Privacy Policy

1. Introduction and Scope

OpportuNation is a multi-tenant Enterprise Resource Planning ("ERP") platform that provides integrated human resources, finance, payroll, procurement, and talent marketplace services to organisations operating in Africa. This Privacy Policy explains how OpportuNation Limited (RC Number: 8406042) collects, processes, stores, retains, discloses, and protects Personal Data obtained through or in connection with the Platform.

This Policy applies to Employer Organisations that subscribe to OpportuNation, Employees whose data is processed through the Platform, and Vendors registered on the OpportuNation marketplace.

This Policy is issued in compliance with the Nigeria Data Protection Act 2023 ("NDPA"), the Nigeria Data Protection Commission's regulatory instruments, and all other applicable data protection laws in force in the Federal Republic of Nigeria.

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree with this Policy, you must discontinue use of the Platform.

2. Categories of Personal Data Collected

Depending on your relationship with the Platform, we collect:

• Employer Organisation data: business name, CAC registration number, TIN, the legal representative's contact details, billing information (processed by Paystack), and configuration/usage data.
• Employee Work Profile data (employer-managed): legal name, work email, employee ID, job details, bank account for salary (encrypted at rest), tax/pension/NHF identifiers, leave and payslip history, and performance and disciplinary records where configured.
• Employee Personal Profile data (employee-owned, optional): personal email, public profile, career history, course and skill records, job applications, mentorship activity, and rewards.
• Vendor data: business name and CAC certificate, contact details, category and location, TIN, bank account (encrypted), portfolio, and transaction history.

3. Purposes and Legal Basis for Processing

We process Personal Data to provision and operate workspaces, run payroll and statutory remittances (PAYE, PENCOM, NHF), administer HR, process billing, facilitate procurement, provide marketplace features, and maintain audit trails.

Under the NDPA, our lawful bases are: performance of a contract (subscription and employment relationships), compliance with a legal obligation (tax, pension, and housing-fund requirements), consent (the optional Personal Profile), and legitimate interest (platform improvement and security). Where processing is based on consent, you may withdraw it at any time, subject to this Policy and applicable law.

4. Data Separation and Isolation

OpportuNation maintains strict logical and technical separation between the Work Profile and the Personal Profile, enforced at the database, API, and application layers:

• An Employer Organisation cannot access, view, or infer an Employee's Personal Profile data (personal email, career history, job applications, courses, mentorship, networking, or rewards).
• The Personal Profile cannot access an Employer Organisation's proprietary data or other employees' data.
• Vendor data is isolated so one Vendor cannot access another Vendor's data, and Employer Organisations only see Vendor data specific to their own transactions.

5. Your Rights as a Data Subject

In accordance with the NDPA you have the rights of access, rectification, erasure, restriction of processing, data portability, objection, and the right not to be subject to solely automated decision-making.

To exercise any of these rights, email privacy@opportunation.io with your full name, the organisation you are associated with (where applicable), and the right you wish to exercise. We verify identity before processing any request and respond within thirty (30) days.

6. Data Security

Data in transit is encrypted using TLS 1.2 or higher. Sensitive Personal Data (bank details, tax identifiers, pension PINs, and passwords) is encrypted at rest using AES-256. We apply role-based access control, offer multi-factor authentication (mandatory for administrative accounts), keep immutable audit logs for at least seven years, and conduct independent security audits and penetration testing.

All Personal Data is stored within Africa on AWS infrastructure in the Africa (Cape Town) region (af-south-1). In the event of a Personal Data breach we notify affected Data Subjects within seventy-two (72) hours and notify the NDPC as required.

7. Data Retention

We retain data only as long as necessary for the purposes described or as required by law. Employer and Work Profile records are retained for the duration of the relationship and then archived for seven (7) years for tax, pension, and audit compliance. Employee payslip records remain available to the Employee on a permanent read-only basis. Personal Profiles are retained until the Employee deletes them, subject to a fourteen (14) day grace period. Vendor data is retained for three (3) years after cancellation. Backups are purged within ninety (90) days of deletion.

8. Third-Party Sharing

OpportuNation does not sell, rent, lease, or trade Personal Data. We share data only where necessary to deliver the service or comply with the law — for example with Paystack (payments), SendGrid (email delivery), AWS (hosting), and the relevant statutory authorities (FIRS/State IRS, PENCOM, Federal Mortgage Bank of Nigeria). All sub-processors are bound by data processing agreements no less protective than this Policy. We do not share Employee data with Vendors, and we do not use Employee or Vendor data for advertising or profiling without explicit consent.

9. Cookies, Children, and Changes

We use strictly necessary cookies for authentication and platform functionality, plus anonymised analytics. We do not use third-party advertising or cross-site tracking cookies. The Platform is not intended for individuals under eighteen (18). We may update this Policy from time to time and will notify registered users by email at least thirty (30) days before material changes take effect.

10. Contact

For any enquiry, request, or complaint relating to this Policy or the processing of Personal Data, contact the Data Protection Officer at privacy@opportunation.io. You may also escalate complaints to the Nigeria Data Protection Commission (NDPC). This Policy is governed by the laws of the Federal Republic of Nigeria.