Luster
Car Care Booking

Privacy Policy

Last updated: 7th September 2026

Luster Beacon Systems Ltd ("Luster," "we," "us," or "our") operates the Luster mobile application (the "App"), a marketplace for booking car wash, mobile mechanic, tow, fuel delivery and other car care services in Nigeria. This Privacy Policy ("Policy") explains what personal data we collect, why we collect it, how we use and share it, and the rights you ("User") have over it.

By creating an account or using the App, you agree to the collection and use of personal information as described in this Policy. Personal information means information that identifies you and includes information such as your name, email address, telephone number as well as any other personal data collected. We recommend that you read this Privacy Policy carefully to understand your rights and our duties towards managing your personal data. For further information or enquiries, reach out to us at Lusterng@gmail.com.

1. Notification of Changes to Privacy Policy

This Privacy Policy will be reviewed annually to ensure compliance with applicable data protection laws and regulations in all jurisdictions where the Services are provided, including but not limited to the Nigeria Data Protection Act (NDPA), 2023. Nonetheless, we are continually improving our methods of communication and adding new functionalities and features to our website and existing services. Because of these ongoing changes, changes in the law and the changing nature of technology, our data protection practices will change from time to time. If and when our data protection practices change, we will update this Policy to describe our new practices and publish them on our website and applications.

2. Data we collect

We collect the following categories of personal data, only where relevant to the feature you're using:

Account & identity data (collected for every user)

Location data

Precise or approximate device location, used to show nearby wash shops, mechanics, and operatives, to calculate estimated arrival times for dispatched services, and to pre-fill your address when booking a doorstep service. Location is only accessed while the App is in use — we do not collect location in the background. If you decline location access, you can still select your city/neighbourhood manually.

Verification data (only if you apply to become a partner shop, mechanic shop, or individual operative)

Payment data

We do not directly collect or store your card number, expiry date, or CVV. Payments are processed by our third-party payment processors, Paystack and Flutterwave, who are independently responsible for the security of your payment card data. We retain only the transaction reference, status, amount, and payment channel (e.g., card, bank transfer) returned to us by the processor.

Booking & usage data

Booking history, service type, scheduled times, ratings and reviews you leave, referral activity, and your Luster credit balance.

Device & technical data

Communications

Support messages you send us, and the SMS one-time-passcode messages we send to verify your phone number.

3. How we use your data

We use the data described above to:

4. Understanding what you want (use of cookies)

We might use cookies (small text files in your browser) and other techniques such as web beacons (small, clear picture files that follow your movements on our website). These collect information that makes the website remember you and tells us how you use our website, web-related products and services. This, in turn, helps us make our website relevant to your interests and needs. They also help us find information once you have logged in or help us link your browsing information to you and your personal information, for example, when you choose to register for a service. We may use a persistent cookie (that stays linked to your browser) to record your details so we can recognise you if you visit our website again. Your cookie preferences, including whether you accept or reject cookies, may also be stored to remember your choice for future visits. If you choose not to accept cookies from our website, this may limit its functionalities or performance.

5. Consent

You accept this Policy when you click on the "continue" button to sign up and use any of our Platforms, products and Services. You also consent to the collection and processing of your personal information (which includes but is not limited to your name, date of birth, email address, address, telephone number, etc), your order details, order history and any other information for the purpose of providing the Services. If you decide to opt out of any of the Services or withdraw consent for the processing of your personal information, you can do so by reaching out to us at Lusterng@gmail.com.

6. Legal basis for processing

Under NDPA 2023, we process your personal data on the following bases:

7. Who we share your data with

We share personal data only with the following third parties, and only as needed to operate the App: Paystack/Flutterwave for payment processing, Termii for login verification, Google (Maps / Firebase Cloud Messaging) for location and push notification, etc. We do not sell your personal data. We do not share it with third parties for their own marketing purposes.

If you're a customer booking a service, we share the minimum information the assigned operative or shop needs to fulfil your booking — your name, phone number, and location.

8. Disclaimer

Luster has no prior relationship or representation with the partner/operative whose services are listed on Luster's Platform. Luster is solely responsible for the purchase of the service and the delivery of the service to the customer upon confirmation of payment.

Luster will not be responsible for any breach in the representations made by the partner/operative concerning any service made by the customer and does not guarantee that the representations will be fit for purpose, true and accurate.

9. Storage and Security

We protect your information using physical, technical, and administrative security measures to reduce the risks of loss, misuse, disclosure, or alteration and unauthorised access.

Personal information is collected on servers in electronic databases which are in the EU and managed by our related entities and/or vendors. We will ensure that your information is protected and that they only process your information in the way we have authorized them to. These organizations will not be entitled to use your personal information for their own purposes unless authorised by you. Where such cross-border transfers occur, we will ensure that they are carried out in accordance with applicable data protection laws and that appropriate safeguards are implemented to protect your personal data.

We have put in place suitable physical, and electronic administrative procedures and measures to safeguard and protect the information that we collect, and to reduce the risks of loss, misuse, disclosure, alteration and unauthorised access to your personal information within our custody. Personal information and associated data stored on servers are encrypted and stored through data isolation technology.

We limit access to personal information to individuals within our employ or that of our related entities or contracted vendors who we believe reasonably need access to such information to provide products or services to you, or to us, or to perform their duties. Some of the safeguards we use are firewalls and data encryption, physical access controls to our data centres, and information access authorization controls. To prevent unauthorised access to your information, we have implemented strong controls and security safeguards at the technical and operational levels. Our website uses a Secure Sockets Layer (SSL) to ensure secure transmission of your Personal Data. You should see the padlock symbol in your URL address bar when browsing through our website. The URL address will also start with https:// depicting a secure webpage. SSL applies encryption between two points such as your PC and the connecting server. Any data transmitted during the session will be encrypted before transmission and decrypted at the receiving end. This is to ensure that data cannot be read during transmission.

We will never ask for your secure personal or account information by unsolicited means of communication. You are responsible for keeping your personal and account information secure and not sharing it with others. We shall not be liable for any unauthorised access or loss of personal and account information.

10. Data retention

We retain personal data for as long as your account is active, and for 5 years afterward to comply with our legal, accounting, and dispute-resolution obligations. Verification documents (ID photos) submitted by partners/operatives are retained for 5 years after account closure or rejection.

11. Your rights

Under the Nigeria Data Protection Act 2023, you have the right to:

You can make any of the above requests by contacting us via email at Lusterng@gmail.com. Our office address is 6 Caroline Atounah Street, Lekki Phase 1.

We will provide you with a response as soon as possible. If we are unable to comply with your request for any reason (such as not being permitted or required to do so under privacy legislation in force or any other applicable legislation) we will inform you of this.

If the personal information we provide in response to your request includes information that is the personal information of a third party, or that is confidential, or in which we own the copyright (such as transcripts or recordings of customer service call records), we may redact such information where reasonably necessary, and you must keep such information confidential and not make the information public, including by sharing the information on social media, without our written consent sought and obtained.

Users can also delete their accounts from the Luster application. If you delete your account, we will retain your personal information in accordance with our Retention Policy.

Luster may retain your personal information after you have requested us to delete or de-identify your information if:

When personal information is no longer required, we will take reasonable steps to delete the personal information from our systems or de-identify the personal information.

12. Children's privacy

The App is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Data Protection Officer

In compliance with the Nigeria Data Protection Act (NDPA) 2023, we have appointed a Data Protection Officer (DPO) responsible for overseeing our data protection strategy and implementation. You may contact our DPO regarding any issue related to this Privacy Policy or your personal data at: clintonjacklegal@gmail.com.

14. Governing Law

This Policy is governed by the laws of the Federal Republic of Nigeria. Where any provision of this Policy is deemed inconsistent with a law, regulation or convention, such provision shall be subject to the overriding law, regulation or convention.

This Policy applies to all Users of the Services provided by Luster, and to anyone else who contacts Luster or otherwise submits information to Luster.

Contact us

Last reviewed in September 2026