Privacy Policy

Parffic is operated by Parffic Technology, a business name registered in Nigeria, based in Lagos, Nigeria ("Parffic", "we", "us").

Parffic Technology is the data controller for the personal data described in this policy: we decide why and how it is processed through parffic.com and the Parffic services that use the same account.

Contact for anything in this policy, including requests about your data: hi@parffic.com.

This policy explains how we handle personal data in line with the Nigeria Data Protection Act 2023 (the "NDPA") and the guidance of the Nigeria Data Protection Commission (the "NDPC"). We will update it as our services and legal requirements develop.

This policy applies to everyone who uses Parffic, including:

• Drivers who find car parks and reserve spaces
• Passengers who look up stops, routes and timetables
• Car park owners and their listings
• Transport operators, and the members of their teams
• People who visit parffic.com without an account

Car park owners and transport operators also handle information about the people who use their services (for example, checking a reservation at the gate). They are responsible for how they use that information outside Parffic.

Account information

• Your name and email address
• Your phone number, if you choose to give one
• Your password, which our sign-in provider stores only in protected (hashed) form; we never see it
• What you told us you use Parffic for (travel, parking, listing a car park or running a transport company), which only decides which page you see first

If you sign in with Google

• Your name, email address and whether Google has verified that email address. We do not access your Gmail, contacts, calendar, files or any other Google data.

Parking reservations

• The car park, and the bay if you choose one
• The arrival time and how long you plan to stay
• The price per hour the car park listed
• The vehicle plate number you enter
• The reservation reference and its history: reserved, checked in, checked out or cancelled, and any reason given

Problem reports, support requests and replies

• What you write when you report a problem with a reservation or open a support request, any reference you add, and the replies from Parffic staff

Payments (when online payment is switched on)

• The payment reference, amount, status, fee and any refund. Card and bank details are entered on the payment provider's page and never reach Parffic.

Payout accounts (transport operators and car park owners)

• The bank, the last four digits of the account number and the account holder's name as the bank returns it. The full account number is passed once to our payment provider to set up your payouts and is then deleted from Parffic's systems.

Notifications

• Your notification choices, and for each phone or browser where you turn on notifications, a push token or address issued by that device's notification service and a device label such as "Chrome on Windows"

Car park listings (car park owners)

• The car park's name, address, state and Local Government Area, and the map position of its entrance
• Price, number of spaces, opening hours, access notes, facilities and rules
• Photos and floor plans you upload, and the bay layout you draw
• Free-space counts and bay states you report, with the time you reported them
• A record of reservations and completed stays at your car parks

Transport operators

• Your organisation's name and contact email
• The names, email addresses and roles of the people in your team
• Your networks, stops, routes and timetables
• For private networks, the email addresses of the people you give access to

Other information you create

• Stops you save
• Notifications we show you in Parffic about your reservations and car parks

Information from your device

• Your IP address, browser and device type, which our hosting providers record when your device connects
• The cookies listed on our Cookies page, which are needed for sign-in

Staff records

• When Parffic staff take an action (for example, suspending a listing or answering a report), we record which staff member did it, what changed and why

We use your device's location only when you ask:

Your browser asks for your permission first, and you can refuse.

• Find stops near me (Transit): your location is sent to our servers once to find nearby stops. It is not stored.
• Near me (Parking): your location is used in your browser to sort car parks by distance. It is not sent to us.

The map position of a car park's entrance is part of its public listing.

Live vehicle tracking and passenger location sharing are not switched on. Parffic does not collect the location of vehicles, drivers or passengers. If we switch either on, we will update this policy before it starts and ask for your permission where the law requires it.

The NDPA requires a lawful basis for each use of personal data (section 25). We use your information:

To provide the service you asked for (performance of a contract with you)

• Creating and securing your account and signing you in
• Making, showing and updating your reservations, and telling the car park about them
• Publishing car park listings and transit information that owners and operators submit
• Giving people access to the private networks an operator shares with them
• Showing you notifications about your reservations and car parks
• Sending account emails, such as confirming your email address or resetting your password

To keep Parffic safe and working (our legitimate interests, balanced against your rights)

• Investigating problem reports between drivers and car parks
• Preventing fraud, misuse and attacks, and enforcing our Terms of Service
• Reviewing and, where needed, suspending listings
• Keeping records of staff actions
• Fixing faults and improving the service

With your consent

• Using your device's location when you press a near-me button
• Signing in with Google, when you choose to

To meet legal obligations

• Responding to lawful requests from courts, regulators or law enforcement

We do not sell personal data, show advertising, or make decisions about you based solely on automated processing.

Car park owners

• When you reserve, the car park sees the reservation reference, arrival time, duration, bay and vehicle plate number, and any problem report about it. They do not see your email address or phone number.

Transport operators (bus tickets, when online booking opens)

• When you book seats, the operator sees the lead passenger's name and the phone number you enter, your ticket reference, seats and boarding and drop-off stops, so it can carry you and contact you about that trip. It does not see your email address or payment details.

Payment providers (when payments are switched on)

• Paystack or Flutterwave processes card and bank payments. You enter your payment details on the provider's page; Parffic never sees or stores your card number. Parffic receives the payment reference, amount, status and fee.

Sponsored results

• Parffic counts how often a sponsored trip is shown and clicked, per day. These counts are not linked to you.

Other users

• Car park listings and public transit information are visible to everyone.
• Private transit networks are visible only to the people the operator gives access to, and the operator's team can see who has access.

Service providers who process data for us

These providers may only use the data to provide their service to us.

• Supabase: database, sign-in and file storage. Data is stored in London, United Kingdom.
• Vercel: hosting and delivery of the website.
• Google: only if you choose to sign in with Google.
• OpenFreeMap: map images. Your browser requests them directly, which shares your IP address with that service.
• Photon by Komoot: place search and address suggestions on the car park listing form. What an owner types, and the map position they choose, are sent to this service.
• Resend (when email is switched on): sends account, booking, payment and support emails. It receives your email address and the message.
• Expo and Google Firebase Cloud Messaging (Android app), and your browser's push service (web): deliver notifications you have turned on. They receive the push token and the notification text.

Authorities

• Where Nigerian law requires it, or to protect the rights, safety or property of our users or the public.

If Parffic Technology's business is reorganised or transferred, personal data may pass to the new operator under this policy.

Some of our service providers store or process data outside Nigeria. In particular, our database is hosted in London, United Kingdom.

We transfer personal data outside Nigeria only as permitted by Part VIII of the NDPA, which allows a transfer where the receiving country, or the arrangement with the recipient, gives adequate protection, or where another lawful condition in the Act applies.

You can ask us at hi@parffic.com for more information about these transfers.

We keep personal data only for as long as we need it for the purposes in this policy, or as the law requires:

• Account information: while your account is open.
• Reservations, problem reports, support requests and staff action records: kept so that drivers, car parks, operators and Parffic can refer to them, including when a problem is reported.
• Payment, refund and payout records: kept as tax and accounting law requires, even after an account is closed.
• Push tokens: removed when you remove the device, or when its notification service reports it is no longer valid.
• Location used by near-me buttons: not kept.
• Server and security logs: kept by our hosting providers for their own limited periods.

When information is no longer needed, we delete it or make it anonymous.

You can ask us to delete your account at any time (see Your rights). We may keep some records after that where the law requires it, or where they are needed to deal with a dispute or a legal claim.

Under the NDPA (sections 34 to 38) you have the right to:

• Be told how your personal data is used, as this policy does
• Get a copy of the personal data we hold about you
• Have inaccurate or incomplete data corrected
• Have your data deleted, where the law allows
• Restrict how we use your data in certain cases
• Receive your data in a commonly used, machine-readable format, and have it sent to another controller where possible
• Object to our use of your data based on legitimate interests
• Withdraw your consent at any time, without affecting what we did before you withdrew it
• Not be subject to a decision based solely on automated processing that significantly affects you

To use any of these rights, email hi@parffic.com from the email address on your account. We may need to confirm who you are before acting. We will reply within the time the law requires, and we will not charge you unless the law allows it.

You can change your name and phone number yourself on your Account page.

We use technical and organisational measures appropriate to the risk, including:

• Encrypted connections (HTTPS) for all data in transit
• Encryption at rest provided by our database host
• Database rules that let each person read and change only what they are allowed to
• Passwords stored only in protected (hashed) form
• Staff access limited by role, with staff actions recorded
• Testing of access rules before changes are released

No system is completely secure. If we become aware of a personal data breach that is likely to put your rights at risk, we will notify the NDPC and, where required, tell you, as the NDPA requires.

If you think your account has been used without your permission, email hi@parffic.com straight away.

Parffic is intended for people aged 18 and over, and our Terms of Service require account holders to be at least 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email hi@parffic.com and we will delete it.

We may update this policy when the service or the law changes. The date at the top shows the latest version. If a change significantly affects how we use your personal data, we will tell you in Parffic before it takes effect.

Parffic Technology, Lagos, Nigeria

Email: hi@parffic.com

If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission (NDPC), the regulator for data protection in Nigeria.