Privacy Policy

Numatryx Technologies (“Numatryx”, “we”, “us”) builds Numatryx Business Suite, software that organisations in Nigeria and Ghana use to manage HR and, over time, finance and operations. Our office is at 15a Emma Abimbola Cole, Lekki Phase 1, Lagos State, Nigeria.

We play two different roles, depending on whose data it is:

• Data controller for the information about the people who sign up, sign in and contact us, and for our website and marketing. We decide how that information is used.
• Data processor for the employee and candidate information our customers put into Business Suite. The customer (usually your employer) is the controller and decides why that information is collected. We process it only on their instructions and under our agreement with them.

If you are an employee and have questions about the records your employer keeps about you, please contact your employer first. We will help them answer you.

Information you give us

• Account details: your name, work email, phone number, job title and password (stored only in a form we can’t read back).
• Organisation details: company name, country, address, registration details, logo and setup choices.
• Messages: what you send us by email, through the contact options or in support conversations.

Information our customers put into Business Suite

• Employee records entered by HR, such as contact details, job and department, salary information, bank details, identity numbers (for example NIN or Ghana Card), pension and tax details, next of kin and guarantors.
• Offers and onboarding: offer letters, signatures, documents and photos that new hires upload in the staff app, and background check details where the employee has agreed to one.
• Attendance: clock-in and clock-out times, and, if the employer uses work locations, the device’s location at the moment of clocking in or out. We do not track location in the background.
• Face check data: if the employer turns on face check-in, a face template used to confirm it’s really the employee clocking in. See “Face check-in (biometric data)” below.

Information collected automatically

• Device and usage data: IP address, browser and device type, pages and features used, and error logs, so we can keep the service secure and working.
• Cookies: a small number of essential cookies. See Cookies.

We only use personal data where the law allows it. In practice that means:

• To provide the service (create accounts, sign you in, store and show records, send offers and documents for signing): because it is needed to perform our contract with you or your organisation.
• To keep the service secure (prevent fraud and misuse, investigate problems, keep logs): our legitimate interest in running a safe service.
• To improve the product using usage information, in aggregated or de-identified form where we can: our legitimate interest.
• To send service messages such as verification links, invitations and important changes: needed to perform the contract.
• To send product news: only with your consent or where the law otherwise allows, and you can unsubscribe at any time.
• To meet legal obligations, such as keeping business records or answering lawful requests from authorities.

For employee information, our customer is responsible for having a lawful basis (for example, the employment contract, a legal obligation or consent) and for telling their employees how their data is used.

Face data is sensitive personal data under the Nigeria Data Protection Act 2023 and Ghana’s Data Protection Act 2012, so we treat it with extra care.

• Face check-in is off by default. An employer has to turn it on for their organisation.
• Each employee must give their explicit consent in the staff app before their face is enrolled. Without that consent, face check-in is not used for them.
• We use face data only to confirm that the person clocking in is the enrolled employee. We do not use it for any other purpose, and we never sell it or use it for advertising.
• We keep a face template (a set of numbers that describes the face), not a gallery of photos, and only for as long as face check-in is in use for that employee.
• The template is deleted when the employee withdraws consent, when they leave the organisation, when the employer turns face check-in off, or when the account is closed.

Employees who don’t want to use face check-in should ask their employer for another way to clock in.

We do not sell personal data. We share it only with service providers who help us run Business Suite, under contracts that require them to protect it and use it only for us:

• Cloud hosting and storage providers.
• Email delivery providers, for verification links, invitations and notifications.
• Payment providers, once paid plans are introduced.

Inside a customer’s organisation, the information you see depends on the access your administrator gives you. We may also share information where the law requires it, to protect people’s safety or our legal rights, or as part of a merger or sale of our business (in which case this policy will continue to apply).

Some of our service providers may store or process data outside Nigeria or Ghana. When that happens, we make sure the transfer is allowed by law, for example because the destination offers adequate protection or because we have put appropriate safeguards in place, such as contractual commitments to protect the data.

• Account and organisation information is kept for as long as the account is open.
• Employee records are kept for as long as our customer keeps them in Business Suite. Customers can delete records or export them.
• Face templates are kept only as described in “Face check-in (biometric data)”.
• Security and usage logs are kept for a limited period, then deleted or anonymised.

When an account is closed, we delete or anonymise its data within a reasonable period, unless the law requires us to keep some of it for longer (for example, tax and accounting records).

We use technical and organisational measures that match how sensitive the data is, including:

• Encryption of data in transit, and secure storage of passwords.
• Access limited to the people who need it, inside Numatryx and inside each customer’s organisation.
• Sign-in sessions held in secure, HTTP-only cookies.
• Monitoring and logging to detect misuse.

No system is perfectly secure. If a breach affects personal data, we will tell affected customers without undue delay and notify the regulator where the law requires.

Under the Nigeria Data Protection Act 2023 and Ghana’s Data Protection Act 2012, you have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or incomplete.
• Delete data we no longer have a reason to keep.
• Object to or restrict some uses of your data, including direct marketing.
• Portability: receive your data in a common, machine-readable format.
• Withdraw consent at any time, where we rely on consent. This doesn’t affect anything done before you withdrew it.
• Complain to the Nigeria Data Protection Commission (NDPC) or, in Ghana, the Data Protection Commission.

To use these rights, email hello@numatryx.ng. We may need to confirm your identity first. If the data is held for your employer, we will pass your request to them and help them respond.

Business Suite is a tool for organisations and is not meant for children. We do not knowingly create accounts for anyone under 18. If a customer needs to keep records about a younger employee or trainee, the customer is responsible for getting any consent the law requires.

Cookies are small files a website stores in your browser. We keep their use to a minimum and do not use advertising cookies.

• Essential cookies: a secure session cookie that keeps you signed in and protects your account. Business Suite can’t work without it, so it doesn’t need your consent.
• Preferences: your browser may store small settings, such as choices you made on a screen, so you don’t have to make them again.

If we ever add analytics or other non-essential cookies, we will update this section first and ask for your consent where the law requires.

You can view, block or delete cookies in your browser’s settings. If you block essential cookies, you won’t be able to sign in.

We may update this policy as Business Suite grows. We’ll change the “Last updated” date above and, for important changes, tell account administrators by email or in the product before the change takes effect.

For privacy questions or requests, email hello@numatryx.ng or write to us at: