PRIVACY POLICY (TORRISTA)

Effective date: September 23, 2026

1.0 Purpose of this Privacy Policy

This Privacy Policy (“Privacy Policy” or “Policy”) explains how Qoray Mobility and Energies Limited (“QMEL”, “we”, “us” or “our”), the owner and operator of the Torrista travel and tourism marketplace platform (“Torrista”), collects, uses, stores, shares, protects and otherwise processes personal data relating to travellers, vendors, prospective users and other individuals who interact with Torrista or use its products and services (“you” or “your”). This policy is established in compliance with the Nigeria Data Protection Act (NDPA), 2023, as well as other relevant data privacy laws and regulations.

This Policy also explains:

• the types of personal data we collect;
• how and why we use your personal data;
• who we may share your personal data with;
• how we protect your personal data; and
• the rights available to you under applicable data protection laws.

We process personal data in accordance with the Nigeria Data Protection Act, 2023 (“NDPA”), the General Application and Implementation Directive (NDP Act GAID) and other applicable data protection and privacy laws and regulations.

2.0 Definitions of Terms

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

Consent: your clear agreement allowing QMEL to collect, use, or otherwise process your personal data for a specific purpose. Where processing is based on your consent, you may withdraw it at any time.

Data Controller: the organisation that decides why and how your personal data is collected, used, stored, shared, or otherwise processed. Under this Privacy Policy, QMEL is the Data Controller.

Data Processor: an individual or organisation that processes personal data on behalf of QMEL and in accordance with our instructions.

Data Protection Officer (DPO): the designated officer responsible for overseeing QMEL's compliance with applicable data protection laws and serving as the primary contact for privacy-related enquiries, requests, and complaints.

Data Subject: any individual whose personal data is collected, used, stored, shared, or otherwise processed by QMEL.

Lawful Basis: the legal reason that allows QMEL to process your personal data. These include consent, performance of a contract, legal obligation, legitimate interests, vital interests, and public interest, as permitted by applicable law.

Legitimate Interest: a lawful basis that allows QMEL to process personal data where it is necessary for a legitimate business purpose, provided your rights and freedoms are respected.

Nigeria Data Protection Act (NDPA): the law that governs how personal data is collected, used, stored, shared, and protected in Nigeria.

Nigeria Data Protection Commission (NDPC): the independent regulatory authority responsible for overseeing and enforcing compliance with data protection and privacy laws in Nigeria.

Personal Data: any information that identifies you or can be used to identify you, either on its own or together with other information. Examples include your name, contact details, identification number, photograph, or financial information.

Personal Data Breach: a security incident that results in personal data being lost, altered, accessed, disclosed, or destroyed without authorisation.

Processing: any activity carried out on personal data, including collecting, recording, storing, organising, using, sharing, updating, transferring, or deleting it.

Recipient: any individual, organisation, or public authority that receives your personal data from QMEL where necessary and in accordance with applicable law.

Sensitive Personal Data: personal data that requires additional protection under applicable law because of its sensitive nature. This may include biometric information, health information, and other categories of personal data recognised by law as sensitive.

Third Party: any individual or organisation, other than you or QMEL, that receives or processes your personal data in accordance with this Privacy Policy and applicable law.

3.0 Who We Are

QMEL is a limited liability company incorporated under the laws of the Federal Republic of Nigeria, with its registered office at 310, Opebi Road, Ikeja, Lagos State, Nigeria.

QMEL owns and operates Torrista, a digital travel and tourism marketplace that connects travellers with vendors and tour operators for tours, experiences, and related travel services, and facilitates access to travel financing through partner financial service integrators.

This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal data when you:

• use the Torrista platform, mobile application, or website;
• book tours, experiences, or other services listed on Torrista;
• register or operate as a vendor on Torrista;
• communicate with us; or
• otherwise interact with Torrista.

4.0 How We Use Personal Data

At QMEL, we collect and process personal data responsibly, fairly and lawfully, and only where we have a valid legal basis to do so.

We use personal data to:

• create and manage traveller and vendor accounts on Torrista;
• process bookings, payments, and vendor payouts;
• verify the identity of travellers, vendors, and administrators;
• facilitate referrals to our financial service integrators where you choose to apply for travel financing;
• manage vendor onboarding, listing approval, and content moderation;
• respond to your requests and communicate with you;
• improve our services and your experience on the platform;
• comply with legal and regulatory obligations; and
• protect the security and integrity of the Torrista platform.

We are committed to safeguarding your personal data and ensuring that it is processed in line with applicable data protection laws and industry standards.

4.1 Data Protection Principles

QMEL processes personal data in accordance with the principles set out under the Nigeria Data Protection Act (NDPA). Accordingly, we are committed to ensuring that personal data is:

• processed lawfully, fairly and transparently;
• collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
• adequate, relevant and limited to what is necessary for the purposes for which it is processed;
• accurate and kept up to date where necessary;
• retained only for as long as necessary for the purposes for which it was collected or as required by law; and
• protected through appropriate technical and organisational measures to ensure its confidentiality, integrity, and availability.

5.0 Lawful Bases for Processing

The lawful basis for processing your personal data depends on the nature of the processing activity and your relationship with Torrista. We may process your personal data based on one of the six lawful bases:

• Consent: We may process your personal data where you have given clear, informed, and specific consent for one or more purposes to do so.
• Performance of a contract or taking steps before entering into a contract: We process your personal data to fulfil contractual obligations, such as processing a booking.
• Legitimate interest: We may process your personal data to fulfil the legitimate interests pursued by QMEL, such as securing the platform.
• Legal Obligation: We may process your personal data to comply with a legal or regulatory requirement.
• Vital Interest: We may process your personal data to protect your vital interests where necessary, such as during emergencies affecting your safety while travelling.
• Public Interest: We may process your personal data to perform a task carried out in the interest of the public, where applicable to our operations.

6.0 Individuals to Whom This Privacy Policy Is Addressed

This Privacy Policy applies to individuals whose personal data we process, including:

• travellers and customers who book tours, experiences, or other services on Torrista;
• vendors, tour operators, and service providers listed on Torrista;
• prospective vendors applying to be listed on the platform;
• users who apply for travel financing through our financial service integrators;
• individuals who contact our customer support;
• visitors to the Torrista website and mobile application; and
• recipients of electronic or other communications that reference this Privacy Policy.

7.0 The Data That We Collect and How It Is Used

7.1 How We Collect and Use Your Data

We collect and process personal data to provide our platform, manage our relationship with you, comply with legal and regulatory obligations, protect our users and business operations, prevent fraud, improve our services, and support our legitimate business activities.

The personal data we collect depends on your relationship with Torrista and the products, services, and interactions you have with us. We may collect personal data directly from you, automatically through your use of the platform, or from third parties where permitted by law. Examples of collection channels include:

• account registration and onboarding, for travellers and vendors;
• the booking and checkout process;
• our website and mobile application;
• emails, calls, and customer support interactions;
• cookies and similar technologies used across our digital channels;
• social media and online interactions with Torrista; and
• third parties, including our financial service integrators, payment processors, and identity verification providers, where permitted by law.

We only collect personal data that is reasonably necessary and proportionate for the purposes described in this Privacy Policy. We do not sell your personal data.

Where we process your personal data based on consent, you may withdraw your consent at any time using the channels identified in this Privacy Policy. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

7.2 Categories of Personal Data We Process

Depending on your relationship with Torrista and the services you use, we may process the following categories of personal data.

a. Identification and Verification Information

Information used to identify and verify travellers and vendors, and to comply with fraud prevention and regulatory obligations. Examples may include:

• full name, date of birth, and photograph;
• government-issued identifiers, where required for a booking or a financing application (e.g. international passport, National Identification Number, or driver's licence details); and
• vendor business registration and identification documents.

b. Contact Information

Information used to communicate with you and manage our relationship with you. Examples may include:

• residential or business address;
• email address and telephone number; and
• communication preferences.

c. Vendor and Business Information

Where relevant to vendor onboarding, listing management, or payouts, we may process:

• business name and registration details;
• contact person details;
• listing and performance information; and
• payout account details.

d. Financial and Transaction Information

Information necessary to process bookings, payments, and vendor payouts. Examples may include:

• payment card or bank account details used at checkout;
• booking and transaction records;
• vendor payout records; and
• information shared with our financial service integrators where you apply for travel financing (subject to your consent and that integrator's own privacy notice).

Where payment card information is processed, appropriate security controls and applicable industry standards are applied.

e. Sensitive Personal Data

Torrista does not require sensitive personal data to use the platform. Where you voluntarily provide health, dietary, or accessibility information to enable a vendor to accommodate a specific need on a tour or booking, we process this limited information, with your consent, only for that purpose and only for as long as necessary to fulfil the booking.

f. Authentication and Security Information

To secure access to our platform, we may process authentication and security information, including:

• username and authentication credentials;
• device verification information; and
• security logs.

g. Technical and Device Information

When you use the Torrista website or application, we may collect information such as IP address, browser type, operating system, device identifiers, access dates and times, session information, and diagnostic data.

h. Location Information

Where enabled through your device settings, we may process location information to support tour discovery, service delivery, and fraud prevention. You may manage location permissions through your device settings.

i. Usage, Analytics, and Digital Interaction Information

We may collect information relating to how you interact with the Torrista website and application, including browsing activity, product usage patterns, preferences, and interaction history, generated through cookies and similar technologies. Additional information regarding cookies and tracking technologies is provided in our Cookie Notice.

7.3 Profiling and Automated Decision-Making

We may use analytics to understand platform usage and to personalise tour and experience recommendations shown to you on Torrista.

Where you apply for travel financing through one of our financial service integrators, any credit assessment or lending decision is carried out by that integrator in accordance with its own privacy notice and lawful basis; Torrista does not itself make credit or lending decisions.

Where profiling or automated processing significantly affects you, we will implement appropriate safeguards in accordance with applicable law, including providing you with information about the processing and, where applicable, the ability to request human review.

7.4 Cookies and Similar Technologies

We use cookies and similar technologies to operate and secure the Torrista platform, remember your preferences, analyse usage, and improve functionality and performance. Cookies are small data files stored on your device when you visit our website.

When you visit the Torrista website, a cookie consent banner allows you to Accept all, Reject all, or Manage preferences to choose which categories of cookies you allow. Cookies are grouped into Strictly necessary, Analytics, and Marketing categories. Strictly necessary cookies cannot be switched off, as they are required for core functions such as signing in and booking a tour; all other categories are off by default until you choose to turn them on.

You can review, change, or withdraw your cookie preferences at any time using the “Cookie Preferences” link in the footer of our website, which reopens the same preference panel.

7.5 Information from Social Media and Online Platforms

We may collect information from social media platforms or online accounts where you interact with us, or from which you choose to share such information with us.

7.6 Other Information We Process

Other categories of personal data we may process and the lawful bases for processing are highlighted below:

Note: The personal data elements identified above are not an exhaustive list and may vary depending on the nature of the relationship between the individual and QMEL.

8.0 Your Rights

You have certain rights that you may exercise regarding your personal data. These rights may include:

• Right to be Informed: You have the right to receive clear and transparent information about how we collect, use, store, disclose and otherwise process your personal data.
• Right of Access: request confirmation of whether we process your personal data and obtain access to information about such processing.
• Right to Rectification: request correction of inaccurate or incomplete personal data.
• Right to Data Portability: request a copy of certain personal data in a structured, commonly used, and machine-readable format, where applicable.
• Right to Erasure: request the deletion of your personal data where permitted by law.
• Right to Restrict Processing: request that we limit how we process your personal data in certain circumstances.
• Right to Object: object to certain processing activities, including processing based on legitimate interests and direct marketing.
• Right to Withdraw Consent: withdraw consent at any time where consent is relied upon as the lawful basis for processing.
• Rights Relating to Automated Decision-Making: where applicable, request information about decisions made solely through automated processing and request review where permitted by law.
• Right to Lodge a Complaint: submit a complaint to QMEL and/or the Nigeria Data Protection Commission (NDPC).

Please note that some rights are not absolute and may be limited where processing is necessary to comply with legal or regulatory obligations, prevent fraud, maintain security, exercise legal claims, or fulfil contractual obligations.

9.0 Sharing and Disclosing Your Personal Data

QMEL may share or disclose your personal data where necessary to provide the Torrista platform, perform our contractual obligations, comply with legal and regulatory requirements, prevent or detect fraud, protect our legitimate interests, or where you have provided your consent.

We may share your personal data with authorised third parties, including our financial service integrators, payment partners, and professional advisers, only to the extent necessary for the purposes described in this Privacy Policy and in accordance with applicable data protection laws.

Where third parties process personal data on our behalf, we require them to process such data only in accordance with our instructions and to implement appropriate technical and organisational measures to protect your personal data.

9.1 Law Enforcement

Under certain circumstances, we may be required to disclose your personal data if required by law or in response to valid requests from public authorities (e.g. a court or a government agency).

9.2 Third Party Services

We may use third-party services on our platform or in the course of providing services to you. These services may collect and process personal information on our behalf. We ensure that these third-party services are reputable and comply with applicable data protection laws.

• Our financial service integrators (Alt Travel, and GoTrip once live)
• Identity verification service providers
• Payment processors and payment schemes
• Cloud service providers
• Technology service providers
• Regulatory authorities
• External auditors and professional advisers

10.0 Protecting and Safeguarding Your Information

We take your privacy seriously and take every reasonable measure and precaution to protect and secure your personal data. We work hard to protect you and your information from unauthorised access, alteration, disclosure, or destruction, and have implemented security controls including network security, encryption, restricted access, firewalls, and other forms of security to ensure that your data is protected.

We require all parties, including our staff and third parties processing data on our behalf, to comply with relevant policies and guidelines to ensure the confidentiality and protection of information in use, in storage, and in transit.

11.0 Children or Minors

Torrista's services are intended for individuals aged 18 years and above, or persons who have attained the age of majority in their respective jurisdictions. We do not knowingly collect personal data from children.

If a parent or guardian believes that a child's personal data has been provided to us in error, please contact us at info@torrista.com.

12.0 Retention of Data and Disposal

QMEL retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including providing the platform, complying with legal and regulatory obligations, resolving disputes, and meeting legitimate business requirements.

Retention periods are determined based on the nature of the personal data, the purpose of processing, applicable legal and regulatory requirements, and operational needs. Where personal data is no longer required, it will be securely deleted, destroyed, anonymised, or de-identified in accordance with our retention practices.

13.0 Transfers Outside Nigeria

QMEL may transfer your personal data to countries outside Nigeria, as necessary, to provide our services, comply with legal or regulatory obligations, support our business operations, or engage third-party service providers. Where we transfer personal data outside Nigeria, we will ensure that appropriate safeguards are in place in accordance with the NDPA and the GAID.

For more information about how we transfer and protect personal data outside Nigeria, please contact us at info@torrista.com.

14.0 Links to Other Websites

The Torrista website and mobile application may have links to or from other websites that are not operated by us. We have no control over and assume no responsibility for the content, privacy practices, or security of third-party websites or services. We recommend that you always read the privacy and security statements on these websites.

15.0 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and indicate the effective date at the top of the revised Privacy Policy. Where required by applicable law, or where changes materially affect how we handle your personal data, we will provide additional notice before such changes take effect.

Contact Us

If you have any questions about this Privacy Policy, how we process your personal data, or if you wish to exercise any of your rights under applicable data protection laws, please contact us at info@torrista.com.

We will respond to your request within thirty (30) days of receiving it. Where we are unable to meet this timeframe, we will notify you and provide an update on the expected response date.

If you are dissatisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) in accordance with applicable law.

Our registered office is at 310, Opebi Road, Ikeja, Lagos State, Nigeria.