Privacy Policy
Effective 4 August 2026 · Last updated 4 August 2026 · Applies to the WasteAway mobile app and wasteaway.ng
WasteAway is a service of Xzeiten Ltd (“we”, “us”), a private company limited by shares incorporated in Nigeria under the Companies and Allied Matters Act 2020, registration numberRC 9740479. We provide waste collection, recyclables buy-back, and estate waste-management services in Nigeria, starting in Abuja. This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have under the Nigeria Data Protection Act, 2023 (NDPA) and its subsidiary regulations. It applies from the first account we create.
1. Who is responsible for your data
Xzeiten Ltd (RC 9740479), trading as WasteAway, is the data controller for the personal data described in this policy. Contact us about anything privacy-related at privacy@wasteaway.ng or support@wasteaway.ng.
2. What we collect and why
| Data | When | Why (purpose) |
|---|---|---|
| Phone number | Registration and login (SMS one-time code) | Creating and securing your account; contacting you about your collections |
| Name and email (optional) | If you add them to your profile | Personalising your account, receipts and support |
| Pickup addresses, landmarks and (optionally) a map location you pin | When you save an address or book a pickup | Routing a collector to you and pricing travel fairly |
| Collector live location | While a collector is actively on a job (foreground only) | Showing the customer their collector’s progress to the pickup |
| Photos you attach | When you add photos to a booking or a collector records proof of collection | Describing the job; proof that a collection happened |
| Booking, subscription and recycling history | As you use the service | Providing the service, billing, statements and dispute resolution |
| Payment information | When you pay | Processing payments. Card details are entered only on our payment processor’s secure page. Full card numbers never touch WasteAway systems. We store only a masked reference (e.g. “Visa •••• 4081”). |
| Collector verification data (ID document, NIN, guarantor contact, vehicle details) | If you apply to be a collector | Identity verification and safety (a legal-compliance and legitimate-interest basis) |
| Device push token | When you enable notifications | Sending you booking updates |
| Basic technical logs (request identifiers, timestamps, app version) | Automatically | Security, fraud prevention, and fixing failures |
We do not collect your precise device location in the background, we do not access your contacts or files, and we do not sell personal data to anyone.
3. Legal bases
We process your data under the NDPA on the bases of contract performance (providing the service you signed up for), legal obligation (tax and financial record-keeping), legitimate interests (fraud prevention, service safety), and consent (optional marketing messages, which you can withdraw at any time in the app’s notification settings).
4. Who we share data with
- Collectors serving your pickup see your first name, the pickup address, your instructions, and a contact number, only for jobs assigned to them.
- Payment processing: Paystack (a Nigerian PCI-DSS-certified processor) handles card, transfer and USSD payments.
- Cloud hosting: our servers and encrypted databases run on Amazon Web Services.
- Maps: in-app maps and address search use Google Maps Platform.
- Push notifications: delivered via Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iPhone).
- SMS delivery: one-time login codes and key service updates (such as booking confirmations and collector arrivals) are sent through a licensed Nigerian SMS provider.
- Authorities: only where the law requires it.
Each provider processes data under contracts consistent with the NDPA’s cross-border transfer rules.
5. How long we keep data
- Account and profile data: while your account is active.
- Transaction and financial records: retained after account closure for the period Nigerian tax and financial regulations require.
- One-time login codes: they expire within minutes and are stored only as one-way hashes.
- When you delete your account in the app (Profile → Delete account), your name, email, photo and ID details are removed immediately; transaction and financial records are kept only as required by law and are no longer linked to a usable profile.
- An account holding money cannot be deleted, so that nothing is stranded on a closed account. Wallet money pays for WasteAway pickups and plans and cannot be paid out to a bank account, so a wallet balance is cleared by spending it; collector earnings are cleared by requesting a payout to your bank account.
How to delete your account sets out both routes, in the app and by email, and exactly what is erased and what is retained.
6. Your rights
Under the NDPA you can ask us to access, correct, delete, or export your personal data, object to certain processing, and withdraw consent. Most of these are available directly in the app; for anything else, including deleting your account without the app, email privacy@wasteaway.ng. We respond within 30 days. You can also lodge a complaint with the Nigeria Data Protection Commission (NDPC).
7. Security
Data is encrypted in transit (TLS) and at rest. Access follows least-privilege: login codes are stored hashed, sessions use short-lived rotating tokens, and money movements are recorded in an append-only ledger. No system is perfectly secure. If a breach affects you, we will notify you and the NDPC as the NDPA requires.
8. Children
WasteAway is not directed at children under 18. We do not knowingly collect their data; if you believe a child has created an account, contact us and we will delete it.
9. Changes
We will post any changes here and update the effective date; material changes are announced in the app. This version, effective 4 August 2026, replaces the policy of 26 July 2026: it names Xzeiten Ltd (RC 9740479) as the data controller, where the previous version identified only the WasteAway brand. The 26 July version, which it keeps, states how each kind of balance is cleared before an account can be deleted, including that wallet money pays for WasteAway services and cannot be paid out to a bank account.