Privacy Policy

The NDPA requires data controllers of major importance to register with the NDPC and designate a Data Protection Officer. We are currently assessing whether we meet that designation; this section will be updated with our registration details and DPO contact once that assessment is complete. Until then, all data protection enquiries are handled by our privacy contact at the address above.

2.1 Account Registration

• Full name, email address, password (stored as bcrypt hash — never in plaintext)
• Phone number (optional)
• Job role and employer sector
• Nationality / work permit status (optional — you may select "prefer not to say")
• Trade union membership and union name (optional)
• Consent timestamp and policy version

2.2 Incident Reports

• Workplace name, specific location, date and time of incident
• Free-text description of what happened
• Name and role of any person involved (employer, manager, colleague, customer)
• Witness names and contact information (if provided)
• Injury details, medical attention sought, days off work
• Retaliation events, timeline, and description
• Police or NAPTIP involvement and any case reference number
• Details of document confiscation (NIN, passport, ID card) or coercion by an employer

2.3 Evidence Files

• File contents (photos, PDFs, documents) stored in encrypted object storage
• File metadata: name, type, size, SHA-256 hash, upload timestamp
• EXIF metadata extracted automatically: GPS coordinates, device make/model, original capture timestamp — you are notified of this at upload
• Masked IP address and browser user-agent at upload time

2.4 Legal Claims

• Case type, status, notes, and linked incident report
• Legal representative contact details (name, firm, email, phone)
• Retaliation event log
• Legal deadlines (National Industrial Court filing dates, limitation dates)

2.5 Technical & Usage Data

• Masked IP address — the last octet of your IPv4 address (or last 4 groups of IPv6) are zeroed before storage. We never store your full IP.
• Browser user-agent string (for device compatibility diagnostics)
• Audit log entries: action type, resource accessed, timestamp (no report content)
• Session authentication cookies (HTTP-only, Secure, SameSite=Lax)

2.6 Anonymous Submissions

If you use our anonymous submission option, no account or email is required. We store: incident type, workplace sector, state (Nigerian state, not precise location), retaliation flag, injury flag, and work-permit flag. We also generate a UUID token you can use to claim the report later.

Section 25 of the NDPA requires a lawful basis for every processing activity, and section 30 imposes additional conditions for sensitive personal data. The table below sets out our basis for each activity.

• Providing the service — storing and displaying your reports, evidence, and legal cases
• Authentication — verifying your identity on each request
• Communications — confirmation emails, legal deadline reminders, organisation invites
• AI incident classification — automatically categorising your report to assist you in understanding its urgency and type. This runs entirely on our platform; no data is sent to external AI APIs without your knowledge.
• Evidence integrity — computing SHA-256 hashes and optional blockchain timestamps to create tamper-evident records for legal proceedings
• Security and fraud prevention — rate limiting, audit logging, and abuse detection
• Platform stability — error monitoring via Sentry (body stripped; see §10)
• Legal compliance — responding to lawful requests from courts or regulators

We share your data only with the sub-processors listed below, each subject to a written data processing agreement as the NDPA requires for engagements between controllers and processors.

Payment processing (Stripe) is not currently active on the Nigerian service — no paid plans are offered in Nigeria at this time.

Sharing with Lawyers, Unions & Organisations

If you request help from a lawyer or NGO through our directory, or link your account to a union or organisation, you may choose to share specific incident reports or legal cases with them. This sharing is always worker-initiated and explicit — we never share your data with an organisation without your action. You can revoke any share at any time from your reports page.

Legal Disclosure

We may disclose data if required by a court order, statutory authority (such as the NDPC, the Police, or NAPTIP acting under lawful powers), or applicable law. Where permitted by law, we will notify you before disclosing.

The NDPA permits transfers of personal data outside Nigeria where the recipient is subject to a law, contract, or binding scheme that provides an adequate level of protection. All our sub-processors are bound by written data processing agreements incorporating standard contractual protections (including GDPR-grade Standard Contractual Clauses), which we rely on as the safeguard for these transfers. Copies of the relevant clauses are available on request.

We keep data only as long as necessary for the purpose it was collected, or as required by law. The table below sets out our retention periods.

Hard-deletion after account closure

When you request account deletion, your profile is immediately pseudonymised (name replaced with "Deleted User"; contact fields nulled; work-permit/union data cleared). All incident report PII fields (descriptions, names, locations, medical details) are anonymised within the same request. Witness records are hard-deleted immediately. The remaining structural data is permanently deleted within 30 days.

Despite these measures, no system is completely secure. If you discover a security vulnerability, please report it responsibly to support@safeguardworkers.com.ng.

We use no advertising cookies, no cross-site tracking, and no fingerprinting. The Sentry session replay feature is disabled by default and only enabled with your explicit consent. Text and media are masked even when replay is enabled.

You have the following rights. Most can be exercised directly in your Account Settings. We will respond within 30 days.

To exercise rights not available in Account Settings (correction, portability, complex erasure), email support@safeguardworkers.com.ng with "Privacy Rights Request" in the subject line. We may ask you to verify your identity.

Our Nigerian service is intended for workers aged 18 and over. The NDPA requires verifiable parental or guardian consent before processing the personal data of a child (under 18), and we do not have a mechanism to obtain it. If you believe we have collected data from anyone under 18, please contact us immediately at support@safeguardworkers.com.ng and we will delete the data without delay.

We will update this policy when our processing activities change. For material changes (new sensitive-data processing, new sub-processors, changes to retention) we will notify registered users by email and require re-consent where the lawful basis is consent. Minor clarifications will be noted in the version history.

The current version is 1.0-NG (draft), effective 16 July 2026. Older versions are available on request.

Right to complain to the NDPC

If you are not satisfied with how we handle your personal data or respond to your rights request, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the supervisory authority under the NDPA: