Privacy Policy

How Fortel collects, uses, shares, and protects vehicle and personal data

Last updated: 20 July 2026   |   Effective date: [1st July 2026 ) ]

234Drive Limited (“Fortel”, “we”, “us”, or “our”) provides a connected-vehicle intelligence service comprising a physical OBD-II diagnostic device, a mobile and web application, and related data services (together, the “Service”). This Privacy Policy explains what personal data we collect from consumers, drivers, fleet operators, and other users of the Service, why we collect it, who we share it with, and the rights available to you under the Nigeria Data Protection Act 2023 (“NDPA”) and its subsidiary regulations.

For the purposes of the NDPA, 234Drive Limited is the data controller in respect of personal data processed through the Service. Where we process personal data on behalf of a fleet operator, insurer, lender, or other business client, we act as a data processor for that data and our client acts as the controller; that relationship is governed separately by our Business Data Processing Terms.

  1. Scope
    1. This Policy applies to:
      1. Individual consumers who purchase or use a Fortel device and the Fortel app (“Consumer Users”);
      2. Drivers, fleet administrators, and authorised personnel using Fortel through a business, fleet, insurer, or lender account (“Business Users”); and
      3. Visitors to our websites and marketing pages.
  1. It does not apply to information processed by third parties who operate their own websites or services linked from ours, including payment processors and telematics infrastructure partners, who maintain their own privacy notices.
  2. Data We Collect
    1.  Information you give us
      1. Identity data: full name, date of birth (where required for account verification), government-issued ID or National Identification Number (NIN) (for fleet, lending, or insurance-linked accounts only, where legally required), and photograph (optional, for profile).
      2. Contact data: phone number, email address, delivery/installation address.
      3. Account data: username, password (stored as a salted hash, never in plain text), account preferences.
      4. Vehicle data: make, model, year, Vehicle Identification Number (VIN), registration/plate number, and vehicle ownership documentation where required for B2B or financing-linked use cases.
      5. Payment data: billing details processed by our licensed third-party payment processor. Fortel does not store full card numbers on its own servers.
      6. Support data: records of your communications with our customer support team.
    2.  Information the device and app collect automatically
      1. This is the core of what makes Fortel work, and we are direct about it rather than burying it: the Fortel device reads data from your vehicle’s onboard computer (ECU) and combines it with location and motion data to power diagnostics, safety alerts, and — where applicable — fleet, insurance, or lending products. Specifically:
      2. Diagnostic Trouble Codes (DTCs) and related fault data reported by your vehicle’s ECU;
      3. Vehicle telemetry: speed, engine status, ignition on/off events, odometer/mileage, fuel or battery data, and related sensor readings;
      4. Location data: GPS location and route/trip history, collected continuously while the device is powered and the vehicle is in use;
      5. Driving-behaviour data: acceleration, hard-braking, cornering, and idling patterns, used to generate safety scores, maintenance nudges, and (for consenting fleet/insurance contexts) risk assessments;
      6. Device data: device ID, firmware version, connectivity/signal status, and installation status;
      7. App usage data: pages viewed, features used, crash logs, and device identifiers for the phone or tablet running the Fortel app.

Unlike a general-purpose ride-hailing or payments app, continuous vehicle and location telemetry is not incidental to Fortel — it is the product. We collect it because diagnostics, safety alerts, and fleet/insurance intelligence cannot work without it. Where a feature does not require continuous telemetry (for example, basic account management), we do not condition that feature on unnecessary data collection.

  1. Information we receive from others
    1. From your vehicle’s manufacturer-fitted systems, via the OBD-II port, as described above;
    2.  From our telematics hardware and connectivity partners, who transmit device data to our platform on our instruction;
    3. From fleet operators, employers, or account administrators who add you as a driver on a Business account;

From publicly available vehicle registration and identification records, where lawfully accessible, to verify vehicle details.

  1. Other information we collect
    1. Other information which may be automatically collected from you when you visit our website include; domain name of your internet service provider, the internet protocol address used to connect the computer to the internet, the average time spent on our website, pages viewed, information searched for, access times, your geographical location, operating system, referral source, and other relevant statistics.
  2. Why We Process Your Data 

Under the NDPA, we rely on the following legal bases, depending on the purpose:

  1. Consent — for continuous location/telemetry collection, marketing communications, and any sharing of your data with an insurer or lender. You may withdraw consent at any time; see Section 8.
  2.  Performance of a Contract: to provide the diagnostic, safety, and subscription services you have signed up for, process payments, and provide customer support.
  3. Legitimate Interests: to detect fraud, secure our platform, improve our fault-detection models using de-identified or aggregated data, and maintain the safety of our hardware.
  4. Legal Obligation: to retain financial records, respond to lawful requests from Nigerian authorities, and comply with the NDPA’s own recordkeeping and breach-notification requirements.
  5. Public Interest: Where necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
  6. Vital Interests: To protect your interests or the interests of other persons, where they or you are incapable of providing consent
  7. How We Use Your Data
    1.  To operate the Service: pairing your device, displaying diagnostics, sending fault and maintenance alerts, and calculating driving/safety scores;
    2. To bill and manage your subscription;
    3. To provide fleet dashboards and reporting to Business Users, limited to the vehicles and drivers under that Business account;
    4.  To build and improve our proprietary fault-code and diagnostic models for Nigerian and African road, vehicle, and climate conditions, using de-identified or aggregated data wherever the analysis does not require an identifiable individual;
    5.  To generate anonymised, community-aggregated benchmarks (for example, peer-average fuel efficiency) for the 234Drive community, never revealing one user’s data to another;
    6. To detect and prevent fraud, misuse of the Service, or tampering with the device;
    7. To comply with legal, regulatory, tax, and insurance-related obligations;
    8. With your explicit, separately obtained consent, to share relevant vehicle data with an insurer, lender, or financing partner you have chosen to work with through the Service.
  8.  How We Share Your Data

We do not sell personal data. We share it only in the following circumstances:

  1.  Service providers
    1. Payment processing: a licensed Nigerian payment gateway processes your payments; Fortel does not receive or store your full card or bank details.
    2. Cloud hosting and infrastructure: our platform is hosted with reputable cloud infrastructure providers, which may process data outside Nigeria (see Section 7).
    3. Telematics and device connectivity providers: our hardware partners transmit data from the device to our servers under contractual data-processing terms; they do not have access nor use your data for their own purposes.
    4. Customer support and communications tooling providers, bound by confidentiality and data-processing agreements.
  2.  Business and fleet accounts

Where you are a driver on a Business (fleet) account, the fleet administrator can see the vehicle and driving data associated with the vehicle(s) assigned to you, for legitimate fleet-management purposes such as maintenance, safety, and route oversight. We require Business Users to notify their drivers of this monitoring.

  1. Insurers, lenders, and other B2B partners

We only share identifiable vehicle or driving data with an insurer, lender, or similar third party where you (or, for a fleet vehicle, the fleet operator with authority to do so) have given explicit, informed, and specific consent to that sharing — for example, when you opt into a usage-based insurance or vehicle-financing product through Fortel. You can withdraw this consent at any time, which will stop future sharing but will not affect data already lawfully shared.

  1. Legal and safety disclosures

Legal disclosures may be made under the following circumstances:

  1. Where required by a valid court order, subpoena, or lawful request from the Nigeria Data Protection Commission (NDPC), law enforcement, or another competent authority;
  2. Where necessary to protect the rights, property, or safety of Fortel, our users, or the public;
  3. In connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality obligations and, where required, prior notice to affected users.
  4. Data Retention
    1. Account and vehicle data: retained for as long as your account is active, and for 7 (seven)years thereafter to satisfy Nigerian tax, financial, and consumer-protection recordkeeping obligations, unless a longer period is required by law or an ongoing dispute.
    2. Diagnostic and telemetry data: retained in identifiable form for 24 (twenty-four)from collection, after which it is deleted or irreversibly aggregated/de-identified for model improvement and research purposes.
    3. Support communications: retained for 3 (three) years for quality and dispute-resolution purposes.
    4. On account deletion, personal profile and identifiable diagnostic/location data is deleted or irreversibly de-identified within 30 (thirty) days of your request (following a 14-day account-recovery window), as described in our Account Deletion Policy.
  5. International Data Transfers
    1. Some of our infrastructure and service providers process data outside Nigeria. Where we transfer personal data outside Nigeria, we do so only where the NDPA’s conditions for cross-border transfer are met — including that the recipient country or organisation offers an adequate level of data protection, that appropriate contractual safeguards (such as standard contractual clauses) are in place, or that you have given explicit consent to the specific transfer. We maintain a record of our cross-border transfer mechanisms as required by the NDPA and will make a summary available on request.
  6. Your Rights
    1. Subject to the conditions and exceptions in the NDPA, you have the right to:
      1. Access the personal data we hold about you;
      2. Correct inaccurate or incomplete personal data;
      3. Request erasure of your personal data, including via our Account Deletion process;
      4. Restrict or object to certain processing, including direct marketing;
      5. Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
      6. Request a copy of your data in a portable, machine-readable format;

Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng, , if you believe your rights have been infringed.

  1. To exercise any of these rights, contact our Data Protection Officer using the details in Section 14. We will respond within the timeframe required by the NDPA, generally without undue delay and in any event within one month of a verified request, save where an extension is permitted by law.
  2. Data Security
    1. We apply technical and organisational measures proportionate to the sensitivity of the data we hold, including encryption of data in transit and at rest, access controls limiting internal access to identifiable data on a need-to-know basis, regular security testing, and firmware safeguards preventing the device from writing data back to your vehicle’s ECU. No system is completely secure, and we encourage you to use a strong, unique password and to report any suspected compromise of your account immediately.
    2. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify the NDPC within 72 (seventy-two) hours of becoming aware of it, and will notify affected users without undue delay, together with guidance on protective steps you can take, in line with our obligations under the NDPA.
  3. Children
    1. 10.1.The Service is not directed at, and we do not knowingly collect personal data from, individuals under 18 (eighteen) years of age. If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will take steps to delete it.
  4. Links to Third Party Websites
    1. 11.1.Our website may contain links to third-party websites or services that are not owned or controlled by us.
    2. 11.2.We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services.
    3. 11.3.You further acknowledge and agree that we shall not be responsible or liable, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with use of or reliance on any such content, goods or services available on or through any such websites or services.
  1. Limitation of Liability
    1. 12.1.We exercise reasonable efforts to safeguard the security and confidentiality of your personal data; however, we will not be liable for unauthorised disclosure of personal data that occurs through no fault of ours.
  1. Changes to This Policy
    1. 13.1.We may update this Policy from time to time to reflect changes in our practices, our Service, or Nigerian law. Where changes are material, we will notify you through the app, by email, or by another reasonable means before the changes take effect. The “Last updated” date at the top of this Policy indicates when it was last revised.
  2. Contact Us

If you have questions, requests, or complaints about this Policy or our handling of your personal data, please contact:

  1. 14.1.Data Protection Officer – Datateam
  2. 14.2.General privacy enquiries: mycar@fortelhq.com
  3. 14.3.Registered address: 234Drive Limited,, Nigeria

You may also contact the Nigeria Data Protection Commission directly at www.ndpc.gov.ng if you are not satisfied with our response.