Privacy Policy

WasteAway is a service of Xzeiten Ltd (“we”, “us”), a private company limited by shares incorporated in Nigeria under the Companies and Allied Matters Act 2020, registration number RC 9740479. We operate WasteAway, a technology platform through which households, estates and businesses engage independent, verified collectors for waste collection, recyclables buy-back and estate waste management in Nigeria, starting in Abuja. This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have under the Nigeria Data Protection Act, 2023 (NDPA) and its subsidiary regulations.

1. Who is responsible for your data

Xzeiten Ltd (RC 9740479), trading as WasteAway, is the data controller for the personal data described in this policy. Contact us about anything privacy-related at privacy@wasteaway.ng or support@wasteaway.ng.

2. What we collect and why

We do not collect your precise device location in the background, we do not access your contacts or files, and we do not sell personal data to anyone.

3. If you contact us before you are a customer

If you fill in a form on this site — asking about an estate, or asking us to call you back — we collect only what the form shows you: your name, your phone number, and, for an estate enquiry, the estate's name, roughly how many units it has, your role there and the area it is in. We use it for one purpose: to have that conversation with you.

• We contact you, not your residents. An estate manager asking us for a quote is not permission to approach the people who live there. If we ever need to reach residents, we arrange it with the estate first.
• We keep it for twelve months from the day you send it, then delete it.
• You can stop it at any time.Email support@wasteaway.ng and say so, and we will delete the enquiry and stop contacting you. You do not have to give a reason and you do not need an account.
• We do not sell it or pass it on to anyone for their own marketing, and we do not add you to a mailing list you did not ask for.

4. Legal bases

We process your data under the NDPA on the bases of contract performance (providing the service you signed up for), legal obligation (tax and financial record-keeping), legitimate interests (fraud prevention, service safety, service improvement), and consent (optional marketing messages, which you can withdraw at any time in the app’s notification settings).

5. Who we share data with

• Collectors serving your pickup see your first name, the pickup address and postcode, your instructions, and a contact number, only for jobs assigned to them.
• Collectors working your area, before anyone takes the job. An unclaimed pickup appears to approved collectors covering your area with the street name but not your house number, a map position rounded to about 100 metres, and the waste type, time and price. Your name, landmark, instructions, photos, unit and contact number are not among them.
• Your estate, if you are a resident on an estate plan. The manager who runs your estate’s account sees your name and phone number on the estate’s member list, approves or declines pickups you request against the estate’s account, and receives a monthly report showing what each unit was collected, what was missed, what it cost, and what is still unpaid. They do not see your personal wallet or bookings you paid for yourself outside the estate. Your neighbours do not see any of this.
• Payment processing: Paystack (a Nigerian PCI-DSS-certified processor) handles card, transfer and USSD payments. For payouts, it receives the payout bank details, checks the account and sends the money to it.
• Cloud hosting: our servers and encrypted databases run on Amazon Web Services in Ireland, so your personal data is stored outside Nigeria.
• Maps: in-app maps and address search use Google Maps Platform on Android. On iPhone, maps are provided by Apple Maps.
• Push notifications: delivered via Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iPhone).
• SMS delivery: one-time login codes and key service updates (such as booking confirmations and collector arrivals) are sent through licensed Nigerian SMS providers.
• Crash and error reporting: the app sends crash reports and technical error details to Sentry so we can find and fix failures. These reports carry technical context, such as the app version, the type of failure and a request identifier. They never carry your name, phone number, address or account identity.
• Our website: wasteaway.ng is hosted by Vercel, which also gives us aggregated, cookie-free page-view counts. The website sets no advertising or tracking cookies. The only thing it keeps in your browser is your light or dark theme choice, so the page opens the way you left it.
• Authorities: only where the law requires it.

Some of these providers store or process data outside Nigeria, including our hosting in Ireland. Every such transfer is covered by contracts that hold the provider to protections consistent with the NDPA’s cross-border transfer rules, and Xzeiten Ltd remains responsible for your data.

6. How long we keep data

• Profile and identity-verification details: while your account is active.
• Transaction and financial records, including the bank details on each payout or withdrawal: kept for six years after account closure, the period Nigerian company and tax law requires accounting records to be retained.
• When an estate is handed over or closes, we keep a short record of what happened and when, without names or phone numbers, for six years.
• Reports of an issue on a job, such as a spill or an injury, and fraud reviews: kept for five years after the case is closed, so there is a record of what happened and what was done about it.
• Photos on a pickup or buy-back, including the collector’s proof photo: kept for twelve months after the job ends, then deleted. A photo needed for an open complaint, dispute or review is kept until that case is closed.
• In-app messages in your notification inbox, read or unread: kept for twelve months after they are sent, then deleted.
• App usage events: kept for 90 days after they are recorded, then deleted.
• Collector live location: only the latest position is stored, and it is deleted one day after its last update.
• One-time login codes: they expire within minutes and are stored only as one-way hashes.
• Sign-in tokens, which keep you signed in between visits: deleted 30 days after they expire.
• When you delete your account in the app (Profile → Delete account), the name, email and photo on your profile and the identity details on your account are removed immediately, and the account can never sign in again. Some data stays. We keep the records of every pickup, plan, buy-back and payment on the account, with the notes, complaints and ratings attached to them. The photos on those records are kept for twelve months after the job ends, as set out above. We keep every address saved on the account, including the addresses attached to those past collections. If you applied to collect, we keep the vehicle and licence facts from a collector record, with your work record and your name on any collection you carried out as a collector. We keep the bank details on any payout or withdrawal you requested, and any issue report or fraud review until five years after it is closed. Your name, phone number, role and unit stay on the member list of any estate you joined or set up. An estate you set up stays registered to you until another member takes it over. The messages we sent you and records of how you used the app stay with the closed account for the periods set out above. Your security and notification settings stay with the closed account, and so does the reference our payment processor gave us for each card you saved. The phone number the account was registered to stays too: it keeps those records attributable and stops the number being recycled into your old account. How to delete your account lists what goes and what stays, and why.
• An account holding money it can still pay out is not deleted. Collector earnings are cleared by requesting a payout to your bank account. Wallet money pays for WasteAway pickups and plans, and the app has no way to send it to a bank account, so a wallet balance is cleared by spending it, or by confirming in the app that you give it up.

How to delete your account sets out both routes, in the app and by email, and what is erased and what is retained.

7. Your rights

Under the NDPA you can ask us to access, correct, delete, or export your personal data, object to certain processing, and withdraw consent. Most of these are available directly in the app; for anything else, including deleting your account without the app, email privacy@wasteaway.ng. We respond within 30 days. You can also lodge a complaint with the Nigeria Data Protection Commission (NDPC).

8. Security

Data is encrypted in transit (TLS) and at rest. Access follows least-privilege: login codes are stored hashed, sessions use short-lived rotating tokens, and money movements are recorded in an append-only ledger. If a breach affects you, we will notify you and the NDPC as the NDPA requires.

9. Children

WasteAway is not directed at children under 18. We do not knowingly collect their data; if you believe a child has created an account, contact us and we will delete it.

10. Changes

We will post any changes here and update the effective date; material changes are announced in the app. This version, effective 4 August 2026, names Xzeiten Ltd (RC 9740479) as the data controller. It also updates how each kind of balance is cleared before an account can be deleted: wallet money pays for WasteAway services, the app has no way to pay it out to a bank account, and what is left in the wallet, together with the unused part of any plan you pay for yourself, can be given up when you delete. An update of 1 September 2026 added our error-reporting and website providers (Sentry and Vercel), named Apple Maps as the map provider on iPhone, and stated that data is hosted in Ireland. An update of 12 September 2026 sets out what deleting your account keeps: the financial and collection records the law requires us to keep, the addresses attached to those collections, and the phone number the account was registered to. An update of 27 September 2026 adds issue reports and fraud reviews to what deleting your account keeps, and says how long they are kept: five years after the case is closed. It also lists the bank details we keep when you request a payout, including the account holder’s name our payment processor gives us when it checks the account. The same update adds the records of every pickup, plan and buy-back and what was written about them, the bank details on a withdrawal, your place on any estate member list and any estate you set up, the messages we sent you, records of how you used the app, and your security and notification settings. An update of 29 September 2026 says how long we keep the photos on a pickup or buy-back, in-app messages, app usage events, a collector’s latest location and sign-in tokens. An update of 3 October 2026 adds the optional postcode for your building to the address details we collect and to what collectors serving your pickup see, and says that the map location you pin can be placed by hand or from your phone's location. An update of 5 October 2026 says that an estate you set up stays registered to you until another member takes it over, and adds the short record we keep when an estate is handed over or closes.