Privacy Policy
Effective date: [23-07-2026] · Last updated: [23-07-2026]
1. Who we are
VettamHR is a workforce records platform operated by SPAL SOLUTIONS ("we", "us", "our"), a company registered in Nigeria with registration number RC-9589939, with its registered office at 3RD FLOOR, OKOI ARIKPO HOUSE, 5, IDOWU TAYLOR STREET, LAGOS, NIGERIA. For the purposes of the Nigeria Data Protection Act 2023 ("NDPA"), SPAL SOLUTIONS is the data controller for personal data processed on the VettamHR platform.
Contact for privacy matters: info@vettamhr.com | 3RD FLOOR, OKOI ARIKPO HOUSE, 5, IDOWU TAYLOR STREET, LAGOS, NIGERIA
2. Who this policy covers
- Business users: owners, managers, and staff of businesses that subscribe to VettamHR.
- Workers: individuals whose employment records are created and maintained on VettamHR by a subscribing business, with the worker's consent.
- Visitors: people who browse vettamhr.com.
3. What personal data we collect
From business users: business name, CAC registration number, contact name, email address, phone number; bank account details for payment purposes; login credentials (passwords are stored hashed, never in plain text); subscription and billing records (payments are processed by Paystack; we do not store full card details).
About workers (entered by the subscribing business, with the worker's consent confirmed by email): full name, phone number, email address; National Identification Number (NIN), encrypted at rest using AES-256-GCM and searchable only via one-way hash; employment records (employer, role, department, salary, start and end dates); performance reviews and ratings; dispute records and related messages; payment records relating to the worker.
We do not collect Bank Verification Numbers (BVN).
Important: NIN details are checked and entered by the subscribing business at onboarding. VettamHR uses the NIN and phone number to match a worker's records across employers.
From visitors: we use Google Firebase Analytics on vettamhr.com, which collects usage data (pages visited, approximate location, device and browser information) and may set cookies or similar identifiers.
4. How we obtain worker consent
Before a worker's record is created, VettamHR sends a confirmation to the worker's email address. The record is only activated if the worker confirms. A worker who does not consent is not added. Workers may later access their record through the VettamHR staff app and may withdraw consent as described in Section 9.
5. Why we process personal data (purposes and lawful bases under the NDPA)
| Purpose | Lawful basis |
|---|---|
| Creating and maintaining worker employment records | Worker's consent (email confirmation) |
| Providing the platform to subscribing businesses | Performance of a contract |
| Processing subscription payments (via Paystack) | Performance of a contract |
| Matching a worker's records across employers via NIN and phone number | Worker's consent |
| Performance reviews and dispute mediation | Consent and legitimate interests in fair record-keeping |
| Security, fraud prevention, audit logging | Legitimate interests / legal obligation |
| Complying with Nigerian law and lawful requests | Legal obligation |
We do not sell personal data. We do not use worker data for advertising.
6. Who we share data with
- Subscribing businesses: a business sees the records of workers it is/has onboarded.
- Workers: each worker can see their own profile, employment history, reviews, and disputes via the staff app.
- Service providers (data processors): Amazon Web Services (AWS): cloud hosting, database, and authentication infrastructure, hosted in the AWS Europe (Stockholm) region (eu-north-1); Mailgun: transactional email delivery, including consent emails; Google Firebase Analytics: website usage analytics; Paystack: payment processing.
- Authorities: where required by Nigerian law or a valid legal process.
We do not permit processors to use personal data for their own purposes.
7. International transfers
Personal data is stored on AWS infrastructure located in Europe, and our email/SMS providers may process data outside Nigeria. Where personal data is transferred outside Nigeria, we do so in accordance with Part VIII of the Nigeria Data Protection Act (NDPA) 2023, relying on appropriate contractual safeguards through the execution of Data Processing Agreements (DPAs) incorporating Standard Contractual Clauses (SCCs), or where applicable, the Adequacy Decisions recognized by the Nigeria Data Protection Commission (NDPC) regarding jurisdictions providing an equivalent level of data protection.
8. How we protect data
- NIN encrypted at rest (AES-256-GCM); lookup via one-way hashes
- All traffic encrypted in transit (HTTPS/TLS)
- Password hashing, authenticated sessions
- Access controls limiting each business to its own records
- Complete audit logs of administrative actions
No system is perfectly secure. If a breach occurs that is likely to result in a risk to individuals, we will notify the Nigeria Data Protection Commission ("NDPC") and affected individuals in accordance with the NDPA.
9. Your rights under the NDPA
Whether you are a business user or a worker, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data (workers can also raise disputes in-app to challenge records or reviews)
- Delete your data: we will delete or irreversibly anonymise your personal identifiers; some records must be retained (in anonymised form, or where law requires) for the periods in Section 10
- Withdraw consent at any time (this stops future processing based on consent; it does not make past processing unlawful)
- Object to or restrict certain processing
- Data portability: receive your data in a structured, commonly used format
- Complain to the Nigeria Data Protection Commission (ndpc.gov.ng) if you believe your rights have been infringed
To exercise any right, contact info@vettamhr.com. We respond within the timelines required by the NDPA. Workers may also make requests through the staff app.
10. Retention
- Employment and payment records: Employment, payroll, and statutory tax payment records shall be retained for a minimum period of 10 years from the end of the relevant financial year. This policy exceeds the standard 6 year statutory minimum required under the Companies and Allied Matters Act (CAMA) and federal/state tax administration laws to ensure operational readiness for extended tax audits, defense against late-stage contractual or labor disputes, and robust corporate record-keeping.
- Deletion requests: Where a worker exercises their deletion right, we delete or irreversibly anonymise their personal identifiers (name, phone number, email, NIN) within 30 days. Deletion is completed after this 30-day processing window; a misconduct record properly filed and notified during the window pauses deletion for the affected records until the matter is resolved. Employment and payment entries are retained in anonymised form for the 10-year retention period above.To prevent contract and payroll disruption, VettamHR will notify a worker’s current employer that a deletion request is pending. Workers will be explicitly informed of this employer notification at the point of request before the deletion process is accepted.
- Misconduct hold (exception): Where a record contains a documented misconduct finding (one the worker was notified of and had the opportunity to challenge through VettamHR's dispute process), that record may be retained in identifiable form for fraud prevention and the establishment or defence of legal claims, until the matter or the applicable statutory limitation period (up to 6 years) concludes.When a hold is applied, VettamHR will issue a mandatory restriction notice to the worker outlining the legal basis, specific records held, and their right to escalate the matter. Deletion requests for unaffected records are honoured normally.
- Business account data: retained for the life of the subscription plus 6 years for legal and accounting purposes
- Audit logs: 10 years
- Payment records: as required by Nigerian financial regulations
11. Children
VettamHR is for people of working age. We do not knowingly process data of anyone under 16.
12. Changes to this policy
We will post changes on this page and update the date above. For material changes affecting workers, we will notify via email or the staff app.
13. Contact
SPAL SOLUTIONS (RC-9589939)
3RD FLOOR, OKOI ARIKPO HOUSE, 5, IDOWU TAYLOR STREET, LAGOS, NIGERIA
info@vettamhr.com