Xeerka asturnaanta

This policy explains how Walex Biz Nigeria Limited ("WorkTime", "we", "us"), the company that provides the WorkTime cloud ERP at worktimeng.com and its workspace sub-domains, collects, uses, shares and protects personal data. We follow the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive issued under it, and we apply the same standards to customers outside Nigeria, including the EU and UK General Data Protection Regulation where it applies.

1. Who is responsible for your data

Our own data. For the information we collect to run our business (website visitors, people who contact us, the people who sign up and pay for WorkTime) we are the data controller.

Your company's data. When a business uses WorkTime, it stores its own records in its workspace: for example employees, payroll, customers, suppliers and accounts. For that data the business is the data controller and we are its data processor. We process it only on the business's instructions to provide the service, as set out in our terms of service. If you are an employee or customer of a company that uses WorkTime, please contact that company first about your data; we will help it respond.

2. What we collect

• Account and contact details: company name, workspace address, contact name, e-mail address, phone number, postal address and country, and the sign-in details of users.
• Billing details: the plan and modules you choose, invoices, the currency you pay in, bank transfer references and payment status. Card details are entered on the payment provider's page and are never stored by us.
• Enquiries: what you send through our contact form, e-mail, phone, WhatsApp, live chat or AI assistant, including your name, company, country and team size if you give them.
• Usage and security data: IP address, browser and device type, pages visited, sign-in times, two-factor authentication events and an audit log of sensitive actions inside a workspace.
• Location for attendance: when a company switches on geo-fenced clock-in, the device location of a staff member at the moment they clock in or out, used only to confirm they are at an approved workplace.
• Workspace content: whatever the business chooses to store in WorkTime, which may include employee records, salaries, bank account numbers for payroll, tax and pension identifiers, leave and performance records, and customer and supplier records.

3. Why we use it, and our lawful basis

• To provide the service you or your company signed up for, keep it secure and support you: performance of a contract.
• To bill subscriptions, send invoices and receipts, and keep financial records: performance of a contract and legal obligation.
• To answer enquiries and demo requests: legitimate interests, or steps taken at your request before a contract.
• To protect accounts and prevent fraud and abuse, including sign-in monitoring and audit logs: legitimate interests and legal obligation.
• To improve WorkTime using aggregated, de-identified usage information: legitimate interests.
• To send product news and offers: consent, which you can withdraw at any time using the link in every message.

We do not sell personal data, and we do not use workspace content to build advertising profiles.

4. AI features

WorkTime includes an AI assistant and AI-powered features such as answering questions, drafting text and translating the website. When you use them, the text you submit and the data needed to answer are sent to our AI provider to produce a response. We instruct the provider not to use this data to train its models where that option is available, we send only what the feature needs, and we never send passwords or full card details. AI answers can be wrong; please check important figures before you rely on them.

5. Who we share data with

We share personal data only with service providers that help us run WorkTime, under contracts that require them to protect it and use it only for us:

• Cloud hosting and network providers that run and protect our servers and website (including content delivery and attack protection).
• Payment providers, including Paystack and Flutterwave, to collect subscription payments and, when a company uses payroll payouts, to pay salaries and suppliers.
• E-mail and messaging providers that deliver service e-mails, SMS and WhatsApp messages.
• Our live-chat provider (Tawk.to), only when you choose to chat with a person.
• Our AI provider, for the AI features described above.
• Integrations a company chooses to connect, such as Mono, QuickBooks, Xero or Zoom, which receive data under that company's instructions.

We may also disclose data when the law requires it, to protect the rights and safety of our customers, users or the public, or as part of a merger or sale of our business, in which case the buyer must honour this policy.

6. International transfers

Some of our providers process data outside Nigeria. When personal data leaves Nigeria we make sure it is protected as the NDPA requires, for example by transferring it only to countries with adequate protection, or under contractual safeguards that bind the recipient to protect it.

7. How long we keep data

• Workspace content is kept while the subscription is active. After a subscription ends we keep it for 90 days so the company can return or export it, then we delete it from live systems; backup copies are overwritten within a further 30 days.
• Billing and tax records are kept for six years, as Nigerian law requires.
• Enquiries and chat transcripts are kept for up to two years after our last contact with you.
• Security logs are kept for up to one year unless needed to investigate an incident.

8. How we protect it

Each company's records are kept in a separate database. All connections are encrypted with HTTPS. Users can sign in with two-factor authentication, access inside a workspace is controlled by roles and approval limits, and sensitive actions are recorded in an audit log. Our own staff access a workspace only to provide support, with the company's permission, on a time-limited basis that is logged. If a personal data breach occurs we will notify affected companies and, where required, the Nigeria Data Protection Commission within 72 hours of becoming aware of it.

9. Your rights

You have the right to be informed about how your data is used, to access it, to have it corrected, to have it deleted, to restrict or object to its use, to receive it in a portable format, to withdraw consent at any time, and not to be subject to decisions based solely on automated processing that significantly affect you. To use these rights, e-mail [email protected]. We reply within 30 days. For workspace content, we will pass your request to the company that controls it. You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or to the data protection authority in your country.

10. Children

WorkTime is a business service and is not meant for children. We do not knowingly collect data from anyone under 18 except where an employer records data about young employees or interns as the law allows.

11. Cookies

We use cookies to keep you signed in, remember your language and currency, and keep the service secure, and optional cookies only with your consent. See our cookie policy.

12. Changes

We will post any change to this policy on this page with a new effective date, and tell account owners by e-mail or in the app before significant changes take effect.

13. Contact

Walex Biz Nigeria Limited, Abuja, Nigeria. Data protection enquiries: [email protected], +234 707 710 1826.