Privacy Policy

1. Personal Data We Collect

Depending on whether you interact with DinePort as a Customer, Store Merchant, or Platform Administrator, we collect the following categories of data:

• Identity & Account Data: Full name, verified email address, telephone number, encrypted password hash (PBKDF2/Bcrypt salted), and authentication tokens (including Google Sign-In identity tokens).
• Dietary & Wellness Preferences (Customer Portal): Customer-selected dietary tags such as Halal, Vegetarian, Vegan, Gluten-Free, Nut-Free, Dairy-Free, and custom spice level tolerances. This data is voluntarily provided to prevent adverse food reactions and personalize storefront dish filtering.
• Precise Geolocation & Address Data: Real-time GPS coordinates, street addresses, city, state, and landmarks. Geolocation is collected when you open the app to calculate delivery distance, display nearby kitchens, and verify in-store arrival.
• Order & In-Store Fulfillment Data: Dining mode selections (Dine-In, Advance Outside, Pickup, Delivery), table numbers, cryptographic QR verification codes (HER-QR-...), timestamps of arrival, and QR scanning verification by store attendants.
• Merchant Business & KYC Compliance Data: Corporate Affairs Commission (CAC) business certificates, registered company names, director/owner details, physical kitchen address, commercial food handling permits, and settlement bank accounts (bank name, code, account number, and account name verified through NIBSS/Paystack).
• Audit Trail & Technical Logs: IP address, browser user-agent, operating system, device identifiers, and immutable CRUD action logs recorded in the AuditLogs system for security and anti-fraud monitoring.

2. Device Permissions & Why They Are Required

To provide real-time ordering and kitchen operations, the DinePort mobile and web applications request specific device permissions. We never access your device without your explicit prior authorization:

• 📍 Geolocation Permission:
  Customer App: Required to pinpoint your delivery drop-off location, identify kitchens within dispatch radius, and calculate exact delivery fees.
  Store App: Used to verify your storefront's pickup coordinates and establish delivery coverage circles.
• 🔔 Push Notifications & Audio Permissions:
  Customer App: Sends real-time progress updates when the kitchen accepts your meal, prepares it, or when your driver is approaching.
  Store App: Plays high-priority audio chimes when new orders arrive, alerting attendants to accept orders before expiration timers.
• 📷 Camera & Media Library Permissions:
  Store App: Crucial for kitchen attendants to scan customer dine-in and advance order QR codes using high-speed camera decoders, and for uploading dish photos and store banners.
  Customer App: Optional for scanning table QR codes and attaching photos to customer dispute requests.

3. Legal Basis for Processing

In accordance with the NDPA 2023 and international privacy standards, Pentfield Technologies processes personal data under the following lawful bases:

1. Performance of a Contract: To process food orders, dispatch deliveries, verify in-store dining via QR code, and disburse merchant settlements via Paystack.
2. Consent: For voluntary profile dietary preferences and marketing communications (which can be revoked at any time).
3. Legal & Regulatory Obligations: For anti-money laundering (AML) checks, CAC verification, tax reporting, and food health compliance.
4. Legitimate Interests: To detect and prevent fraudulent chargebacks, maintain portal security isolation, and uphold audit trails.

4. Data Sharing & Third-Party Processors

We do not sell, rent, or monetize your personal data. We disclose information strictly on a need-to-know basis to the following entities:

• Independent Store Merchants: When you place an order, the relevant store receives your name, table number (or delivery address), dietary tags, and ordered items. Stores never receive your payment card numbers or banking passwords.
• Payment Processors: We partner with Paystack Payments Limited (licensed by the Central Bank of Nigeria) for card tokenization and automated bank settlement. Payment data is processed in PCI-DSS Level 1 compliant environments.
• Cloud Infrastructure & Database Hosts: Encrypted databases hosted on secure cloud providers with automated failover and daily backups.
• Law Enforcement & Regulators: Disclosures made solely where mandated by court order or statutory requirement under Nigerian law.

5. Data Retention & Security Architecture

Pentfield Technologies implements enterprise security controls, including:

• Cryptographic hashing of passwords using PBKDF2 with unique cryptographic salts;
• Portal-isolated JWT sessions with explicit role claims (customer, store, admin), preventing token reuse across boundaries;
• End-to-end Transport Layer Security (TLS 1.3) encryption across all public endpoints;
• Role-based access control (RBAC) ensuring staff roles (Attendants vs Managers vs Admins) can access only authorized data scopes.

Personal account data is retained for the lifetime of your account. Transaction and financial settlement records are retained for a minimum of six (6) years in accordance with Nigerian financial and tax regulations.

6. Your Data Subject Rights (NDPA & GDPR)

Under the Nigeria Data Protection Act 2023, you hold enforceable rights regarding your data:

• Right of Access: Request a copy of your personal data held by DinePort.
• Right to Rectification: Edit your user profile, delivery address, or dietary preferences at any time in the Customer App.
• Right to Erasure ("Right to be Forgotten"): Submit an account deletion request through the Customer App profile tab or by emailing our Data Protection Officer. We will purge marketing and profile records, retaining only statutory transaction histories.
• Right to Object: Opt out of promotional notifications or restrict processing for direct marketing.

7. Data Protection Officer & Inquiries

For data protection inquiries, to exercise your rights, or to report a privacy concern, please contact our Data Protection Officer (DPO):

Data Protection Office | Pentfield Technologies Ltd
Compliance & Information Security Division
Abuja, Federal Capital Territory (FCT), Nigeria
DPO Direct Email: dpo@pentfieldtechnologies.com
Privacy Inquiries: privacy@dineport.com