Privacy Policy

Introduction

i-Swipe Technologies Limited ("i-Swipe", "we", "us", "our"), RC No. 7752654, provides i-Swipe HR Suite. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have in relation to it.

This policy applies to our website at iswipehr.com, our web application at app.iswipehr.com, and all services provided under the i-Swipe HR Suite brand. It does not apply to third-party websites, applications or services linked from our platform.

Who decides what

Your employer's staff records. When a company uses i-Swipe HR Suite, that company is the data controller for its staff records: it decides what is recorded and why. i-Swipe is its data processor and handles the data only on its instructions, under our data processing agreement. If you are an employee, questions about your HR records go first to your employer's HR team or data protection contact. You can also send a request from the Privacy page in your account.

Our own data. i-Swipe is the data controller for data about our customers' account holders, website visitors, people who contact us or book a demo, and newsletter subscribers.

Information we collect

Information you or your employer provide:

• Account details: name, work email address, phone number and company name
• Staff records an employer creates or imports: names, date of birth, contact and emergency contact details, job and pay details, bank account details, pension (RSA) PIN and tax identification number (TIN), attendance, leave, performance and documents. Some employers also record a National Identification Number (NIN). This field is optional.
• Location at clock-in, only where the employer uses GPS or geofenced clock-in
• Job applications sent through a company's careers page: your details, CV and the consent you gave
• Messages to support, and questions asked of the AI assistant where the employer has switched it on
• WhatsApp or USSD messages, only for staff who link their phone number
• Website forms: your name, email, phone, company and message when you contact us, book a demo or apply to be a partner. A work email is welcome, but a personal email such as Gmail is fine.
• Newsletter: your email address, and when and how you confirmed your subscription
• Subscription billing details. Card and bank payments are handled by Paystack; we do not see or store full card numbers.

Information collected automatically:

• Sign-in records: time, IP address and browser, plus security events such as failed sign-ins
• An audit trail of changes made in the app: who changed what, and when
• For API users: a log of each API call, with the calling IP address

We do not use advertising trackers or third-party analytics on the website or the app. We do not buy data about you from other sources.

How we use your information

1. To provide i-Swipe HR Suite as each customer has set it up: payroll and statutory deductions, leave, attendance, performance, recruitment and self-service
2. To send service emails and in-app notifications, such as sign-in codes, payslip notices and approval requests
3. To answer support requests and enquiries, and to arrange demos
4. To keep the platform secure and to detect and prevent fraud and abuse
5. To bill customers and manage subscriptions
6. To send our newsletter, but only to people who confirmed their subscription
7. To meet our legal obligations

Legal basis for processing

Under section 25 of the NDPA, we rely on the following lawful bases:

Sharing and sub-processors

We do not sell personal data, and we do not share it with anyone for their own marketing. We share it only in these cases:

• Sub-processors who help us run the service, under written contracts:
  • Our hosting provider, which runs the app, database and files
  • Our email delivery (SMTP) provider
  • Paystack (Nigeria), for subscription payments. No employee data is shared.
  • Anthropic PBC (United States), for the AI HR assistant and AI writing help. This applies only when a company switches these on. Anthropic receives the question and the records needed to answer it.
  • Meta (WhatsApp Business) and Africa's Talking (USSD), only for staff who link their phone
  • proxycheck.io (United Kingdom), to check whether a clock-in comes from a VPN, proxy or data-centre network. It receives only the internet address of the clock-in, and its answer is kept for 7 days.
  • Google or Microsoft, only when a company uses "Sign in with Google/Microsoft"
  The current list for this installation is on our Trust page. We give customers 30 days' notice before adding a new sub-processor.
• Statutory bodies: where an employer uses the platform to prepare or send returns to tax authorities, pension fund administrators, NSITF or NHF
• Legal requirements: courts, regulators or law enforcement, when we are legally required to
• Business transfers: in a merger or sale, with notice to customers and the same protections continuing

Transfers outside Nigeria

Some data leaves Nigeria when a company switches on a feature that needs it:

• AI assistant and AI writing help (Anthropic, United States): the question and the records needed to answer it are sent to Anthropic. An example is the person's leave balance. Under Anthropic's commercial terms, this data is not used to train AI models. The transfer relies on appropriate safeguards under Part VIII of the NDPA and the GAID, namely a data processing agreement with standard contractual clauses. Each company decides whether to switch the AI features on, and can switch them off at any time.
• WhatsApp (Meta) and sign-in with Google or Microsoft: these services may process data outside Nigeria under their own data processing terms.

We do not transfer personal data outside Nigeria for any other purpose.

How long we keep data

We keep personal data only as long as it is needed. These periods are applied automatically by scheduled jobs:

A company can export its data at any time before it leaves. When data reaches the end of its period, we delete it or remove everything that identifies the person.

Security measures

Our technical and organisational measures include:

• Encryption in transit: the website and app are served over HTTPS
• Passwords and sign-in: passwords are stored only as bcrypt hashes. Two-step sign-in is available to everyone, and companies can make it compulsory. Its secret keys are encrypted with AES-256-GCM.
• Separation: each company's data is kept apart, and every request is checked against the signed-in company
• Access by role: people see only what their role needs. Pay and bank details are limited to HR admins and finance.
• Audit trail: changes are recorded with who made them and when
• Private files: CVs, staff documents and photos are stored outside the public web folder. Only signed-in, authorised users can download them.
• Backups: made nightly and rotated

Your data rights

Under the NDPA 2023, you have the right to:

1. Be informed about how your data is used. This policy, and your employer's privacy notice in the app, do that.
2. Access the personal data held about you. Staff can download their own data from the Privacy page in the app.
3. Correct data that is wrong or incomplete
4. Erase data where there is no longer a lawful reason to keep it
5. Restrict or object to some processing
6. Data portability: receive your data in a structured, machine-readable format (JSON)
7. Withdraw consent at any time where we rely on consent, for example the newsletter

If your request is about staff records, your employer answers it, and we help them. Staff can send a request from the Privacy page in their account. For anything else, email [email protected]. We reply within 30 days.

You can also complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Cookies

We use only the cookies the service needs. We do not use advertising or analytics cookies, so there is nothing to opt out of.

The website loads its font from Google Fonts. Your browser therefore connects to Google, which receives your IP address. You can block cookies and storage in your browser settings, but the app needs the session cookie to sign you in.

Updates to this policy

We may update this Privacy Policy when our practices, technology or the law change. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Tell customers' HR admins by email or in the app

Contact us

For questions about this policy, to exercise your rights, or to raise a data protection concern, contact our data protection team:

• Email: [email protected]
• General enquiries: [email protected]
• Phone: +234 906 977 7799
• Post: Data Protection Officer, i-Swipe Technologies Limited, Flat 4, Yaounde Street, Wuse Zone 6, FCT Abuja, Nigeria