Data Protection & Privacy Policy

Last updated: 22 August 2026 · Aligned with the Nigeria Data Protection Act, 2023 (NDPA 2023) and the NDPC General Application and Implementation Directive, 2025 (GAID 2025).

On this page Who we are Legal framework Data we process Registry & identity lookup data Biometric data (face verification) Lawful basis Use & minimisation Processors & transfers Security Retention Your rights Breach notification Contact

This Policy explains how SmartWorks360 (“we”, “us”, “our”) collects, uses, secures, retains, and shares personal data — including data obtained through third-party identity and corporate registry lookups — when you use our mobile app, employer dashboard, and related services (the “Services”). We process personal data as a data processor where we process employee personal data on behalf of our corporate clients, and as a data controller for our own operations.

1. Who we are and our data protection roles

Entity: SmartWorks360.
As data processor: where we process the personal data of our corporate clients’ employees — names, employment records, salary details, bank account details, and identity data (BVN and government-issued identity documents) — we do so on behalf of and on the instructions of the client organisation, which remains the data controller of that data.
As data controller: we are the controller for our own operations, including the personal data of our own employees and of our business contacts at client organisations.
Data Protection Officer (DPO): reachable at privacy@smartworks360.com.
Supervisory authority: the Nigeria Data Protection Commission (NDPC).

2. Legal framework

We process personal data in accordance with:

the Nigeria Data Protection Act, 2023 (NDPA 2023) — the principal data protection law, which builds on and supersedes the earlier NDPR framework;
the NDPC General Application and Implementation Directive, 2025 (GAID 2025), which operationalises the NDPA; and
any other applicable Nigerian law and the contractual and regulatory requirements of our licensed data-source partners.

We apply the NDPA data-processing principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity, confidentiality and accountability.

3. Personal data we process

Identity & contact: name, email address, phone number, date of birth.
Employment data: employer, role, staff ID, salary details (provided by the employer).
Financial data: bank account details; and, for salary-advance applicants, Bank Verification Number (BVN).
Verification media: a photo of a government ID and a face-scan (liveness) capture. The face scan constitutes biometric data, a category of sensitive personal data under the NDPA 2023 — see section 5.
Registry & lookup data: corporate and identity information retrieved from licensed providers — see the next section.
Device & usage data: device type, app version, and diagnostic logs.

4. Registry & identity lookup data — how it is managed

To verify organisations and applicants, we retrieve data from licensed lookup providers, including Mono (corporate registry / CAC lookups) and Monnify (BVN identity match). This section describes the full lifecycle of that lookup data, as required for our onboarding with those providers.

4.1 What is retrieved

Corporate registry (CAC) lookup via Mono, keyed by the company’s RC number: company name, RC number, registration date, registered/head-office address, and the particulars of the company’s directors — each director’s name, designation, date of birth, nationality, and address.
BVN identity match via Monnify, for individual salary-advance applicants: a match result comparing the applicant-supplied name, date of birth, and phone against the BVN record. We receive match outcomes; we do not retrieve or store the full BVN record.

4.2 Purpose (purpose limitation)

Lookup data is retrieved and used solely to verify the identity and legitimacy of an organisation and its authorised representatives, and of individual applicants, for Know-Your-Customer (KYC), anti-fraud, and regulatory-compliance purposes. It is not used for marketing, profiling unrelated to verification, automated decision-making with legal effect without human review, or any purpose incompatible with verification.

4.3 Lawful basis for lookups

We perform lookups on the basis of (a) the necessity of processing for entering into and performing our contract with the organisation/applicant; (b) compliance with our legal and regulatory KYC/AML obligations; and (c) our legitimate interest in preventing fraud. Where a director’s or third party’s personal data is returned by a registry, we rely on the legal obligation and legitimate-interest bases and limit use strictly to verification. The person initiating verification confirms they are authorised to submit the organisation’s details.

4.4 Storage, minimisation & security of lookup data

We store only the fields necessary for verification (company name, RC number, business address, and director particulars needed to complete director verification). We do not retain provider payloads beyond what is required.
Lookup results are stored in access-controlled databases; sensitive identifiers (e.g. BVN) are encrypted at rest and are never displayed in full.
Access is restricted to authorised personnel and internal compliance staff on a need-to-know basis, and administrative access is audit-logged.
Data in transit is protected with TLS encryption.

4.5 Retention & deletion of lookup data

We retain verification and lookup data only for as long as necessary to fulfil the verification purpose and to meet legal, tax, and regulatory record-keeping obligations (including AML record-retention requirements). When it is no longer required, we delete or irreversibly anonymise it. An organisation or data subject may request deletion, which we honour subject to overriding legal-retention requirements.

4.6 Sharing of lookup data

Lookup data is not sold and is not shared for any purpose other than verification. It is accessible to the relevant employer organisation only insofar as it concerns that organisation’s own registration, and may be disclosed to regulators or law enforcement where legally required.

5. Biometric data — face verification

Salary-advance applicants complete a face scan (liveness check) as part of first-time identity verification. Because a facial template derived for the purpose of uniquely identifying a person is sensitive personal data under the NDPA 2023, this section sets out that processing separately and in full.

5.1 What is processed

A short video of the applicant’s face, captured on the applicant’s own device and streamed directly to our verification processor for analysis.
Up to two still reference images returned by that analysis.
A liveness confidence score, and a face-comparison similarity score measured against the government ID document supplied by the same applicant.

5.2 Purpose (purpose limitation)

The face scan is used solely to establish that a real, live person is present and that this person is the individual shown on the submitted identity document, for KYC, anti-fraud, and AML compliance. It is not used for marketing, advertising, profiling, emotion or demographic inference, surveillance, or model training. We operate no face collection or biometric search index: every comparison is one-to-one against the applicant’s own document, never a one-to-many search.

5.3 Lawful basis

We rely on the explicit consent of the data subject, obtained in-app immediately before the scan begins, together with our legal obligation to conduct KYC/AML identity verification. Consent is freely given: an employee who declines retains full access to the remainder of the Services and forgoes only the salary-advance facility, for which verified identity is a precondition of lending. Consent may be withdrawn at any time, and withdrawal triggers erasure of the biometric records subject to overriding AML retention obligations.

5.4 Processor, storage, and cross-border transfer

Liveness analysis and face comparison are performed by Amazon Web Services (AWS), using Amazon Rekognition, as our data processor under its data processing addendum.
Face-scan images and identity documents are stored in encrypted AWS object storage in the Europe (Ireland) region. This is a cross-border transfer outside Nigeria, made on the basis of the data subject’s explicit consent and contractual safeguards — see section 8.
The video is transmitted from the applicant’s device to the processor over an encrypted connection. Access to stored images is restricted to authorised compliance personnel on a need-to-know basis and is audit-logged.

5.5 Retention & erasure

Biometric verification records form part of the KYC file we are required to retain under AML record-keeping rules, and are held for the statutory period following the end of the customer relationship, after which they are deleted or irreversibly anonymised. A data subject may request erasure at any time; we honour such requests except where retention is legally mandated, and we inform the data subject where that exception applies.

5.6 Sharing

Biometric data is never sold and is not disclosed to the employer organisation, which receives only the binary outcome of verification. It may be disclosed to regulators or law enforcement where legally required. Given the sensitivity of this processing, it is treated as high-risk and subject to a Data Protection Impact Assessment under GAID 2025.

6. Lawful basis of processing

Under NDPA 2023, we rely on one or more of the following bases:

Contract — to provide the Services you or your employer request.
Legal obligation — KYC/AML, tax, and regulatory compliance.
Legitimate interest — fraud prevention and securing the Services.
Consent — where required (e.g. certain verification steps); consent may be withdrawn at any time.

7. Use & data minimisation

We collect and process only the personal data necessary for the stated purposes, retain it only as long as needed, and design our verification flows to request the minimum data required. High-risk processing is subject to a Data Protection Impact Assessment (DPIA) as contemplated by GAID 2025.

8. Processors & cross-border transfers

We engage vetted service providers as data processors under written agreements requiring NDPA-consistent safeguards, including:

Mono — corporate registry (CAC) lookups.
Monnify — payments, wallet funding, card processing, and BVN identity match.
Amazon Web Services (AWS) — cloud hosting and encrypted object storage, and the face-liveness and face-comparison processing described in section 5.
Cloud hosting, storage, and email providers supporting our operations.

Where any processing or storage occurs outside Nigeria, we ensure an adequate level of protection and appropriate safeguards consistent with the NDPA 2023 and GAID 2025 cross-border transfer requirements. Specifically, identity documents and biometric face-scan data are stored and processed in AWS’s Europe (Ireland) region; that transfer is made on the basis of the data subject’s explicit consent and a data processing agreement imposing NDPA-consistent obligations on the processor.

9. How we protect data

We apply technical and organisational measures including encryption of sensitive data at rest (e.g. BVN, bank account numbers) and TLS in transit, role-based access controls, audit logging of administrative actions, and continuous monitoring. No system is perfectly secure, but we work to protect personal data and to respond promptly to incidents.

10. Data retention

We retain personal data for as long as an account is active and as long as necessary to provide the Services and to meet legal, tax, and regulatory obligations, resolve disputes, and enforce our agreements. Financial and verification records may be retained for statutory periods. Thereafter we delete or anonymise the data.

11. Your rights

Subject to applicable law, you may:

access the personal data we hold about you and request a copy;
request correction of inaccurate or incomplete data;
request erasure, subject to legal-retention requirements;
object to or restrict certain processing, and withdraw consent where processing relies on consent;
request portability of data you provided, where applicable.

To exercise these rights, contact our DPO (below). We respond within the timelines required by the NDPA 2023 and GAID 2025. You also have the right to lodge a complaint with the NDPC.

12. Breach notification

In the event of a personal-data breach likely to result in risk to data subjects, we will notify the NDPC and, where required, affected individuals in accordance with the timelines and requirements of the NDPA 2023 and GAID 2025 (including notification to the Commission within 72 hours of becoming aware, where applicable).

13. Children

The Services are intended for employed adults (18+) and are not directed at children. We do not knowingly collect data from anyone under 18.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new “Last updated” date and, where appropriate, notify you in the app.

15. Contact us

For any privacy question, request, or complaint, contact our Data Protection Officer at privacy@smartworks360.com. You may also contact the Nigeria Data Protection Commission (NDPC) as the supervisory authority.