1. Introduction

SOS Express Limited ("we," "us," "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, store, disclose, and protect the personal information of our customers, website visitors, business partners, and other individuals ("you," "your") in the course of providing our logistics services.

We process your personal data in accordance with applicable Nigerian laws, including the Constitution of the Federal Republic of Nigeria 1999 (as amended), Nigeria Data Protection Act, 2023 (NDPA) and the General Application and Implementation Directive, 2025 (GAID) issued by the Nigeria Data Protection Commission (NDPC).

This privacy policy is applicable to our website www.sosexpressltd.com and any services we provide. It also applies to our marketing practices. We ensure transparency in all our dealings.

By using our website, services, or providing your information to us, you acknowledge you have read and understood this policy.

2. About Us

SOS Express Limited, a Nigerian logistics company duly registered with the Corporate Affairs Commission (CAC) with RC Number 8140571, with its registered office at 2B Lumsar Street, Abacha Estate, Zone 4, Wuse, Abuja, is the data controller responsible for your personal data.

3. Information We Collect

We may collect, use, store, and transfer different kinds of personal data, which we have grouped as follows:

Personal information collected on our website

As a general practice, no personal Information is collected about a visitor to the website, apart from the personal information submitted by the visitor himself/herself in a 'contact us' form. We shall use such Personal Information for the purpose you share it with us. However, at times, certain information may be collected from you when you visit the website. Such information is aggregated to measure the number of visits, average time spent on the website, pages viewed etc. This gives us an idea of which parts of our website users are visiting, in order that we may improve the content to offer you better services. We do not link IP addresses to anything personally identifiable. This means that a user's session will be tracked, but the user will be anonymous.

ID, Customer information for support and maintenance

When you register, create an ID with us or use our services, we collect information that is unique to you and identifies you. This may include your name, email address, phone number, contact address, and payment information. Please note that payment transactions are processed by our secure third-party payment processors, such as Paystack. We do not store your full credit/debit card or bank account details on our servers. Paystack and other third party payment processing platforms used by us may collect, process, and store your payment information in accordance with their own privacy policy. We only receive and store a transaction reference and confirmation details.

Information collected while using our website especially during activation and automatic updates

When our platform is used, information may be collected on how it is used. We may collect information (like an IP address, or the type of device used) that your browser or device typically sends to our servers whenever you use our website. We may use information that led you to our website, for example the search terms used or the device being used, through cookies and similar technologies. Often this information is anonymous and if associated with you kept strictly confidential. If you do not want us to collect this information, you can tell us by opting out or by either declining or customising cookie settings on our website.

Emails

We do contact businesses, customers and individuals as a part of our marketing campaigns. We do so, as we believe we have legitimate interest to promote our products and services and it also benefits our prospects. We do not do any mass mailing and carefully reach out to selected customers with a personalised approach. The emails we send you as part of our marketing campaigns allow us to know if you have received or opened the email, or clicked a link within the email. If you do not want us to collect this information from marketing emails, you can opt out of receiving such emails by clicking on the unsubscribe button.

Buttons or tools on our websites related to other companies and social media pages

Our websites may include buttons or tools that link to other companies' services (for example, a Facebook or Instagram button). We may collect information about your use of these features. In addition, when you see or interact with these buttons, tools, or content, or view our web page containing them, some information from your browser may automatically be sent to the other company. Please read that company's privacy policy for more information, as these sites may have their own privacy policies/notices in place, which we recommend you review if you visit any linked Websites. We are not responsible for the content of linked sites or any use of the sites or for the privacy practices of those other Web sites.

We may collect information when you interact with our social media pages or use the sign-on features.

Hosted services provided by SOS

We may provide hosted services to other companies that may sometimes require the collection of information through cookies and other technology to collect analytic data required by the product and to understand our users and their likely interests. No information is collected without consent.

4. How We Collect Your Personal Data

We use different methods to collect data from and about you:

You may provide us with your data by filling forms on our website, corresponding with us by post, phone, email, or in person, when you:

• Apply for or use our services.
• Create an account on our website.
• Subscribe to our service or publications.
• Request marketing materials.
• Give us feedback or contact us.

5. Where Do We Store This Data

Information and data files are stored on our servers and the servers of companies we hire to provide services to us. For the specific purpose of processing payments, we share necessary transaction and payment information with our certified third-party payment processors, such as Paystack.

We do not share, sell or lease any kind of information collected to any third parties for their marketing purposes.

6. Why Do We Process Your Personal Information

Subject to the purpose of processing, we may collect information through our websites, electronic and manual correspondences, telephone conversations and documents given to us by you or third parties:

• To register you as a new customer and provide logistics services.
• To manage our relationship with you, including notifications of policy changes.
• To fulfill our contractual commitment and to enhance the performance of our contract with you.
• To allow you use our platform and respond to your requests.
• To provide you with the services, support or information requested and monitor the effectiveness.
• To improve our website's user experience and communicate better to engage users.
• To send marketing emails or messages related our services and enhance the effectiveness of our marketing campaigns.
• To monitor aggregate metrics to conduct our market research and understand our customers better.
• To analyze, diagnose and fix issues in our service offerings.
• To make suggestions and recommendations about services that may interest you.
• To process payments for our services securely through our authorized third-party payment processors, such as Paystack.
• Any other purpose that we disclose to you in the course of providing our services to you.

In all cases, this information is not shared with any third party. We use it as stated above or to prevent/respond to protection of our website. In some cases like with hosted services, we may share information with those that provide us with technology services (e.g. web hosting and analytics services), but strictly for the purpose of carrying out our work. We may be required to share information with law enforcement or other third parties when compelled to do so by court order or other legal process, to comply with relevant and applicable laws.

7. How Do We Secure Information Collected

We understand that the security of your information is vital and have in place strong administrative, technical, and physical security controls and measures to keep data safe and secure. Our privacy practices are designed to provide protection for your personal information.

To protect information stored in our servers, access is limited (through user/password credentials and two factor authentication) to those employees who require it to perform their job functions. We use industry-standard Secure Socket Layer (SSL) encryption technology to safeguard the account registration process and sign-up information. Other security safeguards include but are not limited to multifactor authentication, data encryption, firewalls, and physical access controls to our building and files.

We would like to caution our visitors about phishing attacks, wherein unscrupulous third parties seek to extract sensitive and confidential information from you by posing as a genuine website or by sending an email misrepresenting it to be from a genuine source. Please be aware that we never seek sensitive or confidential information such as regarding your Bank Verification Number (BVN), National Identification Number (NIN), full credit/debit card and bank login details, and financial records, through emails or through our websites. If you receive such a message claiming to be from Us, then please do not reply to it and immediately bring it to our attention by contacting Us.

We also recognize the receipt, transmission or distribution of spam emails (unsolicited bulk emails) as a major concern and have taken reasonable measures, to minimize the transmission and effect of spam emails.

8. Lawful Basis for Processing

In processing the personal data of customers and users of our website and services, we rely on the following lawful basis:

• Consent: for the personal data surrendered or supplied to us by the data subjects, including our customers and users of our website and services.
• Legal obligation: for the personal data shared with us by users and customers in the performance of our services where required by law or regulatory bodies.
• Legitimate interest: for the personal data that have justifiably come into our custody in the course of carrying out our business and providing our services to our users and customers.
• Public interest: when such personal data is required in furtherance of public interest as provided by law.

9. How Do You Consent to the Processing of your Personal Information

When you voluntarily surrender, share or provide your personal data either manually or through our website platform, you give your consent to our processing of such information until your consent is withdrawn. This includes, where necessary for your requested service (e.g., making a payment), sharing your information with essential third-party payment processors like Paystack as described in this policy.

10. How Do You Withdraw Your Consent

If consent is the only legal basis on which we process your data, you can withdraw your consent by contacting us at sosexpressltd@gmail.com

11. Data Sharing

Your data processed by us may be shared with:

• Our employees who require it to perform their job functions.
• Authorized third-party service providers who process data on our behalf under strict contractual obligations (data processors). This includes Paystack, and other payment processing partners, to facilitate secure transactions.
• Law enforcement or regulatory bodies where required by law or to protect our legal rights.

We do not share, sell or rent your data for third-party marketing purposes.

12. Data Retention

We will retain your personal data only for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, contractual, accounting, or reporting requirements. Our retention periods are determined by the nature of the data, the purpose for processing, legal and contractual requirements, and our legitimate business interests. Your data may be retained for a period where you have not validly exercised your right to request deletion of personal data.

13. Your Legal Rights

Under the NDPA, you have rights regarding your personal data. To exercise any of these rights, please contact us using the details in Section 15.

• a. Right of access to your personal data.
• b. Right to request rectification and correction of inaccurate or incomplete data.
• c. Right to request deletion or erasure of your data.
• d. Right to object to further processing of your personal data.
• e. Right to data portability. You can request transfer of your data to you or another controller in a structured format.
• f. Right to withdraw consent at any time.
• g. Rights related to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing.

14. Cookies

Cookies are small text files stored on your device when you visit a website. They enable the site to remember your actions and preferences over time. When you visit our website (www.sosexpressltd.com) we use cookies to distinguish you from other users. This helps us provide you with a good experience and allows us to improve our site. We collect information such as your IP address, device identifier, browser type, operating system, information about your website use, and data regarding network-connected hardware (e.g a computer or mobile device) to provide customized services, content and advertising; ensure your account security is not compromised; mitigate risk; promote trust and safety on our website amongst others.

Cookies do not typically contain any information that personally identifies a user. However, the personal information we store about you may be linked to the information stored in and obtained from cookies.

You can set your browser to refuse all or some browser cookies, but this may impair website functionality.

15. Contact & Complaints

For questions about this policy, to exercise your data rights, or to make a complaint, please contact us at sosexpressltd@gmail.com

You can contact the Nigeria Data Protection Commission (NDPC) if you have any concerns about how we handle your personal data. You also have the right to make a complaint at any time to the NDPC, the Nigerian regulatory authority for data protection related issues.

You can find out more information about your rights as a data subject, their regulatory powers and actions they can take on their website at https://ndpc.gov.ng

16. Changes to This Policy

If we decide to change our privacy policy, we will post those changes on this page so our users are always aware of the information we collect and how we use it. If at any point we decide to use personally identifiable information in a manner different from that stated at the time it was collected, we will notify users by way of an email. Users will have a choice as to whether or not we use their information in this different manner. We will use information in accordance with the privacy policy under which the information was collected.