Who are we?

Pade HCM Technology Limited (“PaidHR”) “Our”, “Us”, or “We” is a retail technology company based in Lagos, Nigeria, with Our registered address at 11 Providence Street, Lekki Phase 1, Lagos. Our business involves providing human resource, payroll and related financial technology services, including facilitating access to third-party credit facilities through Our marketplace, to businesses in Nigeria and to the individuals who use Our platform (Our “Services”). We are registered with the Nigeria Data Protection Commission (the “NDPC”) and subject to its regulatory supervision in respect of data protection. If You have any questions about this Privacy Policy or how and why We process Personal Data, please contact Us at hello@paidhr.com.

Our Privacy Policy has been prepared to meet the requirements of the extant Nigeria Data Protection Act (the “NDPA”). We are committed to protecting the confidentiality and privacy of all personally identifiable information (“Personal Data”) entrusted to Us through this website and/or Our mobile application, or otherwise (“Website”). Our Privacy Policy, together with Our Terms of Use, explains the type of Personal Data we collect, when, how and why We collect Personal Data, lawful basis for processing the Personal Data, how We use the Personal Data, the conditions under which We may disclose Personal Data to others and the efforts We take to keep Personal Data secure, and Your Rights as regards Personal Data collected and processed. By registering for or using Our services, You acknowledge that You have read and agree to Our Privacy Policy and Terms & Conditions, which are incorporated herein by reference.

The terms ‘You’ and ‘Your’ means You as an individual accessing this Website and applying for or using Our Services. Where We make decisions on how Personal Data is used in connection with Our Services, We are acting as a Data Controller and will be responsible for the obligations of a Data Controller under the NDPA in connection with the processing of Personal Data. For example, We use this Privacy Policy and other notices to provide You with information about Our use of Personal Data, as required by the NDPA. Where We only use Personal Data requested by other Data Controllers, We would be acting as Data Processors and those other Data Controllers are similarly responsible for the obligations of a Data Controller under the NDPA in connection with the processing of those categories of Personal Data. If You are using Our Services through those other Data Controllers, You should contact them if You have questions or concerns about the processing of Your Personal Data or compliance with the NDPA and other applicable laws.

The credit facilities referred to above are made available through Our Loan Marketplace. They are provided, underwritten and funded by independent, licensed third-party financial institutions and financing providers (each a “Loan Partner” and together Our “Loan Partners”). PaidHR is not a lender and does not itself grant credit. Where You apply for a product offered by a Loan Partner, Your Personal Data will be shared with that Loan Partner, and that Loan Partner will process Your Personal Data as an independent Data Controller under its own privacy policy. Section 6 explains this in full, and You should read it before making an application.

We may update and modify this Privacy Policy from time to time, so please do return to the Website and review this Privacy Policy regularly. Unless otherwise stated, any updates to this Privacy Policy become effective when We post the updates on the Website. Your continued use of the Website for Our Services following an update to the Privacy Policy means that You are aware of the updated Privacy Policy and have no objections to any such updated Privacy Policy. Please read the following carefully to understand Our views and practices regarding the processing of Your Personal Data.

1. What Personal Data Do We Collect?

We may hold and use various types of Personal Data collected at the start of, and during Your relationship with Us. We will limit the collection and processing of these Personal Data to what is necessary to achieve the purposes identified in this notice. The information You provide to us must be correct, accurate, complete and not misleading.

The Personal Data We collect includes:

• Personal details, including Your name, residential address, phone numbers, email address, date of birth, gender, nationality, national identity number, employment status;
• Financial and banking information, including bank account details, bank verification number and transactional information;
• Means of identification, including permanent voters card, drivers license, passport, utility bill;
• Employee details including tax identification number, pension fund administrator name and RSA number, HMO details, employment letter, payslips;
• Company details including job title, department, company name, company address, incorporation certificates, directors and shareholders ID, personal information of employees who may act as agents, work email address and office phone number;
• Applicant details, including university certificates, birth certificates, academic certificates and passport photograph;
• Log in details including username and authentication credentials (passwords are stored only in irreversibly hashed form and are not accessible to Our personnel);
• Identifiers assigned to Your computer or other devices, including Your Internet Protocol (IP) address and other information about Your visits to the Website;
• Usage information and browsing history including usage metrics (including usage rates, occurrences of technical errors, diagnostic reports, settings preferences, content, and advertising interactions);
• Information collected from fraud prevention and investigation agencies;
• Details of any contacts that We have had with You;
• Details of any contact with Us including any telephone, email or other communication with You; and
• Information collected through customer feedback surveys.

Where You apply for, or express interest in, a product offered through Our Loan Marketplace, We also collect:

• Employment and income data used to assess affordability, including Your gross and net monthly salary, salary payment history and pattern, length of service, confirmation of employment status, employment contract type and notice period;
• Affordability and indebtedness data, including Your existing loan obligations, monthly repayment commitments, deductions already applied to Your salary, and the amount, tenor and purpose of the credit You are requesting;
• Credit reference data obtained from licensed credit bureaux, including Your credit report, credit score and record of any past or current default;
• Repayment data, including Your repayment schedule, amounts repaid, arrears, restructures and any default, in each case in respect of credit obtained through the Loan Marketplace;
• Next-of-kin, guarantor and referee details, where a Loan Partner requires them. Where You provide the Personal Data of another person, You confirm that You have informed them and that You are entitled to provide it to Us;
• Housing and tenancy data, where You apply for a rent financing or housing-related product, including Your current or intended address, landlord or agent details, rent amount, tenancy period and related documents; and
• Device, location and behavioural signals used for fraud prevention and identity assurance in the loan application journey.

In some circumstances we may also collect and process special categories of Personal Data. This is to help ensure that Our Services are accessible and so that we can offer appropriate levels of support where required.

2. How We Use Your Personal Data

We may use Your Personal Data:

• To process employee and cross border payroll;
• To search the records of fraud prevention and investigation agencies;
• To process statutory remittances, including taxes, health and pension remittances;
• To set up and process payments and to prevent fraudulent transactions;
• To provide an all-inclusive full suite human resource solution that streamlines time consuming task for Your employer;
• To streamline the hiring process for Your employer and effectively manage applications through automated workflows and tools;
• To update Our records and maintain Your account with Us;
• To offer You services that may be of interest to You, where You have consented to be contacted for such purposes;
• To process Your application for loans or other third-party services, to which You have consented;
• To monitor, review and improve the content and appearance of Our Website, to ensure it is presented in the most effective manner for You;
• To maintain and develop Our business systems, including without limitation, testing and upgrading them;
• To update Your contact details from public registers or tracing services where correspondence sent to You is returned undelivered, so that We can continue to provide You with notices required in connection with the Services or other third-party services You access through the Website;
• To comply with Our legal and regulatory obligations;
• For any other specific purpose which We notify You of at the time Your Personal Data is collected;
• To pre-populate fields on Our site to make it easier for You to navigate when You return to Our Website and login as an existing customer; and
• To help Us analyse Our business and develop marketing strategies, develop products and improve Our advertising materials.

In connection with the Loan Marketplace, We also use Your Personal Data:

• To operate the Loan Marketplace and display the products for which You may be eligible;
• To carry out a preliminary eligibility and affordability assessment before an application is submitted, so that You are shown products You have a reasonable prospect of obtaining;
• To transmit Your application and the supporting Personal Data to the Loan Partner or Loan Partners You have selected, or to whom You have consented that We route Your application;
• To verify Your employment status, salary and payroll data with Your employer, and to confirm those particulars to a Loan Partner where You have consented;
• To facilitate disbursement of approved funds to Your nominated account;
• To administer repayment, including instructing and reconciling salary deductions through Your employer’s payroll where You and Your employer have agreed to that repayment method;
• To provide a Loan Partner with information relevant to servicing Your facility, including changes to Your employment status, resignation, termination, or a change in salary that affects Your ability to repay;
• To detect and prevent credit fraud, identity fraud and multiple or duplicate applications across Our Loan Partners; and
• To respond to complaints and to reconcile records with a Loan Partner where a dispute arises.

We may monitor and record calls, emails, SMS and other communications to ensure transactions are executed correctly, detecting any vulnerabilities You may have, and for security, quality control, training and fraud prevention purposes.

3. How We Collect Your Personal Data

We collect Personal Data about You in the following ways:

• Directly from You when You fill in forms on Our Website, or correspond with Us by email, phone or otherwise;
• By observing how You access and use Our Services. For example, how You use Our Website or how You manage Your accounts with PaidHR;
• From Your employer, where Your employer uses Our Services to administer payroll and human resources, including salary, employment status and deduction data;
• From organisations that have Your consent to share Your Personal Data with Us or for a separate legal basis for a specific or defined purpose. This could include for direct marketing or assessing Your eligibility for a partner’s Services which may be suitable for You;
• From Our Loan Partners, where they share with Us the status or outcome of an application You have made, and information necessary to administer repayment;
• From licensed credit bureaux and other credit reference agencies, where You have consented to a credit search in connection with an application;
• From public sources, for instance the Corporate Affairs Commission’s register or other public registers; and
• From third party organisations such as affiliates who resell or integrate with Our Services, fraud prevention and investigation agencies. These entities provide information on Your financial behaviour.

4. Lawful Basis for Processing Your Personal Data

We collect and use Your Personal Data where it is necessary for Us to carry out Our lawful business activities. Our grounds for processing Your Personal Data are as follows:

4.1. Contractual necessity

We may process Your Personal Data where it is necessary to enter into a contract with You or to perform Our obligations under that contract. This may include processing to:

• Assess Your eligibility for the Services We provide;
• Sharing information to fraud prevention and investigation agencies;
• Assess Your eligibility for similar Services. This may include making periodic searches at fraud prevention and investigation agencies;
• Provide and administer the Services We offer, including setting up Your account; verifying Your contact information; collecting and providing to You required information and documents including statements and formal notices; processing payments; managing employee and cross border payroll; providing workflows and tools for business/companies; managing statutory remittance, employee benefits and creating employee wallets; sending You service communications and notices required by law; and addressing any enquiries or complaints We receive from You, a representative You have appointed or a regulator; and
• Administer the repayment of credit You have taken through the Loan Marketplace, including applying and reconciling agreed payroll deductions, once a facility has been granted to You.

4.2. Legal obligation

We may process Your Personal Data where it is a legal or statutory obligation on Us. This may include processing to:

• Confirm Your identity;
• Detect, investigate and report transactions in order to comply with laws relating to money laundering, financial crime and international sanctions;
• Detect, investigate and report financial crime, and to take measures to prevent this;
• Maintain records of Our business as required by law;
• Complying with laws which require Us to provide information, directly or indirectly to any state or federal agencies, for the purpose of the calculation and collection of tax;
• Responding to enquiries and requests for information by any of Our regulators;
• Creating and submitting reports required by any of Our regulators;
• To otherwise meet Our obligations under all laws and regulations and codes of practice which apply to Our business activities; and
• Where We have a duty to protect vulnerable customers and provide them with support.

4.3. Legitimate interest

We may process Your information when We have a business or commercial reason to do so. If We do, it must not unfairly go against what is right and best for You. If We rely on Our legitimate interest, We will tell You what that is. This may include processing to:

• Develop new Services and identifying which may be of interest to You;
• Contact You to make You aware of such Services, where We have the relevant permission to do so. This may include a reasonable period after Your relationship has ceased with Us;
• Collect information in order to perform statistical analysis, analytics and profiling, for example, to create scorecards, models and variables in connection with the assessment of credit, fraud, vulnerabilities, risk or to verify identities, to monitor and predict market trends, and for analysis such as loss forecasting (and share this information with other members of Our corporate group of companies);
• Monitor, review and improve the content and appearance of Our Website, to ensure that content from Our Website is presented in the most effective manner for You assess how Our customers use Our Website, and Services;
• Maintain and develop Our business systems, including without limitation, testing and upgrading them;
• Sharing information with organisations who introduce You to Us under a commercial agreement;
• To share Your information with third parties for the purpose of preventing fraud and financial crime, including detecting duplicate or inconsistent loan applications submitted across Our Loan Partners;
• Maintain the integrity and performance of the Loan Marketplace, including monitoring approval, decline and default rates at an aggregated level in order to decide which Loan Partners to retain on the panel; and
• To obtain finance for the Services We provide.

4.4. Consent

We rely on Your consent where You ask Us to share Your Personal Data with a Loan Partner so that You can apply for a product offered through the Loan Marketplace, and where You authorise a credit bureau search in connection with that application. Your consent is given separately from Your acceptance of this Privacy Policy, is specific to the application You are making, and is recorded by Us.

You may withdraw Your consent at any time by contacting Us at hello@paidhr.com or through the Loan Marketplace in the app. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and it does not, by itself, cancel a credit agreement You have already entered into with a Loan Partner or discharge You from repaying it. Once Your Personal Data has been shared with a Loan Partner, that Loan Partner processes it under its own privacy policy and You will need to contact the Loan Partner directly to exercise Your rights in respect of the data it holds.

If You choose not to give consent, or You withdraw it before an application is submitted, You will not be able to apply for credit through the Loan Marketplace. This will not affect Your access to any other part of Our Services, and it will not be communicated to Your employer as a reflection on You.

5. Who Do We Share Your Personal Data with

We may share Your Personal Data with third party companies who provide Services on Our behalf, and/or third-party companies who provide Services to Us. This may require these organisations to access and process Your Personal Data. These may include:

• Government agencies: for compliance with statutory, tax, anti-money laundering, or law enforcement obligations;
• Identity verification service providers: to confirm Your identity and prevent impersonation or fraudulent activity;
• Auditors: for the purpose of financial and compliance audits;
• Fraud investigation and prevention agencies: to detect, prevent, and investigate fraud or misuse of Our Services;
• Communications service providers offering mail, email and SMS text services;
• Customer survey providers in order to receive feedback and improve Our Services;
• IT service providers: to ensure a smooth and seamless user experience on Our Website;
• Data security providers for debugging and product improvement purposes;
• Legal service providers: to obtain legal advice, enforce Our rights, or defend against legal claims;
• Digital and direct marketing service providers: to communicate relevant updates or promotional information where permitted by law and subject to Your consent;
• Third party quality assurance providers, to ensure that the Website is secure, compliant and reliable;
• Your employer, in respect of employment, salary and deduction data necessary to administer payroll, employee benefits and any agreed salary deduction;
• If We or Our assets are potentially to be acquired by a third party, or if We consider restructuring, Personal Data held by Us about Our customers (including borrowers and investors) will be one of the transferred assets and may be shared during the potential transaction or restructuring process or as part of a mergers & acquisition transaction;
• Our Loan Partners, and other service providers like loan providers, with respect to applications You make in regard to a loan or other third-party services through the Website. Section 6 sets out who Our Loan Partners are and what is shared with them;
• Licensed credit bureaux and credit reference agencies, where You have consented to a credit search or where a Loan Partner is required to report Your facility;
• Payment processors; to process payments necessary for Your enjoyment of the Services; and
• Prospective assignees of Your account.

We may also process Your Personal Data using data analytics and artificial intelligence tools provided by external third parties to manage risks, improve Our Service and produce statistical analysis to be shared internally and with other companies within Our corporate group.

6. The Loan Marketplace and Our Loan Partners

This section explains what happens to Your Personal Data when You use Our Loan Marketplace. Please read it before You apply for any product offered there.

6.1. What the Loan Marketplace is

The Loan Marketplace is a feature of Our Website and mobile application through which employees of businesses that use Our Services can discover and apply for credit, salary advance, rent financing and related products. The products are provided, underwritten, priced, approved or declined, funded and serviced by Our Loan Partners. PaidHR is a technology platform and an introducer. We are not a bank, We are not a lender, We do not decide whether Your application is approved, and We do not set the interest rate, fees, tenor or any other term of the credit offered to You.

6.2. Our role and the role of Our Loan Partners

Up to the point at which Your application is transmitted, We act as a Data Controller in respect of the Personal Data We collect from You and from Your employer, and We are responsible for it under the NDPA.

Once Your Personal Data is transmitted to a Loan Partner, that Loan Partner becomes an independent Data Controller of that data. It decides for itself how and why it will process Your Personal Data, in accordance with its own privacy policy, its own regulatory obligations, and its own retention schedule. We do not control, and are not responsible for, a Loan Partner’s processing of Your Personal Data once it has been transmitted. Each Loan Partner is separately accountable to You and to the NDPC for that processing.

We enter into written agreements with each Loan Partner governing the sharing of Personal Data, requiring the Loan Partner to process Your Personal Data only for the purposes for which it was shared, to apply appropriate technical and organisational security measures, and to comply with the NDPA.

6.3. Who Our Loan Partners are

As at the effective date of this Privacy Policy, Our Loan Partners are set out below. Each Loan Partner operates under its own privacy policy, which We encourage You to read before applying. We will update this table when a Loan Partner joins or leaves the panel.

We are not responsible for the content or accuracy of a Loan Partner’s privacy policy, and a Loan Partner may change its policy without notice to Us. Where a Loan Partner leaves Our panel, this does not by itself require that Loan Partner to delete Personal Data it lawfully holds about You, and any credit agreement between You and that Loan Partner continues on its own terms.

6.4. What Personal Data We share with a Loan Partner

We share only the Personal Data that the relevant Loan Partner needs in order to assess and administer the product You have applied for. Depending on the product, this may include:

• Your identity and contact details, including name, date of birth, gender, residential address, phone number and email address;
• Your identification and verification data, including national identity number, bank verification number and a copy of an accepted means of identification;
• Your employment data, including employer name, job title, department, employment start date, employment status and staff or payroll identifier;
• Your income data, including gross and net salary, salary payment history, and deductions already applied to Your salary;
• Your affordability data, including existing obligations You have disclosed and any facility You already hold through the Loan Marketplace;
• Your application data, including the amount, tenor and stated purpose of the credit requested and the repayment method selected;
• Your bank account details for disbursement and repayment;
• Next-of-kin, guarantor or referee details where the Loan Partner requires them;
• For housing and rent financing products, Your tenancy details, including property address, rent amount, tenancy period and landlord or agent details; and
• During the life of a facility, servicing information such as repayment status, arrears, and any change to Your employment status or salary that is material to repayment.

We do not share Your authentication credentials with any Loan Partner. We do not sell Your Personal Data to any Loan Partner or to any other party.

6.5. Your employer’s role

Products offered through the Loan Marketplace are typically made available because Your employer has enabled the Loan Marketplace for its workforce, and many of them are repaid by deduction from Your salary. This means:

• Your employer, as the source of Your payroll data, provides and confirms employment and salary information used in the assessment of Your application;
• Where You select repayment by salary deduction, Your employer must be informed of the deduction amount and schedule in order to apply it, and will therefore know that You have taken a facility;
• Your employer is not told the detail of Your application beyond what is necessary to administer the deduction, and is not given Your credit report or credit score; and
• If Your employment ends or Your salary changes materially, We may inform the relevant Loan Partner so that the facility can be reconciled or restructured.

If You do not wish Your employer to be involved, You should select a repayment method that does not require salary deduction, where one is offered, or apply to a lender outside the Loan Marketplace.

6.6. The lawful basis on which We share with a Loan Partner

We share Your Personal Data with a Loan Partner on the basis of Your consent, as described in Section 4.4, which We collect separately at the point of application, and, once a facility is granted, on the basis of contractual necessity and Our legal obligations in relation to that facility. We will tell You, before You submit an application, which Loan Partner or Loan Partners Your application will be sent to. We will not route Your application to a Loan Partner You have not selected or consented to.

6.7. Credit bureaux and credit reporting

Loan Partners are regulated credit providers. Where You consent to an application, a Loan Partner may search Your credit record with a licensed credit bureau, and where a facility is granted it may report the facility and Your repayment performance to licensed credit bureaux. This is a normal and, for some Loan Partners, a mandatory part of regulated lending in Nigeria. It means that:

• A record of Your application and of any facility granted may appear on Your credit file and be visible to other lenders;
• Missed payments, arrears and defaults may be reported and may affect Your ability to obtain credit in the future; and
• Depending on the product and the Loan Partner, a Global Standing Instruction mandate may be taken, allowing recovery of amounts overdue from Your accounts at other financial institutions in accordance with the applicable Central Bank of Nigeria framework.

The credit search and any reporting is carried out by the Loan Partner as Data Controller, and the Loan Partner’s privacy policy governs it. If You want to know exactly what will be searched or reported, ask the relevant Loan Partner before You apply.

6.8. Automated decisions made by Loan Partners

Loan Partners generally use automated systems to assess creditworthiness and affordability and to decide whether to approve an application, on what terms, and at what price. That decision is made by the Loan Partner, not by PaidHR. We cannot reverse, override or manually review a Loan Partner’s credit decision.

You have the right not to be subject to a decision based solely on automated processing where it produces legal or similarly significant effects, subject to the exceptions set out in Section 12, and You have the right to obtain human intervention, to express Your point of view and to contest such a decision. Because the decision is the Loan Partner’s, that right is exercised against the Loan Partner. We will, on request, tell You which Loan Partner made the decision and how to contact them, and We will pass on Your request to them.

6.9. Marketing by Loan Partners

We do not permit a Loan Partner to use Personal Data shared with it under the Loan Marketplace to market its own unrelated products to You, unless You have separately opted in to receive such marketing. Where You have opted in, You may withdraw that opt-in at any time by contacting the Loan Partner directly, or by contacting Us and We will pass on Your request.

6.10. Retention by Loan Partners

Each Loan Partner sets its own retention period for the Personal Data it holds, including where Your application is declined or You withdraw it. As regulated financial institutions, Loan Partners are typically required to retain customer and transaction records for a minimum period after the end of the relationship. Details are in the relevant Loan Partner’s privacy policy.

6.11. Exercising Your rights and making a complaint about a Loan Partner

Your rights under Section 8 of this Privacy Policy apply to the Personal Data We hold about You. Where Your complaint or request concerns Personal Data held by a Loan Partner — for example, a credit decision, an entry on Your credit file, the terms of Your facility, a collections contact, or a request to delete data the Loan Partner holds — You should contact that Loan Partner directly, using the contact details in its privacy policy.

If You are not sure which Loan Partner holds Your data, or You would like help in making contact, email Us at hello@paidhr.com and We will identify the relevant Loan Partner and provide their contact details. You may also complain to the NDPC at any time, and, in respect of a regulated financial product, to the Consumer Protection Department of the Central Bank of Nigeria.

7. International Transfer of Personal Data

To provide the Services, We or Our service providers may transfer Your Personal Data to countries outside Nigeria, including jurisdictions that have been recognised by the NDPC as providing adequate data protection, as well as countries whose data protection laws may offer a lower level of protection than is available in Nigeria. Any such transfers will only be done where necessary for the performance of a contract between You and PaidHR, or to take steps at Your request prior to entering into such a contract. Additionally, in such cases, We will ensure that appropriate safeguards are in place to protect Your Personal Data in accordance with the NDPA. The specific safeguards We implement will depend on the nature of the transfer and the recipient, and may include the use of standard contractual clauses. Where a Loan Partner transfers Your Personal Data outside Nigeria, it does so as an independent Data Controller and is responsible for putting appropriate safeguards in place. If You would like further information about these safeguards, please contact Us via hello@paidhr.com.

8. Your Data Subject Rights

As a Data Subject, You have a number of rights:

• The right to access the Personal Data We hold about You;
• The right to rectify inaccurate Personal Data or complete it if it is incomplete;
• The right to have Your Personal Data deleted;
• The right to request restriction of Your Personal Data;
• The right to obtain and make use of Your Personal Data for Your own purposes across different Services (“portability”);
• The right to object to the processing of Your Personal Data in certain circumstances;
• The right to object to decisions that are based solely on automated decision-making including profiling;
• The right to withdraw consent at any time; and
• Right to lodge complaints with the NDPC.

Please note that Your data protection rights are subject to certain restrictions and conditions and We may be required to retain a range of Your Personal Data for legal and regulatory reasons. If You think that any of the Personal Data We hold about You is wrong or incomplete You have the right to challenge it. Where the Personal Data in question is held by a Loan Partner rather than by Us, please see Section 6.11.

9. Sensitive Personal Data

We will not typically ask You for any ‘special categories’ of Personal Data. This is also referred to as ‘Sensitive Personal Data’ and includes information revealing an individual’s political opinions, racial or ethnic origin, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data, data concerning health or data concerning an individual’s sex life or sexual orientation. If We process such Sensitive Personal Data, We will do so (a) with Your explicit consent, (b) to comply with Our legal obligations to support You if You are, or become a vulnerable customer, and (c) to establish, take or defend any legal action.

10. How Long We Keep Your Personal Data

We will retain Your Personal Data for as long as We are required to under relevant legislation and regulation, and where no specific rules apply, for no longer than it is necessary for the lawful purposes for which it was originally collected or for related compatible purposes. This will usually be no more than six (6) years from the end of Our relationship with You, unless a longer period is required by tax, anti-money laundering, employment, pension or other applicable legislation. At the end of the applicable retention period Your Personal Data will be securely deleted or irreversibly anonymised, and where We retain Personal Data solely for record purposes We will retain only the minimum necessary and destroy or irreversibly de-identify the remainder. Once deleted, Your Personal Data will no longer be retrievable through a Data Subject Access Request (“DSAR”). The retention period of Your Personal Data may need to be extended where We require this to bring or defend legal claims. We may also retain Personal Data for longer periods for statistical purposes, and if so We will anonymise such Personal Data. Personal Data held by a Loan Partner is retained in accordance with that Loan Partner’s own retention schedule, as described in Section 6.10.

11. How Do We Protect Your Personal Data

We are committed to managing Your Personal Data in line with the NDPA and best practices. We employ all reasonable efforts to keep Your Personal Data secure by taking appropriate technical and organisational measures against any unauthorised or unlawful processing of Personal Data and against its accidental loss, destruction or damage. We protect Your Personal Data using physical, technical, and organisational measures to reduce the risks of loss, misuse, unauthorised access, disclosure and alteration. We also use industry-recommended security protocols to safeguard Your Personal Data. Other security safeguards include, but are not limited to, data encryption, firewalls, and physical access controls to Our buildings and files. Transmissions of Personal Data to Our Loan Partners take place over encrypted channels. We carry out data privacy impact assessments in respect of any processing that is likely to result in a high risk to Your rights and freedoms, in accordance with section 28 of the NDPA, and We review those assessments periodically.

12. Do We Use Automated Processing?

We may use Your Personal Data in automated processes to make decisions about You. You have the right not to be subject to a decision based solely on automated processing, if this will have a legal or other significant effect on You (the exceptions being where the decision is necessary for entering into or performing a contract with You, is authorised by written law, or is based on Your consent). A decision of this kind may result in Your loan application being declined or offered on different terms, Your job application being rejected or de-prioritised, a transaction being blocked, or Your account being suspended.

Where the decision is made by Us, You have the right to obtain human intervention on Our part, to express Your point of view on the decision, and to contest the decision and ask Us to review it. Where the decision is made by a Loan Partner, that right is exercised against the Loan Partner, and Section 6.8 explains how.

We may use automated decision making in:

• Credit scoring and affordability assessment: We may use Personal Data collected from yourself through online forms, Your use of Our Website, credit bureaus and other third parties to assess Your creditworthiness and affordability, on behalf of employers or third-party service providers, whose services You are interested in. The final credit decision on any product offered through the Loan Marketplace is made by the relevant Loan Partner, not by Us, and is addressed in Section 6.8;
• Hiring processes: We may use Personal Data collected from yourself through job posting, forms, job boards, Your use of Our Website or mobile application to make automated hiring decisions like ranking candidates, filtering applicants, and managing approvals, on behalf of employers;
• Fraud and money laundering risk identification: If Our processing reveals Your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with information that You have provided previously, or You appear to have deliberately hidden Your true identity We may decide that You pose a fraud and money laundering risk;
• Sanctions screening: We may use Personal Data collected from You to do a comprehensive sanction check and real time screening for companies and jurisdictions who may use Our cross-border payroll Services; and
• Profiling: We may use Personal Data collected from You to identify whether You are suitable for the Services We offer and to inform You of these. We will use profiling in conjunction with Our partners when developing new prospect marketing campaigns.

If You do not agree with any decisions made as a result of the foregoing, You have the right to appeal the outcome of these automated decisions and ask for them to be reconsidered manually. We may require additional relevant information to be provided by You before human oversight of a specific decision will take place.

13. Access to Your Personal Data via a Data Subject Access Request (DSAR)

You have the right to request access to the Personal Data We hold about You. To make a DSAR, please email hello@paidhr.com with the subject line “DSAR” or write to:

Data Protection Officer.

Pade HCM Technology Limited (PaidHR).

11 Providence Street, Lekki Phase 1, Lagos.

We may need to verify Your identity before processing Your request. We will respond within one (1) month of receipt of Your request and verification of Your identity. Requests are free of charge unless they are manifestly unfounded or excessive, in which case We may charge a reasonable fee or refuse to comply. If You are not satisfied with Our response, You can contact the NDPC. A DSAR made to Us covers only the Personal Data We hold; to obtain the Personal Data held by a Loan Partner You should make a DSAR to that Loan Partner.

14. Cookies

We may use cookie technology on Our Website to collect some of the Personal Data detailed in this policy. Cookies are small text files stored on Your device or internet browser when You visit Us. We use cookies mainly to improve the performance of Our Website and Our Services. The Cookie Policy made available on this Website explains in more detail what types of cookies We use, why We use them and how to identify and disable them. Where cookies are not strictly necessary for the operation of Our Website, We will obtain Your consent through a cookie banner that allows You to accept or reject each category of non-essential cookie before it is placed on Your device.

15. Third-Party Advertising Links or Content

Our Website may contain links to other sites that are not operated by Us, including the websites and applications of Our Loan Partners. We allow third parties, including advertising networks, and other advertising service providers, to collect information about Your online activities through cookies, pixels, local storage, and other technologies. These third parties may use this information to display advertisements on Our Website and elsewhere online tailored to Your interests, preferences, and characteristics. We have no control over, and assume no responsibility for the content, Privacy Policies or practices of any third-party sites or services. Some third parties collect information about users of Our Website to provide interest-based advertising on Our Website and elsewhere, including across browsers and devices. These third parties may use the information they collect on Our Website to make predictions about Your interests in order to provide You with ads (from Us and other companies) across the internet. We strongly advise You to review the Privacy Policy of every site You visit.

16. Children’s Privacy

We do not knowingly collect Personal Data from children under the age of 18. Our Website and Services are not addressed to minors. If You are a parent or guardian and You learn that Your children have provided us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from a child under the age of 18 without verifiable parental consent, We will take steps to remove that information from Our servers.

17. Personal Data Breaches

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

Where We act as a Data Controller. If We become aware of a personal data breach that is likely to result in a risk to Your rights and freedoms, We will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, describing the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures We have taken or propose to take. Where that information is not all available at once, We will provide it in phases without undue further delay.

Where a personal data breach is likely to result in a high risk to Your rights and freedoms, We will communicate it to You immediately, in plain and clear language, together with advice on the steps You can take to mitigate its effects. Where direct communication would involve disproportionate effort or is otherwise not feasible, We will make a public communication through widely used media so that You are likely to be informed.

Where We act as a Data Processor. Where We process Personal Data on behalf of Your employer or another Data Controller, We will notify that Data Controller on becoming aware of a breach affecting their Personal Data, and will assist them in meeting their own obligations under the NDPA.

Where the breach occurs at a Loan Partner. A Loan Partner is an independent Data Controller of the Personal Data transmitted to it and owes its own notification duties to You and to the Commission. Where We become aware of a breach at a Loan Partner affecting Personal Data We transmitted, We will require the Loan Partner to notify the Commission and affected individuals as required by the NDPA, and We will provide You with the Loan Partner’s contact details and such assistance as We reasonably can.

Records. We maintain a register of all personal data breaches, recording the facts relating to each breach, its effects and the remedial action taken, in a form that enables the Commission to verify Our compliance.

18. Complaints

If You have any complaints about Our use of Your Personal Data, please send an email with the details of Your complaint to hello@paidhr.com or use the contact details above. We will investigate and respond to any complaints We receive. You also have the right to lodge a complaint with the NDPC. For further information on Your rights and how to complain to the NDPC, please refer to the NDPC Website at https://ndpc.gov.ng/.

Complaints about a credit product obtained through the Loan Marketplace, including the conduct of a Loan Partner, should be directed to that Loan Partner in the first instance. If You are not satisfied with the Loan Partner’s response You may escalate to the Consumer Protection Department of the Central Bank of Nigeria, and, where the complaint concerns Personal Data, to the NDPC.