1. Introduction

PayNestHR is a cloud-based Human Resource and Payroll Management platform operated by Kojak Ventures (RC: [optional]). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, or related services. It applies to employees, HR administrators, and any individual whose data is processed via PayNestHR.

If you have any questions after reading this policy, please reach out using the details in Section 12.

2. Information We Collect

To deliver accurate payroll and HR services, we process the following categories of personal data:

• Identity & contact data: Full name, email address, phone number, employee ID, residential address, and government-issued identification where required.
• Employment & financial data: Salary details, bank account information, payment history, bonuses, reimbursements, and tax-related identifiers (e.g., TIN).
• Statutory deductions: PAYE (Pay-As-You-Earn), NHF (National Housing Fund), NHIS (National Health Insurance Scheme), Pension contributions (RSA details), and other mandatory deductions.
• Technical & usage data: IP address, browser type, login timestamps, device identifiers, and interaction logs to maintain security and improve performance.
• HR records: Leave balances, employment contracts, job titles, department, and performance records (if enabled by employer).

3. How We Use Your Information

We rely on your information strictly for legitimate business and compliance purposes:

• Payroll execution: Calculating salaries, deductions, statutory remittances, and generating payslips.
• Employee management: Onboarding, attendance tracking, leave administration, and personnel analytics.
• Reporting & analytics: Generating insights for employers (e.g., payroll summaries, tax obligations).
• Security & support: Detecting fraudulent activity, troubleshooting, and providing customer assistance.
• Legal compliance: Fulfilling tax filing, pension remittance, and responding to lawful requests from regulators.

4. Legal Basis for Processing (GDPR & NDPR)

We process your data only when we have a valid legal basis:

• Contractual necessity: To perform our obligations under the service agreement with your employer (the Data Controller).
• Legal obligations: Compliance with Nigerian tax laws, pension reform acts, and labor regulations.
• Legitimate interests: To ensure secure operations, prevent fraud, and improve platform functionality (where no overriding privacy risk exists).
• Consent: For optional features (e.g., marketing communications) where explicit consent is obtained.

5. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. However, we may share data with limited categories of recipients:

• Financial institutions: Banks and payment processors to facilitate salary disbursements.
• Government agencies: Federal Inland Revenue Service (FIRS), Pension Commission (PenCom), NHIS, and state revenue authorities for statutory filings.
• Cloud & infrastructure providers: Secure hosting partners (e.g., data centers, database hosting) that operate under strict confidentiality agreements.
• Professional advisors: Auditors, legal counsel, and consultants bound by confidentiality.

All third parties are contractually obligated to respect data security and only process information for specified purposes.

6. Data Security

We implement robust security measures to protect your information:

• Encryption: All data transmitted via TLS 1.3; sensitive fields (bank details, tax IDs) encrypted at rest using AES-256.
• Access control: Role-based permissions, multi-factor authentication for administrators, and regular access reviews.
• Monitoring: 24/7 intrusion detection, audit logging, and vulnerability scanning.
• Employee training: Regular privacy and security awareness programs for our staff.

While we strive for absolute security, no system is 100% impenetrable. We encourage you to protect your login credentials.

7. Data Retention

We retain personal data only as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law (e.g., tax records — typically 7 years under Nigerian regulations). After the retention period, data is securely anonymized or deleted. If you are an employee of a client organization, your data will be removed within 90 days after termination of the contract, unless legal obligations mandate otherwise.

8. Your Privacy Rights

Depending on your location (e.g., Nigeria, EU, UK), you may have the following rights regarding your personal data:

• Right to access: Obtain confirmation whether your data is being processed and request a copy.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): Request deletion where no legal obligation to retain exists.
• Right to restrict processing: Limit how we use your data under specific circumstances.
• Right to data portability: Receive a structured, machine-readable copy of your data.
• Right to withdraw consent: Where consent is the legal basis, you may withdraw at any time.

To exercise any of these rights, contact your employer (Data Controller) first, or reach out to us directly at support@kojak-ventures.com.ng. We will respond within 30 days.

9. Cookies & Similar Technologies

PayNestHR uses essential and functional cookies to maintain user sessions, remember preferences, and improve platform reliability. We do not use non-essential advertising cookies. You can configure your browser to refuse cookies, but some features may become unavailable. Third-party service providers (such as analytics) may use their own cookies subject to their policies.

10. Third-Party Services & Links

Our platform may include integrations with third-party tools (e.g., payment gateways, identity verification services). Those services have separate privacy policies, and we encourage you to review them. We are not responsible for the content or privacy practices of external sites linked from PayNestHR.

11. Updates to This Privacy Policy

We may revise this Privacy Policy from time to time to reflect changes in legal requirements, our services, or industry best practices. The “Effective Date” at the top of this page indicates when the latest version was published. We will notify users of material changes via email or prominent notice within the platform. Continued use after updates constitutes acceptance of the revised policy.

12. Contact Information & Data Protection Officer

13. Data Roles & NDPR Compliance (Nigeria)

Under the Nigeria Data Protection Regulation (NDPR) and applicable frameworks, your employer (organization) acts as the Data Controller — they determine the purposes and means of processing your HR and payroll data. PayNestHR (Kojak Ventures) operates as a Data Processor, processing data solely on documented instructions from the Controller. We have implemented appropriate technical and organizational measures to ensure compliance with NDPR and assist Controllers with their obligations regarding data subject rights, breach notification, and impact assessments.

If you are unsure about who your Data Controller is, please contact your HR department.

Complaints & Supervisory Authority

If you believe your privacy rights have been violated, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at https://ndpc.gov.ng. We encourage you to first contact us so we can resolve your concerns directly.