Toviri Privacy Policy

1. Scope

This Privacy Policy applies to:

• Toviri mobile applications (iOS / Android);
• Toviri web properties and landing pages (www.toviri.com and region-specific pages);
• Any in-app, email, phone or offline interactions with Toviri regarding our Services.

It covers personal data collected from individuals in the UK, Nigeria and other jurisdictions where we operate. Where relevant, we refer to the UK GDPR and the Data Protection Act 2018 (UK), and the Nigeria Data Protection Regulation (NDPR).

2. Personal data we collect

We collect personal data you provide to us and data collected automatically when you use our Services. Categories include:

3. How we use your data – purposes and legal bases

We process your personal data for the following purposes:

4. Sharing your data

We do not sell your personal data. We share data only as necessary:

5. Data retention

We retain personal data as long as necessary to provide Services and for legitimate business purposes, including legal, tax and accounting obligations.

Typical retention periods:

• Account data: until account deletion + 7 years for accounting/legal records where transactions occurred.
• Health data: stored only with consent and retained no longer than necessary for service provision and emergency support; retention length: [specify e.g., 5 years after account inactive — adapt to company policy].
• Transaction records: 7 years (financial/regulatory).
• Analytics: aggregated/pseudonymised; raw logs: 12–24 months.
• Support & correspondence: 2–7 years depending on content.

You may request deletion or restriction — see "Your rights" below.

6. Your rights

Depending on your jurisdiction (UK, Nigeria, EU, etc.), you may have the following rights:

• Access: Request a copy of personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of personal data (subject to legal/contractual limits).
• Restriction: Request restriction of processing.
• Portability: Request your personal data in a machine-readable format.
• Object: Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: Where processing is based on consent (e.g., health data, marketing), you can withdraw consent at any time.
• Complain: Lodge a complaint with your local data protection authority (e.g., Information Commissioner’s Office (ICO) in the UK; National Data Protection Commission in Nigeria).

To exercise rights, contact: info@toviri.com or use the in-app privacy settings. We will respond within statutory timelines (usually 30 days; may extend when legally permitted).

7. Security

We implement appropriate technical and organisational measures to secure personal data, including:

• Encryption (in transit via TLS/HTTPS; at rest where appropriate)
• Pseudonymisation where feasible
• Access controls and role-based permissions
• Regular security testing and vulnerability assessments
• Encrypted backups and secure key management
• Data minimisation and secure deletion on lifecycle end

If a security breach affects your data and requires notification, we will inform you and the relevant authorities where required.

8. Children

Our Services are not directed at children under 16 (or local age of consent). We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us and we will delete it.

9. In-app social features and Solo Match

• Solo Match connects solo travellers for companionship. We provide safety mechanisms (reported profiles, verification badges, a review/rating system).
• You control what profile information is visible publicly.
• Do not share sensitive personal information publicly.
• We are not liable for interactions between users; however, we provide reporting, blocking and escalation features and may suspend accounts that breach terms.

11. Wallet, payments & money transfers

• We work with PCI-compliant payment processors. Card details are not stored on our servers (only tokens).
• Wallet balances, iSave and transfers are recorded.
• We may require identity verification for regulatory compliance (KYC) for some wallet operations.

12. International transfers

Your data may be transferred to, stored and processed in countries other than where you live (e.g., cloud providers in the UK, EU, US). When we transfer data internationally, we apply legal safeguards (standard contractual clauses, adequacy decisions, or explicit consent) to ensure protection.

14. Third-party integrations and links

• Our Services may contain links to third-party websites and services. We are not responsible for third-party privacy practices. Please review their privacy policies.
• Integrated third-party services (TransportAPI, mapping providers, Uber, payment processors) will process data under their own policies. We will share only the data necessary for the integration.

15. Cookies & tracking

We use cookies and similar technologies on our website for functionality, analytics and marketing. You can manage cookie preferences via the cookie consent tool on our site. Typical cookies used:

• Strictly necessary cookies (session, auth)
• Performance/analytics cookies (usage data)
• Functional cookies (preferences)
• Advertising cookies (third-party retargeting, where consent obtained)

16. Marketing preferences

You can opt-in/opt-out of promotional communications at any time via the links in emails or the app settings. Transactional messages (booking confirmations, security alerts) cannot be opted out of as they are necessary for service delivery.

17. How to delete or close your account

You may request account deletion through in-app settings or by contacting info@toviri.com. On deletion we will:

• Erase personal data no longer required to be retained by law
• De-identify or aggregate data used for analytics
• Retain transactional and legal records for statutory retention periods (e.g., 7 years for financial records)

We may retain anonymised or aggregated data indefinitely.

18. Complaints & supervisory authorities

If you are unsatisfied with our response, you may complain to a supervisory authority:

• UK: Information Commissioner’s Office (ICO)
• Nigeria: National Information Technology Development Agency (NITDA) / National Data Protection Regulation (NDPR) body

19. Changes to this Policy

We may update this Privacy Policy from time to time. We will post a prominent notice on our website and notify account holders of material changes via email where required. The "Effective date" at the top will be updated.

20. Contact us

For privacy enquiries, data access requests or to exercise rights, contact: