Privacy Policy

Carus Recycling ("Carus", "we", "us", "our") operates the website at carus.com.ng and the related services that let you schedule waste pickups and drop-offs, earn points for recycling, donate points and redeem points for airtime or cash (together, the "Service").

For the purposes of the Nigeria Data Protection Act 2023 ("NDPA"), Carus is the data controller of the personal data described in this policy. You can contact us about privacy at carusrecycling@gmail.com.

We collect the following categories of data:

• Account data: first and last name, email address, phone number, gender, date of birth (optional), password (stored only in hashed form), profile picture, and whether you registered as an individual or a business.
• Business data: for business accounts, your company name and CAC registration number.
• Location data: the address, region, city and Local Government Area you provide for pickups, drop-offs and your profile. We do not collect your device's GPS location.
• Schedule data: the waste type, quantity, number of containers, date and status of each pickup or drop-off you book.
• Wallet and transaction data: your points balance, naira equivalent, donations, redemption requests and transaction history.
• Payout details: when you redeem points, the phone number and network (for airtime) or the bank name, account number and account name (for cash).
• Support and chatbot messages: complaints you send us and messages you type into the Carus assistant.
• Sign-in data from Google: if you choose Google sign-in, your name, email address and profile picture as provided by Google.
• Technical data: IP address, browser and device type, pages visited, error reports and, for a sample of sessions, session recordings (see Cookies and similar technologies below).

We do not knowingly collect special categories of sensitive personal data (such as health, religious or biometric data).

We process your data on the following bases under the NDPA:

• To provide the Service (contract): creating and securing your account, verifying your email with one-time codes, scheduling and fulfilling pickups and drop-offs, crediting points, processing donations and paying out redemptions.
• To communicate with you (contract / legitimate interests): sending verification codes, schedule updates, in-app and email notifications, and responding to complaints and support requests.
• To keep the Service safe (legitimate interests / legal obligation): preventing fraud and abuse, enforcing our Terms of Service, debugging errors and monitoring performance.
• To improve the Service (legitimate interests): understanding how the Service is used so we can fix problems and improve features.
• To meet legal duties: complying with applicable Nigerian law, tax, anti-money-laundering and lawful requests from authorities.
• Consent: where we rely on consent (for example, optional profile fields), you may withdraw it at any time.

We do not sell your personal data, and we do not use it for third-party advertising.

We share personal data only with service providers that help us run the Service, and only as needed for them to do so:

• Interswitch – to process airtime and cash payouts (receives payout phone number or bank details and amount).
• Google – to provide Google sign-in, and to power the Carus assistant (your chatbot messages are sent to Google's generative AI service to produce replies).
• Cloudinary – to store and deliver profile pictures and images you upload.
• Sentry – for error monitoring, performance tracing and sampled session replay.
• Email delivery and hosting providers – to send transactional email and to host our servers and database.
• Collection partners and staff – the address, waste details and contact number needed for a pickup or drop-off to be carried out.

We may also disclose data where required by law or a court order, to protect our rights, users or the public, or in connection with a merger, acquisition or sale of assets (in which case we will tell you and the acquirer must honour this policy).

Some of our providers (for example Google, Cloudinary and Sentry) may process data outside Nigeria. Where we transfer personal data abroad, we do so in line with the NDPA, relying on adequate protection in the destination, contractual safeguards, or another lawful transfer mechanism.

• Essential cookies: we store a sign-in cookie ("auth-user") in your browser that keeps you logged in. The Service cannot work without it.
• Local storage: we may keep small items in your browser (for example chatbot session identifiers and preferences) to make the Service work smoothly.
• Monitoring: Sentry may set identifiers and record a sample of sessions (about 10% of sessions, and sessions in which an error occurs) to help us diagnose problems.

You can clear or block cookies in your browser settings, but doing so will sign you out and may stop parts of the Service working. We do not use advertising cookies.

We keep personal data only as long as needed for the purposes in this policy:

• Account, schedule and wallet data – for as long as your account is active, and afterwards while needed to resolve disputes and meet legal, tax and accounting obligations.
• Payout and transaction records – retained for the period required by applicable financial record-keeping rules.
• Support messages – for as long as needed to handle your request and for a reasonable period afterwards.
• Verification codes – only until they expire.

When data is no longer needed we delete it or anonymise it so it can no longer identify you.

We use measures appropriate to the risk, including encrypted connections (HTTPS), hashed passwords, token-based authentication, role-based access controls for staff and admin tools, and limiting access to personal data to people who need it. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your personal data in a way that is likely to cause you serious harm, we will notify you and the Nigeria Data Protection Commission as required by law. Please keep your password confidential and tell us immediately if you suspect unauthorised access to your account.

Under the NDPA you have the right to:

• be informed about how your data is used (this policy);
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• ask us to delete your data, where we no longer have a lawful reason to keep it;
• restrict or object to processing based on our legitimate interests, or to direct marketing;
• receive your data in a structured, commonly used, machine-readable format (data portability);
• withdraw consent at any time, without affecting past processing;
• not be subject to a decision based solely on automated processing that significantly affects you.

You can update most profile details yourself in Settings. For any other request, email carusrecycling@gmail.com. We may need to verify your identity first and will respond within the time required by law. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

The Service is intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us at carusrecycling@gmail.com and we will delete it.

The Service links to third-party sites such as our social media pages. We are not responsible for their privacy practices, so please read their policies.

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. If we make material changes we will notify you by email or in the Service before they take effect.

Questions or requests about this policy or your personal data? Email carusrecycling@gmail.com. We are based in Lagos, Nigeria.