Privacy notice.

Kanat Automobile, trading as Kanat Automobile, of 189c Akarigbo Road, Sabo, Sagamu, Ogun State, is the data controller for the personal data described here. You can reach us at [email protected] or 0807 803 6114.

[TO CONFIRM] the name and address of the data protection officer or contact registered with the NDPR supervisory authority.

We collect only what a coach journey needs. In practice that is:

• Your account — first and last name, email address, phone number, and a password which is stored only as a cryptographic hash, never as text we can read. We also record when you last signed in.
• Your booking — the contact phone number and, if given, the contact email for the booking; the trip, seats and fare; and the booking reference.
• Each passenger travelling — first and last name, seat number, and optionally a phone number and an emergency contact name and number. If you book for someone else, you are giving us their details and should tell them so.
• Payment records — the provider used, that provider's reference for the transaction, the amount, and when it settled. See payment details below.
• Your wallet and points — the balance, and the record of each credit and debit against it, including refunds.
• Anything you send us — reviews, messages and support requests.

You can book without creating an account. If you do, we hold the booking and its passenger details, but no account record.

• To carry out the booking contract — reserving your seat, taking the fare, issuing the ticket, and producing the passenger manifest the coach travels with.
• To tell you what is happening — we send booking confirmations, ticket details and trip updates to the contact phone number and email on the booking, by email and text message.
• In an emergency — the emergency contact you give is used only if something happens to a passenger on a trip.
• To keep our records straight — reconciling payments, handling refunds and disputes, and meeting our accounting obligations.

We never see or store your card number, expiry date or CVV. Card and transfer payments are taken on the payment provider's own systems. What comes back to us, and what we keep, is the provider's reference for the transaction, the amount, whether it succeeded, and the provider's own response — which we retain so that a payment can be traced or disputed later.

Refunds are credited to the wallet on your account rather than reversed to the card, so a refund does not need your payment details to be stored or retrieved. See the refund policy.

We do not sell personal data, and we do not share it for advertising. We do share:

• Our payment providers — they receive what they need to take the payment and identify the transaction.
• Our messaging providers — the email address or phone number a confirmation or trip update is being sent to.
• Our own staff and drivers — the passenger manifest for a trip, which carries passenger names and seat numbers, is seen by the staff and driver working that trip. Staff actions on booking records are logged.
• Anyone we are legally required to share with — a lawful request from a regulator, a court, or the police.

Booking, payment and wallet records are kept for as long as they are needed to run the service and to meet our accounting and tax obligations. Account details are kept while the account is open.

[TO CONFIRM] the specific retention periods for each category, and the process for deleting a closed account. These are commitments Kanat Automobile has to set before this notice is final; no period is stated here because a period we cannot keep to would be worse than none.

Under the Nigeria Data Protection Regulation you may ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong — you can edit your own account details directly;
• delete data we no longer have a reason to keep — you can delete your account yourself, in the app or on this website; see how to delete your account;
• stop sending you messages that are not about a booking you have made;
• explain what we are doing with your data and why.

Write to [email protected]. We may ask you to confirm who you are before we act, so that we do not hand somebody else's travel details to the wrong person. If you are not satisfied with how we have handled a request, you can complain to the Nigeria Data Protection Commission.

Passwords are stored as hashes and cannot be recovered, only reset. Access to booking and passenger records by staff is controlled by role and is logged. Data is sent over encrypted connections.

Your ticket page can be opened by anyone holding its link, because that is what makes a ticket forwardable to the person travelling. Treat the link as you would the ticket itself.

When this notice changes, the updated version is published here. Material changes affecting bookings you have already made will be notified to the contact details on the booking.