Compliance

1. Nigeria Data Protection Act 2023 (NDPA)

The NDPA, administered by the Nigeria Data Protection Commission (NDPC), governs the processing of personal data in Nigeria. Our position under it:

• Roles. A customer organization is the data controller for its staff and member data. We act as a data processor on its written instruction, which the Data Processing Agreement records.
• Lawful basis. Every processing activity is tied to a basis under section 25 of the Act — the table in section 3 below.
• Data minimisation. We collect what the attendance function requires and no more; sensitive features (GPS, biometrics) are off by default and switched on deliberately by the organization.
• Security. Technical and organisational measures are described under Security Practices.
• Breach notification. We notify affected controllers without undue delay and within 72 hours of becoming aware, so they can meet their own NDPC obligations.
• Data subject rights. We support the controller in answering requests for access, rectification, erasure, restriction, portability and objection.

Organizations that are themselves data controllers of significance under the NDPA have their own registration and audit-filing duties with the NDPC. Those are yours to meet; we will provide whatever information about our processing you need in order to meet them.

2. GDPR and UK GDPR

Where a customer or its staff are in the European Economic Area or the United Kingdom, we act as a processor under Article 28 and the DPA linked above serves as the Article 28 contract. We support the full set of data subject rights, we do not engage in automated decision-making with legal effect, and we make no secondary use of customer data.

International transfers. Our infrastructure providers are global, so personal data may be processed outside Nigeria, the EEA or the UK. Those transfers rely on the providers’ own transfer mechanisms — typically Standard Contractual Clauses and equivalent safeguards incorporated into their data processing terms. We do not transfer customer data to any party outside the list on our sub-processors page.

We have not appointed an EU or UK representative under Article 27. If your organization requires one to be in place before it can use the service, contact us before you sign up and we will tell you honestly whether we can meet that requirement.

3. Lawful basis, activity by activity

4. Monitoring staff lawfully

Attendance tracking is monitoring, and most data protection regimes expect it to be proportionate and transparent. Before you enable GPS or biometric check-in, we expect you to:

• Tell your staff or members what is being collected, when, and why — in writing.
• Obtain explicit consent for biometric enrolment, and offer a working alternative to anyone who declines.
• Limit GPS check-in to the sites and shifts where presence genuinely needs verifying.
• Restrict who inside your organization can view individual records, using the role controls we provide.
• Where your regime requires it, run a data protection impact assessment before switching the feature on.

These are obligations of the controller — your organization — not of UseTimio. We provide the switches and the role controls; the decision to use them is yours.

5. Payments and financial compliance

• Card and bank payments are processed by Flutterwave, a licensed payment service provider. Card numbers are entered on their infrastructure — we never see or store them. We keep the transaction reference, amount and status.
• Affiliate payouts are executed as bank transfers through the same provider, with account details verified against the bank before a transfer is approved.
• We keep billing records for at least six years to satisfy Nigerian tax and company law, even after an account is closed.
• Where a payment is flagged as fraudulent or a chargeback is raised, we cooperate with the provider and may suspend the account while it is investigated.

6. Making a data subject request

Start in the right place, and it is quicker:

• You are a staff member or a church/school member: contact your organization’s administrator. They control the record and can view, correct or delete it directly.
• You are an organization owner or admin: email info@usetimio.com from the address on the account, with “Privacy” in the subject line.
• A request reaches us directly from an individual: we forward it to the relevant organization rather than acting on it ourselves, because the data is theirs to control, and we tell you we have done so.

We acknowledge requests within 5 business days and complete them within 30 days, or tell you why more time is needed.

7. Complaints

If you are unhappy with how we have handled your data, write to us first — most issues are a misunderstanding we can clear up quickly. If we cannot resolve it, you may complain to the Nigeria Data Protection Commission, or, if you are in the EEA or the UK, to your local supervisory authority. Exercising that right costs you nothing and does not affect your use of the service.

8. Keeping this current

Data protection law in Nigeria is still developing, and our compliance posture moves with it. We review this page at least annually and whenever we add a feature that changes what we process. Material changes are emailed to organization owners.