Data Protection Policies
Effective Date: July 6, 2026 | Version: 1.0 (Stable) | DPO Contact: Ola Phillips (support@keepsafe.ng)
This document outlines the data protection and privacy policies governing the Keepsafe Employee Onboarding & Performance Rating Service. Keepsafe is committed to processing all employee and user data in strict compliance with the Nigeria Data Protection Act 2023 (NDPA).
Policy 1: Employee Privacy Notice
This notice applies to all users of the Keepsafe Application. It covers two main streams of data processing:
- Identity verification data: One regulatory identity document (NIN Slip, Passport, or Driver’s License) and biometric selfie scans.
- Performance monitoring data: Performance reviews, ratings, KPIs, peer feedback, and project metrics.
Lawful Basis (NDPA 2023)
| Activity | Lawful Basis |
|---|---|
| Identity Verification | Legal Obligation (Labour Act, tax laws) |
| Performance Monitoring | Legitimate Interest (workforce management) |
What Data We Collect & Why
| Data Category | Examples | Purpose | Storage |
|---|---|---|---|
| Identity Documents | NIN Slip, Passport, or Driver's License, Selfie / Liveness check | Right-to-work checks & verification | Encrypted DB folders, access restricted to HR / authorized managers |
| Performance Data | KPIs, manager ratings, peer feedback, assessments | Performance reviews, ratings, promotions | Secure HRIS database system with role-based access |
Your Rights
Under the NDPA, you have the right to access, correct, delete, restrict processing of, object to the processing of, and request portability of your data. Detailed request instructions are provided in Policy 4 below.
Policy 2: Performance Rating Data Policy
Data collected specifically for the performance rating service includes project metrics (completion rate, quality scores), peer feedback, self-assessments, and final performance scores.
Lawful Basis: Employment Contract (explicitly allowing performance reviews) and Legitimate Interest (to improve productivity and fairness).
How Ratings Are Calculated & Limits on Automated Decision-Making
Ratings are 70% manager assessment + 30% project metrics. Peer feedback is used strictly for qualitative developmental comments, not for automated scoring.
No Automated Termination: Keepsafe enforces a strict limit on automated decision-making. No decision that significantly affects an employee (such as termination or demotion) may be made automatically; a human manager must review and approve every final rating and action.
Policy 3: Data Retention & Erasure Policy
| Data Category | Retention Period | Lawful Basis |
|---|---|---|
| Identity Documents (Right-to-work) | 3 years after employment ends | Labour Act |
| General Personnel File | 3 years after employment ends | Tax / Pension Laws |
| Performance Ratings (Active) | Current + 1 prior cycle | Legitimate Interest |
| Performance Ratings (After Exit) | 2 years after exit | Contractual Necessity |
| System Logs containing personal data | 6 months | Operational Need |
Secure Disposal Methods
- Physical documents (paper ID scans): Cross-cut shredder.
- Digital files (HDD/SSD): Secure deletion software (e.g., shred on Linux, Eraser on Windows).
- Cloud/SaaS data: Secure API vendor certification of permanent deletion.
Policy 4: Data Subject Request (DSR) Procedure
Employees can exercise their rights (Access, Rectification, Erasure, Restriction, Portability, and Objection) under the NDPA by submitting a request to our DPO:
Step-by-Step Process:
- Submission: Email Ola Phillips (DPO) at support@keepsafe.ng using your registered email.
- Identity Check: The DPO will verify your identity (via registered employer data or a secure liveness match).
- Review: The DPO reviews the request to check for legal requirements (e.g., if tax laws require keeping your details, erasure might be restricted).
- Response: We will process and fulfill your request within 30 days of submission, at no cost to you.
Policy 5: Third-Party & Processor Management Policy
Before engaging any third-party processor (such as ID verification platforms), Keepsafe performs strict due diligence. We sign a Data Processing Agreement (DPA) containing NDPA-compliant clauses and ensure that biometric and personal records are not transferred outside Nigeria without adequate security guarantees.
Primary Identity Processor: Keepsafe integrates with Dojah Inc. (Dojah SDK) to perform biometric matching, liveness checks, and registry lookups securely. All data transmitted to Dojah is encrypted end-to-end and is used solely for the verification request initiated by the employer.
Policy 6: Breach Response Protocol
In the event of a security incident, Keepsafe adheres to a strict detection and containment timeline to minimize data exposure.
| Phase | Action | Owner / Timeline |
|---|---|---|
| Detection | Incident detected by employee or system alert | Anyone / Immediate |
| Escalation | DPO is officially notified with logs | Discoverer / Within 1 hour |
| Containment | Revoke permissions, isolate servers, preserve database logs | IT Team / Within 4 hours |
| Assessment | Review scope, affected records, and risk level | DPO / Within 12 hours |
| Notification | File breach report to the NDPC Portal | DPO / Within 72 hours |
| Communication | Notify affected employees if risk is high (e.g. ID scans leaked) | DPO + HR / Within 72 hours |