. Who sees it: GioBiz's review team. MaRide's panel sees the last 4 digits of your NIN and "identity checked: yes / no", and, while your application waits for MaRide's final approval, your selfie — never your ID photo. The application records your NIN only as its last 4 digits. (The photo of your NIN slip or ID that we keep, below, does show the full number — it is in private storage only GioBiz's review team can open.)
• GioBiz keeps a copy of your NIN slip or ID photo and your selfie for KYC ("know your customer" — proof of who we checked). They are kept in private storage that only GioBiz's review team can open. Your ID photo is never given to MaRide's panel; your selfie is shown on MaRide's panel only while your application waits for MaRide's final approval.
• Your selfie becomes your rider profile photo. When you accept a delivery, the customer whose parcel you carry sees this photo, so they know who is coming. They see it only for that delivery, through a link that stops working soon after the trip ends. The location hidden inside the photo is removed before it is stored. Other customers do not see it. MaRide's panel sees your selfie (never your ID) while your application waits for MaRide's final approval.
• Your home address (and the state you live in) — required — and your state of origin. Why: so GioBiz knows where its riders live. Who sees it: GioBiz's review team. Not MaRide's panel, not customers.
• Where you ride (state and areas). Why: to offer you jobs where you work. Who sees it: GioBiz and MaRide's panel.
• Your vehicle — its type (chosen from a list), colour and plate number, and whether you own it or are allowed to use it. Why: to match jobs to what you ride, and so the customer can recognise you. Who sees it: GioBiz and MaRide's panel; and the customer whose delivery you accept sees the colour, type and plate while that delivery is in progress (for example "Your rider is on his way — red motorcycle, plate ABC 123 XY"). You are told this before you save it.
• An emergency contact — another GioBiz account holder. You find them by their GioBiz ID or phone number, and we keep their name and GioBiz ID, plus a phone number for them if you choose to add one. This is another person's details: only give them if that person agrees. Why: so GioBiz can reach someone if something happens to you on a job. Who sees it: GioBiz only. It is not shown on MaRide's panel or to customers.
• A company you ride for (its name, number and address) — optional, only if you have one. Who sees it: GioBiz's review team.
• What you agreed to. You read MaRide's terms in one place and agree with one tick. The terms cover MaRide's share of each fare, the per-trip protection contribution, the safety rules, privacy, sharing your location and the shipments you carry while you are available for or doing MaRide work, that GioBiz keeps a copy of your ID and selfie for KYC, and that your answers are true. We record the version of the terms you were shown and the time. Why: proof of what was agreed.

If you apply as a logistics company

The person who applies is the company's director (or the person the company names).

• Your company's public details: company name, business phone number, a short description, the routes and prices you deliver, and any drop-off points, opening hours and facilities you add. Why: to list your company on the Maride Rider Pool, where customers book deliveries. Who sees it: GioBiz and MaRide's reviewers while you wait. Once approved, customers see your company name, description, business phone number, routes and prices, and the drop-off points GioBiz has reviewed.
• Your own name, phone number and email. Taken from your GioBiz account, not asked again. Who sees it: GioBiz's review team, and MaRide's reviewers for the states you applied in. Never customers.
• Company registration: company address, CAC registration number (RC or BN), company status on the CAC register (active or inactive), Tax Identification Number (TIN), the state your company is registered in, and the director's full name. Optional: the director's home address and shareholding. Why: to confirm the company is real and who runs it. Who sees it: GioBiz's review team sees all of it. MaRide's reviewers for your states see the company name and address, the CAC number, the director's name and the state — not the TIN, the director's home address or the shareholding. Never customers.
• The director's NIN, a photo of the director's NIN card, and a photo of the director's face. You tick to agree first, and we record the time. How it is checked today: a GioBiz staff member checks them by hand. When automatic checks are switched on, the NIN and face photo are also sent once to Dojah, and the CAC register is checked only after that passes with matching names — MaRide pays for both, never you. The application records the NIN only as its last 4 digits, and that is all reviewers see as a number (the NIN card photo itself shows the full number, which is why only the people named here can open it). GioBiz keeps private copies of the NIN card and face photo, with the location hidden in the photos removed. Who sees them: GioBiz's review team; MaRide's owner or administrator for companies applying in MaRide's states may open the NIN card and the face photo, with one recorded press, through a link that expires after 5 minutes. Every opening is recorded. The same goes for the ID photo and live selfie your company's representative sends later to go live: GioBiz's review team checks them, and MaRide's owner or administrator for your states may open them on the same recorded press, as a copy with the hidden location removed, through a link that expires after 5 minutes. Never customers.
• If your identity is already verified on GioBiz, we do not ask for it again; we tell MaRide only that it was verified by GioBiz and on what date — never your NIN, date of birth or photos.
• The director's date of birth. Why: a director must be 18 or older, and we compare it with the date on the NIN record. Who sees it: you (to correct your own form). Reviewers see only "matches" or "does not match" — never the date. It is never shown publicly.
• What you agreed to: your agreement to the identity check (with its time) and your acceptance of MaRide's terms, including the commission percentage you were shown. Why: proof of what was agreed.

How long we keep it, and how to ask us to delete it

• We keep your MaRide application, and the KYC copies of your ID and selfie, while your GioBiz account is open. We have not yet set a fixed number of days; when we do, it will appear in our Data Retention Policy.
• When you ask us to delete your account, your account's contact details and identity record are removed, a rider's own rider record is deleted, and the photos in our private storage under your account (ID documents, the NIN card, selfies and face photos, and your profile photo) are deleted. Your MaRide application and your company registration are finished by a GioBiz staff member by hand, because they are linked to agreements and partner payment records.
• We keep, as proof: records of what you agreed to, the outcome of an identity check (passed or not, the last 4 digits and any reference), and any record that MaRide paid for a check.
• To ask what we hold about you, to correct it, or to delete it, email support@giobiz.com with "MaRide data" in the subject. See also section 9 and section 10.

Telegram, co-owners and credit transfers

We hold your Telegram bot token sealed, use it only to post to the channel you connected, and never read messages in your channel. Co-owners you invite can see your shop's records while they have access. Credit transfers record the sender and receiver GioBiz IDs.

Records of what you agreed to

When you accept our terms, a policy, a booking condition or a consent, we record what you accepted, the version, the time, your IP address and your browser/device details (user agent). We keep this as proof of what you agreed to.

Technical and security data

• IP address and device/browser type, used to slow down repeated sign-in attempts and to fight fraud
• One-time codes (OTP) and where they were sent — deleted when used or after at most 10 minutes
• Error reports when something breaks. We try to keep personal details out of them, but an error report can include the page address, your browser details and your IP address.
• Browser push subscriptions, if you turn on notifications (see section 6)

3. What we use it for

• To create your account, sign you in and keep it secure
• To run the app: products, sales, orders, staff, credit, deliveries, messages, jobs, property and services
• To show your shop to customers through your shop link
• To check identity where a role or feature needs it
• To arrange and track deliveries
• To take payment for GioBiz plans and credits
• To send you emails, texts and notifications about your account
• To run the AI features described in section 6.1
• To stop fraud, abuse and break-ins, and to keep the records the law requires
• To find and fix faults

We do not sell your data. We do not use it to build advertising profiles. We share it only as described in section 6.

4. Our legal reason for each use

The NDPA says we must have a lawful reason for each thing we do with personal data. Ours are:

5. What other people can see

When you publish products, anyone with your shop link can see your shop name, published products, descriptions, prices and photos, and the contact number you choose to show.

The order tracking page is open to anyone who has the tracking link. It shows the shop name, the items and total, the order status history (including the name of the staff member who updated it) and the name of the rider carrying it. It does not show the customer's phone number. Share a tracking link only with the person it is meant for.

6. Outside services that receive data

We use the companies below to run GioBiz. Each one receives only what it needs for its job. Some of them are outside Nigeria (see section 6.2).

Card details never reach GioBiz. When you pay for a plan or credits, you pay on the payment company's own page. We receive only a confirmation and a reference.

Riders and delivery companies you book receive the pickup and delivery details they need to do the job.

We update this list when we add or remove a company.

6.1 How we use AI

AI is used in these places, and only these:

• Ask Gio (the assistant). Your question and the records from your business needed to answer it are sent to OpenAI or Anthropic. Those records can include your customers' names, phone numbers and addresses. Recent questions and answers are saved with Upstash so a repeat question is answered faster.
• Product photo help. A product photo you upload can be sent to OpenAI to suggest the product name and details, and to Segmind to make a white background.
• Listing safety checks. Listing text and photos are checked automatically by OpenAI for banned or unsafe items. This check can reject a listing automatically. If you think it got it wrong, email support@giobiz.com and a person will look at it.
• Maride Rider Pool provider applications. Details in an application, such as the business name and director's name, are sent to OpenAI to help check them before a person decides.

We use these companies' business services, not their public chat apps. AI answers can be wrong — check anything important before you rely on it. If you do not want your data sent to AI, do not use Ask Gio or the photo help.

6.2 Data sent outside Nigeria

Many of the companies above store or process data outside Nigeria (marked in the table). We send data abroad only where the NDPA allows it — for example where the company is bound by contract terms that protect your data, or where the transfer is needed to give you the service you asked for.

6.3 Shops and their customers

For your own GioBiz account, we are the "data controller" — we decide how your data is used. For the records a business keeps about its own customers (names, phones, addresses, orders, credit), the business is the controller and GioBiz handles those records for the business, only to provide the service. If you are a shop's customer and want your details changed or removed, ask the shop first; you can also email us and we will help.

7. Cookies and storage on your device

GioBiz stores small pieces of information in your browser so the app works:

• Your sign-in session, so you stay logged in
• Your settings, such as the theme
• Progress through sign-up and some forms, so you do not lose what you typed

Our sign-in provider (Supabase) and Cloudflare may also set cookies needed for sign-in and security. Our pages load Sentry's error-report script, which reports errors only — session recording is switched off.

Counting Marketplace views. GioBiz counts how many times items on the Marketplace are viewed and tapped. These are totals only: the count carries no name, no phone number, no email and nothing that identifies you, and it stores nothing on your device. We do not use advertising trackers or analytics tools from other companies (no Google Analytics, no Facebook pixel). Clearing your browser's storage signs you out.

8. How long we keep data

• One-time codes: deleted when used, or after at most 10 minutes
• Your account and business records: while your account is open
• Sales, payment and tax records: for the period the law requires, even after the account is closed (up to 7 years)
• Records of what you agreed to (with IP and device details): while your account is open, and afterwards for as long as we may need to show what was agreed

The full list, including the items where we have not yet set a fixed number of days, is in our Data Retention Policy.

9. Deleting your account

Deleting an account is a request we complete within 30 days. It does not happen the moment you press the button.

• Business owners: in the app go to Settings → Delete my account and send the request.
• Everyone else (staff, riders, logistics and warehouse users, job seekers, shop customers), or if you cannot sign in: email support@giobiz.com.

We check that the request really comes from you, then delete your data. Some records the law requires us to keep — sales, payments and tax records — are kept for the legal period and then deleted. Copies in our backups disappear as old backups are replaced. Full details: Account Deletion.

10. Your rights

Under the NDPA 2023 you can ask us to:

• Access — give you a copy of the data we hold about you
• Correct — fix data that is wrong or incomplete
• Delete — erase your data (see section 9)
• Object — stop using your data for a purpose based on legitimate interest, or for marketing
• Restrict — pause using your data while a complaint is checked
• Portability — give you your data in a common file format
• Withdraw consent — where we rely on your consent (for example identity checks or marketing), you can withdraw it at any time. This does not undo what was done before.
• Human review — ask a person to look again at a decision made automatically, such as a rejected listing

Email support@giobiz.com with "Privacy" in the subject. We will check it is you, reply within 7 days, and complete the request within 30 days. If we cannot do something, we will tell you why.

Complaints. If you are not happy with how we handled your data, you can complain to the Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng. We would like the chance to put it right first, but you do not have to come to us first.

11. Keeping data safe

• Sign-in with Google or email and password. A text message code may be used to help you recover an account.
• All connections use HTTPS encryption.
• Each business's data is kept separate from every other business's, by our server and our database rules.
• Repeated sign-in attempts are slowed down and blocked.
• Staff PINs and passwords are never stored as plain text.
• ID photos, selfies and message attachments are kept in private storage, not on public links.
• Location details are removed from photos you upload (photos can carry the GPS position of where they were taken).

12. If something goes wrong (data breach)

If personal data is lost, stolen or seen by someone who should not see it, we will act to contain it, report it to the NDPC within 72 hours of finding out where the NDPA requires, and tell the people affected without delay if it is likely to put them at risk — saying what happened, what data was involved and what they should do.

13. Age — adults only

GioBiz is for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a child has an account or has given us their details, email support@giobiz.com and we will delete it.

14. Changes to this policy

When we change this policy we update the version and date at the top of this page. For important changes, we will also tell you in the app.

15. Contact us

• Email: support@giobiz.com
• Privacy questions and requests: support@giobiz.com (subject: Privacy)
• WhatsApp: WhatsApp support
• Henmack Integrated Technologies Ltd (RC 9537539), Lagos, Nigeria