PRIVACY POLICY FOR ORDERCHAW

Last updated: 12 September 2026

QuoNord Technology ("QuoNord", "we", "us", or "our") operates the OrderChaw customer mobile application (package identifier: com.orderchaw.app) and the website located at www.orderchaw.com.

We are committed to protecting your personal data and respecting your privacy in accordance with the Nigeria Data Protection Act (NDPA) 2023, the Google Play Developer Distribution Agreement and Policies, and other applicable international data protection standards (including the General Data Protection Regulation / GDPR where relevant).

This Privacy Policy explains clearly and transparently how we collect, use, process, disclose, store, and protect your personal information when you use the OrderChaw customer application, as well as your choices and rights regarding your personal data.

1. WHO WE ARE

Application Name: OrderChaw (Customer App)
Android Package Identifier: com.orderchaw.app
Operating Company: QuoNord Technology (parent company)
Website: www.orderchaw.com
Customer Support Email: support@orderchaw.com
Data Privacy Contact / DPO: Privacy Team, QuoNord Technology (support@orderchaw.com)

OrderChaw is a food ordering and delivery marketplace connecting three categories of participants: Customers, Delivery Riders, and Restaurants. This Privacy Policy applies specifically to users of the OrderChaw Customer mobile app.

2. LAWFUL BASES FOR PROCESSING YOUR DATA

Under the Nigeria Data Protection Act (NDPA) 2023 and global privacy laws, we process your personal data only when we have a valid lawful basis to do so:

Contractual Performance: Processing necessary to register your account, process food orders, accept payments, arrange delivery, and manage your in-app wallet balance.
Consent: Processing based on your explicit permission, such as accessing your precise location, uploading a profile photo, or sending optional push notifications.
Legitimate Interests: Processing necessary for operational security, fraud prevention, app improvements, customer support, and maintaining ledger integrity, provided your rights do not override these interests.
Legal & Regulatory Obligations: Processing and retaining financial and transactional records required under Nigerian tax laws, financial auditing mandates, and anti-money laundering regulations.

3. DATA WE COLLECT AND WHY WE COLLECT IT

We collect personal data that you provide directly to us, as well as technical data generated when you interact with the app. We organize our collection practices by purpose below:

A. Account Setup and Authentication

Data Collected: Email address, password, display name, and mobile phone number.
How Collected: Inputted directly by you during sign-up or profile setup.
Purpose: To create and secure your OrderChaw account (powered by Google Firebase Authentication), verify your identity via phone/email, communicate order updates, and enable account recovery.

B. Profile Customization

Data Collected: Profile photo (optional).
How Collected: Selected or captured via your device's image picker / camera when you choose to customize your profile.
Purpose: To personalize your customer profile in the app.

C. Delivery Address and Location Data

Data Collected: Delivery address details and precise GPS location coordinates.
How Collected: Collected via foreground device location permissions or manual address input.
Purpose: To discover nearby restaurants, display accurate restaurant menus and pricing, validate deliverable addresses, estimate delivery fees, and direct delivery riders to your location.

D. Food Orders and Transactions

Data Collected: Order history, ordered food items, restaurant selections, special instructions, order status timestamps, and delivery notes.
How Collected: Automatically recorded when you place orders within the app.
Purpose: To process and fulfill your orders, provide real-time tracking, facilitate customer support, and resolve dispute inquiries.

E. Financial and Wallet Ledger Data

Data Collected: In-app wallet balance, transaction ledger history (top-ups, debits, refunds, order payments, promotional credits).
How Collected: Generated automatically when you perform wallet transactions or complete orders.
Purpose: To manage your digital wallet funds, execute instant order checkouts, process refund credits, prevent financial fraud, and maintain audited accounting records.

F. Device Notifications and Technical Tokens

Data Collected: Push notification device token (Firebase Cloud Messaging) and basic app build metadata.
How Collected: Generated automatically by your device upon app installation and permission grant.
Purpose: To send critical order updates (e.g., "Food is being prepared", "Rider has arrived"), safety alerts, and promotional announcements.

4. HOW PAYMENTS ARE HANDLED (NO CARD DATA STORED)

Financial security is paramount. All payment processing for card checkouts and wallet top-ups on OrderChaw is handled by Paystack (Paystack Payments Limited), a licensed and PCI-DSS compliant Nigerian payment processor.

We Never Store Card Details: OrderChaw does NOT collect, process, view, or store full payment card numbers, expiry dates, or CVV/CVC security codes on our servers or within the app.
Direct Paystack Processing: When you enter card details, they are transmitted directly from your device to Paystack over an encrypted, secure connection.
What OrderChaw Retains: Paystack provides OrderChaw with transaction status updates, unique transaction reference numbers, payment receipts, and tokenised authorization codes (if you choose to save a card for faster future checkouts). Tokenised codes allow you to reuse saved cards without OrderChaw ever holding raw card credentials.

5. THIRD-PARTY SERVICES AND DATA PROCESSORS

To deliver a reliable service, we share specific data with trusted third-party service providers acting as data processors. Each processor is strictly bound by contractual data protection agreements:

Service Provider	Service Provided	Data Received / Processed
Google Firebase (Google LLC)	User authentication, cloud database (Cloud Firestore), serverless backend logic (Cloud Functions), cloud storage, push notifications (FCM).	Email address, password hash, display name, phone number, profile photo, order records, wallet ledger, push tokens.
Paystack (Paystack Payments Limited)	Payment gateway processing, card authorization, wallet top-ups.	Customer email, transaction amount, payment reference, tokenised card authorization codes.
Google Maps & Places API (Google LLC)	Geocoding, address autocomplete, location validation, distance calculation.	Precise GPS coordinates, entered delivery address strings.
Expo (60 Enterprise / Expo Inc.)	App build framework, runtime execution, over-the-air app update delivery.	Anonymized crash logs, app version metadata, runtime build diagnostics.

We do not sell, rent, or trade your personal information to third parties, advertising networks, or data brokers.

6. INTERNATIONAL DATA TRANSFERS

OrderChaw operates primarily in Nigeria and processes transactions in Nigerian Naira (₦). However, our core cloud infrastructure and database databases (Google Cloud Platform / Firebase) are hosted on secure servers located in the United States (specifically within the us-central1 and us-east1 regions).

Consequently, your personal data collected in Nigeria is transferred to, stored at, and processed in the United States.

Safeguards for International Transfer: - Google Cloud Platform enforces rigorous technical and organizational security measures certified under ISO/IEC 27001, SOC 1/2/3, and PCI-DSS. - Data transfers are governed by standard contractual clauses and robust data processing terms that safeguard your rights under Section 41 and 42 of the Nigeria Data Protection Act 2023.

7. LOCATION PERMISSIONS AND FOREGROUND USE

OrderChaw requires precise location data to connect you with nearby restaurants and ensure your food is delivered to the correct location.

Foreground Location Only: Location data is accessed ONLY when the OrderChaw app is actively open and running in the foreground on your screen.
No Background Tracking: The OrderChaw Customer App does NOT track, log, or collect your GPS location in the background when the app is closed or minimized.
How to Revoke Permission: You can grant or revoke location access at any time through your Android device settings (Settings > Apps > OrderChaw > Permissions > Location).
Note: Revoking location permission will prevent automatic restaurant discovery and require you to manually enter a delivery address for every order.

8. DATA SECURITY MEASURES

We implement comprehensive technical, physical, and administrative measures to protect your data against unauthorized access, loss, misuse, or alteration:

Encryption in Transit: All communications between the OrderChaw app, Firebase backend, and Paystack are encrypted using Transport Layer Security (HTTPS / TLS 1.2 or higher).
Encryption at Rest: Sensitive stored records—including payout bank account information stored for financial operations—are encrypted at rest using industry-standard AES-256 encryption algorithms.
Secure Hashing: User passwords are stored using Firebase Authentication's secure salted password hashing mechanisms; raw passwords are never visible to QuoNord staff.
Access Control: Server access is strictly restricted to authorized engineering personnel subject to multi-factor authentication and confidentiality agreements.

9. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by Nigerian law:

Active Accounts: Personal identifiers, delivery addresses, and profile details are retained while your account remains active.
Order & Financial History: In compliance with Nigerian legal, tax, and accounting standards, financial transaction records and ledger histories are retained for up to 7 years following transaction completion.
Deleted Accounts: When an account is deleted, personal profile data is purged, subject to the retention restrictions described in Section 10 below.

10. ACCOUNT DELETION AND WALLET BALANCE RULES

In compliance with Google Play Store policies and Section 34 of the NDPA 2023, OrderChaw provides a simple, direct mechanism to request the deletion of your account and personal data.

How to Delete Your Account

In-App Deletion: Open OrderChaw > Go to Profile / Settings > Tap Delete Account > Confirm your request.
Email Request: Send an email from your registered email address to support@orderchaw.com with the subject line "Account Deletion Request".

Data Retained Upon Deletion

To comply with Nigerian financial regulations, prevent fraud, and maintain accounting audits, deleting your account does not erase your historical ledger. Upon deletion confirmation, we permanently remove your profile photo, phone number, saved addresses, and push tokens. However, we retain: - Your internal User ID - Your registered Email Address - Your Wallet Balance and Transaction Ledger history

Wallet Balance & Account Deletion Conditions

Please read these rules carefully before initiating account deletion:

Active Orders Block Deletion: Account deletion is BLOCKED if you currently have an active, pending, or ongoing food order. All orders must be completed or cancelled before deleting your account.
Balance of ₦1,000 or Higher Blocks Deletion: If your in-app wallet balance is ₦1,000 or higher, account deletion is BLOCKED. You must spend your balance on food orders or request a manual wallet withdrawal by contacting customer support before deleting your account.
Forfeiture of Balances Under ₦1,000: If your in-app wallet balance is less than ₦1,000, you may proceed with account deletion immediately. However, any remaining wallet balance under ₦1,000 is permanently forfeited upon account deletion and cannot be recovered or refunded later.

11. PUSH NOTIFICATIONS

We send push notifications to your mobile device to inform you of order statuses (e.g., order acceptance, rider pickup, arrival) and occasional updates or special offers.

Managing Notifications: You can disable push notifications at any time via your device settings (Settings > Apps > OrderChaw > Notifications) or through the notification settings inside the app.
Critical account alerts may still be sent to your registered email address even if push notifications are disabled.

12. COOKIES, TRACKING, AND ANALYTICS

No Web Cookies: The OrderChaw native Android application does not use web browser cookies.
No Ad Trackers: We do not incorporate third-party advertising SDKs, ad-tracking pixels, or cross-app behavioral tracking identifiers (such as Google Advertising ID / AAID) for advertising networks.
Essential diagnostic and service logs are strictly limited to the infrastructure providers listed in Section 5.

13. YOUR DATA SUBJECT RIGHTS

Under the Nigeria Data Protection Act (NDPA) 2023 (and GDPR for European Union users), you possess specific rights regarding your personal data:

Right to be Informed: You have the right to know how your data is collected, used, and shared (as set out in this policy).
Right of Access: You may request copies of the personal data we hold about you by contacting support@orderchaw.com.
Right to Rectification: You have the right to correct inaccurate or incomplete personal information directly within your app profile or by contacting customer support.
Right to Erasure (Deletion): You can request the deletion of your account and personal data in accordance with Section 10.
Right to Withdraw Consent: Where processing relies on your consent (e.g., location permissions, push notifications, profile photo), you may withdraw consent at any time via your app or device settings.
Right to Restrict or Object to Processing: You may object to the processing of your data for marketing purposes or request restrictions on processing under legal grounds.
Right to Data Portability: You may request a machine-readable export of your primary account and order data.

Lodging a Privacy Complaint

If you believe that QuoNord Technology has processed your personal data in violation of the NDPA 2023, you have the right to lodge a complaint with the national supervisory authority: - Nigeria Data Protection Commission (NDPC) - Website: www.ndpc.gov.ng - Email: info@ndpc.gov.ng

(EU/UK users may lodge a complaint with their local Data Protection Authority).

14. CHILDREN'S PRIVACY (MINIMUM AGE: 18+)

OrderChaw is intended solely for adult users who are legally capable of entering into binding contracts and conducting financial transactions.

Minimum Age Requirement: You must be at least 18 years old to create an account, top up an in-app wallet, or place food orders on OrderChaw.
We do not knowingly solicit, collect, or process personal data from children under the age of 18.
If we discover that a user under 18 has provided us with personal information, we will immediately close the account and purge their personal data from our systems.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to reflect changes in our app features, operational procedures, or legal obligations under the NDPA or Google Play policies.

Notification of Changes: When updates occur, we will revise the "Last updated" date at the top of this document and post the updated policy within the app and at privacy.orderchaw.com.
For material changes that significantly affect your rights, we will notify you through an in-app notice, push notification, or email before the changes take effect.
Your continued use of OrderChaw after the effective date of an updated Privacy Policy constitutes your acknowledgment of the revised policy.

16. HOW TO CONTACT US

If you have questions, concerns, feedback, or requests regarding this Privacy Policy or how your personal data is handled, please reach out to us:

Operating Company: QuoNord Technology
App Name: OrderChaw (com.orderchaw.app)
Customer Support Email: support@orderchaw.com
Official Website: www.orderchaw.com
Postal / Physical Address: ``
Privacy Officer / DPO: Privacy Team, QuoNord Technology (support@orderchaw.com)

NOTE TO THE READER / PUBLISHER (OUTSIDE THE PRIVACY POLICY)

Reasoning for the 18+ Minimum Age Requirement: In Section 14, a minimum age of 18 years old is specified for OrderChaw users. This recommendation is based on three key factors: 1. Financial & Wallet Transactions: OrderChaw integrates digital wallet top-ups, debit card payments, and auto-tokenised checkouts via Paystack. Under Nigerian law (and general legal capacity standards), minors cannot independently enter into binding credit/debit payment agreements or manage commercial financial ledgers without parental or guardian liability. 2. Contractual Binding for On-Demand Services: Ordering food delivery involves placing binding commercial transactions with restaurants and delivery riders. Setting the minimum age at 18 ensures all active accounts possess full contractual legal capacity. 3. Compliance with Google Play & NDPA Child Protection: Both Google Play Store policies and Section 31 of the Nigeria Data Protection Act 2023 impose strict processing and consent conditions for minor data (under 18 in Nigeria). Restricting the customer app to adults avoids stringent child data protection liability while remaining fully compliant.