Privacy policy.

Version 1.0 · Last updated: 23 October 2026

Spree is a service of Spreetech Limited, a company registered in Nigeria whose registered office is at 29 Park Road, Ebute Metta, Lagos State, Nigeria ("Spree", "we", "us"). We are the data controller for the personal data described here.

This policy explains what we collect when you use the Spree app, the Spree Rider app or onspree.co to buy, sell or deliver; why we collect it; the law that lets us; who else handles it; how long we keep it; and what you can ask us to do with it.

Data Protection Officer: [email protected]. You can also reach us in either app under Help.

The short version

• We collect what it takes to sell, pay for and deliver an order, and to keep buyers, shops and riders safe while doing it. We do not sell your data and we do not show you anyone else's advertising.
• Your card details go to Paystack on Paystack's own page. They never reach us.
• If you shop, we only know where you are when you tap to pin an address.
• If you ride, we know where you are while you are on duty, and only then. We delete that history after 90 days.
• Shop owners and riders take a selfie that is matched to their national ID record. A face match uses biometric data, so we only do it with your explicit consent, and we keep the result, not a face template.
• Our servers are in Germany, and some of our service providers work from other countries. Section 7 explains this and the protections we use.
• You can delete your account in the app at any time. We keep only what the law requires (order and payment records, and identity checks for shops and riders), without your name.

1. Who this policy covers

It covers everyone who uses Spree: buyers, people who run a shop on Spree ("sellers"), riders who deliver for Spree, and visitors to onspree.co. It also covers people whose details someone gives us: the person receiving a delivery, and a rider's guarantor.

Spree is only for people aged 18 or over (section 12).

2. What we collect, why, and our lawful basis

The NDPA (section 25) only lets us use personal data on a lawful basis. The ones we use are:

• Contract: we need it to give you the service you asked for.
• Legal obligation: a law requires it, such as tax, accounting and consumer protection law.
• Legitimate interest: it is needed for a reasonable purpose of ours or yours, such as preventing fraud, and it does not override your rights. We have assessed each one.
• Consent: you agreed to it, and you can withdraw it at any time. Withdrawing does not undo what was lawfully done before.

2.1 Everyone

2.2 If you shop

We do not keep a history of your ordinary searches. When you skip a piece in Spree (the swipe section), that stays on your phone and is never sent to us.

If you give us someone else's name and number as the person receiving a parcel, make sure they are happy for you to do so. We use them only for that delivery.

2.3 If you run a shop

Everything in 2.1 and 2.2, and:

We send your ID number, name and selfie to our identity provider, who checks them against the national record. We keep only the result: verified or not, a reference, a match score and reason codes. We do not keep what the provider returns about you, and we do not keep a face template. ID and bank numbers are stored encrypted.

2.4 If you ride

Everything in 2.1, and:

2.5 What we count without knowing who you are

We count how many times each piece and shop is seen, by day, hour and where it was seen (the feed, search, a shop page, a shared link, Gbanjo or Spree), so shops can see what works. These counts do not record who looked.

2.6 What we do not collect

Your contacts, calendar, text messages, health data or browsing history. The apps contain no advertising or analytics trackers.

3. Marketing

We only send you marketing messages (news, offers, promotions from Spree) if you have said yes, and every message tells you how to stop them. Messages about your orders, your account, your shop's sales or your jobs are part of the service, not marketing. Notifications you ask for, such as Gbanjo drop alerts and watched searches, can be turned off in the app.

4. The website and cookies

onspree.co is a static website. It sets no advertising, analytics or tracking cookies. Our network provider, Cloudflare, may set a strictly necessary security cookie to tell people from bots; it holds no personal profile and the law does not require consent for it (GAID Article 19). Everything the site needs, including its fonts, is served from onspree.co itself; your browser does not contact any other company to show it. Shared shop and item links (onspree.co/s/…) show public information only. If we ever add cookies that need consent, we will ask first, with a clear choice to accept or decline.

5. Who else handles your data

5.1 Our service providers

We use these companies to run Spree. They process your data only on our instructions, under written agreements, and may not use it for their own purposes (NDPA section 29):

5.2 The people in your order

We share with each person in an order only what they need for it:

• The shop sees the buyer's display name and what was ordered. It does not see the buyer's phone number or address.
• The rider sees the pickup and delivery addresses, the receiver's name and phone number, and the shop's contact name.
• The buyer sees the rider's name, phone number, plate number and rating, and where the parcel is while it is on its way.
• The codes that hand a parcel over are shown only to the person who must read them out. The rider never sees them.
• Public reviews show the reviewer's display name.

5.3 Others

• Authorities: when the law or a court requires it, and to report crime. We disclose only what is required, and we tell you unless the law forbids it.
• Legal claims: to our lawyers and auditors, and in court, where needed to establish or defend a legal claim.
• A buyer of our business: if Spree is sold or merged, under these same promises. We will tell you first.

We never sell personal data.

6. How long we keep it

We keep personal data only as long as the purpose needs, then delete it or remove what identifies you (NDPA section 24; GAID Article 49).

7. Data stored or handled outside Nigeria

Our database and servers are hosted by Render in Frankfurt, Germany, and some providers in section 5 process data in the United States and elsewhere.

The NDPC has not yet published a list of countries it considers adequate. Germany is covered by the EU General Data Protection Regulation, which gives protection substantially similar to the NDPA. The United States has no single national privacy law of that kind, and its authorities can, in some cases, require providers to hand over data.

We transfer your data only on these grounds, and we record each one (NDPA sections 41 to 43):

• the transfer is necessary to perform our contract with you (for example, storing your order so it can be delivered);
• the provider is bound by written data protection terms that give protection to the standard of the NDPA; and
• your consent, which you give when you accept this policy in the app after reading this section.

We encrypt data in transit and encrypt ID numbers, bank details and handover codes at rest, so they are unreadable to the hosting provider.

8. Your rights

Under the NDPA (sections 34 to 38) you can:

• know whether we hold data about you, and get a copy in a common electronic format;
• correct data that is wrong, out of date or incomplete (most of it you can change yourself in the app);
• delete your data (section 10 explains what the law makes us keep);
• restrict our use of it while a request or complaint is being settled;
• object to processing based on legitimate interest, and to marketing at any time;
• move the data you gave us to another service;
• withdraw consent at any time, as easily as you gave it; and
• not be subject to a decision made purely by a computer that seriously affects you, and ask a person to review it (section 9).

How to ask: through Help in the app, or by email to [email protected]. We may ask you to confirm your identity from your account first. It is free. We acknowledge every request within 7 days and answer it within 30 days; if a request is complex we will tell you why we need longer.

Complaints: if you are not happy with our answer, or at any time, you have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng), and to go to court (NDPA section 46; GAID Articles 39 and 47). You can also send us a formal Standard Notice to Address Grievance (SNAG).

9. Decisions made by a computer

Spree makes some decisions automatically, because the service could not work in real time without them:

These decisions are necessary to perform our contract with you (NDPA section 37(2)(a)). Approving a shop or a rider, and deciding a return or a fault, are always done by a person, never by the computer alone. You can ask for a person at Spree to review any of the decisions above, give your view, and contest it, through Help.

10. Deleting your account

In the Spree app: Account → Delete my account. In Spree Rider: You → Settings → Delete my account. Or on the web at api.onspree.co/v1/delete-account.

We can only delete an account when nothing is still in progress: an order you have not received, a job you are on, a payout on its way or money not yet settled. The app tells you which, and you can try again once it is done.

When you delete it, we sign you out everywhere and remove your name, photo, addresses, likes, saves, follows, watched searches, bag and notification tokens. We close your shop and hide its pieces, or deactivate your rider account. Your phone number is freed so you can start again. Order and payment records stay, without your name, for as long as section 6 says.

11. Keeping it safe

• Everything travels encrypted (HTTPS only).
• ID numbers, bank details and handover codes are encrypted in our database, and the server process cannot read the ID and bank numbers in normal operation.
• Private documents (ID photos, return photos, support photos) are kept in private storage and shown only to Spree staff who need them. Staff sign in with a second factor, and every staff action is recorded.
• Sign-in uses one-time codes, short-lived sessions and protection against repeated guessing.

If something goes wrong: if a breach of personal data is likely to put your rights at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of learning of it. If it is likely to put you at high risk, we will tell you straight away, in plain language, with advice on what you can do (NDPA section 40).

12. Children

Spree is not for anyone under 18. You must be 18 or over to buy, sell or ride. We do not knowingly collect data about children. If we learn that an account belongs to someone under 18, we will close it and delete its data, except what the law requires us to keep. If you believe a child is using Spree, tell us at [email protected].

13. Changes to this policy

When we change this policy we will publish the new version here with a new version number and date. If the change is significant, we will tell you in the app, and you will be asked to accept the new version before you can next check out, open a shop or go on duty. Older versions are available on request.

14. Contact

For questions about your data or this policy, write to our Data Protection Officer at [email protected]. For anything else, use Help in either app or email [email protected].