Privacy Notice

1. Who we are

Foodster is operated by Foodster Retail Limited (RC 6912929), UL38 Palms Shopping Mall, Ring Road, Ibadan, Oyo State, Nigeria. We are the data controller for the personal data described here: we decide what is collected and why.

This notice covers foodster.ng, the Foodster mobile apps, our kitchens and counters, and the messages we exchange with you. Foodster runs on commerce software provided by Eleo, which processes data on our instructions as our service provider — Eleo does not decide what happens to your data.

Questions, requests or complaints about this notice: [email protected] or 0809 119 9001.

2. What we collect

Depending on how you use Foodster:

• Who you are — name, phone number, email address, and the password or sign-in method on your account.
• Your orders — items, options and quantities, the kitchen you ordered from, pickup or delivery choice, collection time, delivery address, notes and allergen or preparation requests.
• Payments — amount, currency, time, status, payment method type, and the reference our payment provider returns. Card numbers are entered on the provider's own hosted form; we never receive or store your full card number.
• Foodster credit and refunds — balance, top-ups, spend, and refund records.
• What you write to us — chat messages, ratings and reviews, support requests, WhatsApp and phone conversations, and anything you ask our Oja AI assistant.
• Job applications, where you apply for a role — your CV and the details you submit with it.
• Device and usage data — IP address, device and browser type, approximate location derived from your IP or the state you pick, pages and items viewed, and error and performance diagnostics. See our Cookie Policy for the storage behind this.

Most of this comes from you directly. Some comes from your device automatically, and some from our payment, delivery and messaging providers when they report the outcome of something you asked for.

Some fields are simply required: without a name, phone number and — for delivery — an address, we cannot accept or fulfil an order. Everything else is optional, and leaving it out only costs you the feature it powers.

3. Why we use it, and our lawful basis

Section 25 of the Nigeria Data Protection Act 2023 requires a lawful basis for every use. Ours:

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

4. Who we share it with

We share only what each recipient needs to do its job:

• Our kitchens and staff — the order, your first name and contact number, and any preparation note.
• Payment providers such as Paystack, and card networks and banks behind them, to take payment and process refunds. They handle card data as controllers in their own right, under their own notices.
• Delivery partners such as Chowdeck, and the rider assigned to your order, where you choose delivery — your name, number, address and delivery note.
• Technology providers that run Foodster for us: Eleo (commerce platform and hosting), Google Firebase (sign-in, push notifications, crash and performance diagnostics), Google Cloud Platform (hosting), and our email, SMS and WhatsApp messaging providers.
• Professional advisers — accountants, auditors and lawyers, bound by confidentiality.
• Authorities — including the Nigeria Data Protection Commission, the Federal Competition and Consumer Protection Commission, NAFDAC, tax authorities and law enforcement, where the law requires it or to establish or defend a legal claim.
• A buyer or successor, if the business or part of it is ever sold or reorganised. We would tell you first where the law requires it.

Everyone processing data on our behalf is bound by a written contract to use it only on our instructions and to protect it.

5. Sending data outside Nigeria

Some of our providers — including Google and other hosting and messaging vendors — store or process data outside Nigeria. Under sections 41 to 43 of the NDPA we only do this where the destination gives adequate protection, or where our contract with the provider imposes equivalent safeguards, or where the transfer is necessary to perform our contract with you. Ask us and we will tell you which applies to a given provider.

6. How long we keep it

Backups roll off on their own schedule shortly after the live record is deleted. Where a legal hold, dispute or investigation applies, we keep the relevant records until it ends.

7. Automated decisions and Oja AI

We do not make decisions with legal or similarly significant effects on you by automated means alone. Automated fraud and payment-risk checks may flag an order for review, but a person decides before an order is refused, and you can ask us to explain and to reconsider.

Our Oja AI assistant reads what you type to it, along with your basket and our menu, so it can suggest and help assemble an order. It is a convenience, not advice: always check allergen and ingredient information with us before you rely on it. See the AI section of our Terms.

8. Your rights

Under the NDPA you may ask us to:

• confirm what we hold about you and give you a copy;
• correct anything inaccurate or incomplete;
• delete your data where we no longer need it — see Account & data deletion;
• restrict how we use it while a dispute about it is resolved;
• give you, or another provider, a portable copy of the data you gave us;
• stop using it where we rely on legitimate interests, including for analytics; and
• stop marketing to you — always, immediately, and with no reason needed.

Where we rely on consent you can withdraw it at any time, and withdrawing is as easy as giving it: use the unsubscribe link in any marketing message, reply STOP to an SMS, change your analytics choice on the Cookie Policy page, or email us. Withdrawing consent does not undo what we did lawfully beforehand.

To exercise any of these, email [email protected]. We may need to verify who you are before we act. We respond within one month; if a request is complex we will tell you and may take longer, as the NDPA allows. There is no charge unless a request is manifestly unfounded or excessive.

If you are not satisfied with how we handle it, you may complain to the Nigeria Data Protection Commission — ndpc.gov.ng. Please give us a chance to put it right first.

9. Children

Foodster accounts are for adults. We do not knowingly create accounts for, or market to, anyone under 18. A parent or guardian may of course order food for a child. If you believe a child has given us personal data, tell us and we will delete it.

10. Keeping it safe

We use encryption in transit, access controls that limit staff to the data their role needs, logging and monitoring, and vendors who are contractually held to the same standard. No system is perfectly secure, but if a breach occurs that is likely to put your rights at risk we will report it to the Nigeria Data Protection Commission within 72 hours and tell you where the NDPA requires it.

11. Changes to this notice

We update this notice when Foodster, the law or our providers change. The date at the top always reflects the current version, and we will give you clearer notice — in the app, by email, or both — before any change that materially affects you.