Privacy Policy
This policy explains how [COMPANY NAME], registered in Nigeria under [RC NUMBER], with its registered address at [ADDRESS] ("Strivr", "we", "us"), handles personal data when you visit our website or use the Strivr service. We handle personal data under the Nigeria Data Protection Act 2023 (the "NDPA") and the regulations of the Nigeria Data Protection Commission (the "NDPC").
- Our two roles
- What we collect
- Why we use it
- Sensitive information
- Who we share it with
- Transfers outside Nigeria
- How long we keep it
- How we protect it
- Your rights
- Cookies and similar technology
- Children
- Changes
- Contact us
1. Our two roles
Strivr is used by organizations, such as employers, to manage their people and documents. That gives us two different roles:
- Controller. For the information needed to run accounts and the website (account details, sign-in and security records, support messages and website visits), we decide how the data is used, so we are the controller.
- Processor. For the information an organization puts into Strivr (its employee records, documents, messages, signatures and requests, together "Customer Data"), the organization decides why and how the data is used. The organization is the controller and we are its processor. We handle Customer Data only on the organization's instructions, under our Terms of Service and the data processing terms that go with them.
If you are an employee or other person whose information an organization keeps in Strivr, please contact that organization about your information. We will help it respond to your request.
2. What we collect
Account information
Your name, your organization email address (which is your sign-in name), your contact email address, an optional phone number, and your password. We store passwords only as a salted hash, never in readable form. We also keep your organization's name and address on Strivr.
Customer Data
Whatever your organization stores in Strivr. This typically includes employee profile details, any custom fields the organization creates, uploaded documents and files, signature images, messages, and signing or approval requests with their comments. Your organization decides what to store.
Signature records
When a document is signed or approved we record who acted, when, which document version, and a cryptographic fingerprint of the file, so that the signature can be checked later.
Security and technical records
Your IP address, browser and device type, sign-in history and active sessions, and an activity log of important actions (such as sign-ins, changes to people and documents, and requests). We also keep error logs to fix problems.
Website visits
Our website loads its typeface from Google Fonts, which means your browser contacts Google and shares your IP address with it. We do not currently use advertising or analytics trackers on the website.
3. Why we use it
- To provide the service (performing our agreement with your organization): creating accounts, signing you in, and running documents, messaging, requests and permissions.
- To keep Strivr secure (our legitimate interest and legal obligations): detecting misuse, limiting repeated sign-in attempts, keeping the audit trail, and investigating incidents.
- To contact you about your account (performing our agreement): confirmation, invitation and password-reset emails, and notices about the service.
- To support and improve the service (our legitimate interest): answering questions and diagnosing errors.
- To meet legal duties (legal obligation): responding to lawful requests from authorities and keeping required records.
Where we rely on your consent for anything, we will ask you first and you can withdraw it at any time. We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on people.
4. Sensitive information
Organizations can create custom fields and may store sensitive personal data, such as next-of-kin details, identification numbers or bank details. Each organization is responsible for deciding what it needs, for having a lawful basis, and for telling its people what it keeps. We recommend storing only what is necessary. Fields an organization marks as sensitive are encrypted in our database and shown only to the roles the organization chooses.
5. Who we share it with
We use a small number of service providers (our "sub-processors") to run Strivr. They may process personal data only to provide their service to us.
| Provider | What it does for us | Location |
|---|---|---|
| Render | Runs the Strivr application | [Render region, to be confirmed] |
| Supabase | Managed database that stores account and Customer Data records | United Kingdom (London) [to be confirmed] |
| Cloudflare | Stores uploaded files (R2 storage) and provides domain and network services | [Storage region, to be confirmed] |
| Mailjet | Sends account, invitation and password-reset emails | European Union [to be confirmed] |
| Google Fonts | Delivers website typefaces to your browser | [to be confirmed] |
We may also disclose personal data where the law requires it, to protect people's safety or our rights, or to a successor if our business is sold or merged, in which case this policy continues to apply. We will update this list when providers change.
6. Transfers outside Nigeria
Our providers are located outside Nigeria, so personal data is processed in other countries. Where the NDPA requires safeguards for such transfers, we put them in place, for example through contractual commitments with our providers. [To be confirmed with counsel before publishing.]
7. How long we keep it
- Account information is kept while the account is active and for a reasonable period afterwards.
- Customer Data is kept until the organization deletes it or closes its account, following the organization's instructions.
- Signature records and the activity log are kept as permanent records so that signatures can be proven later. Users cannot edit or delete them. Where the law gives you a right to erasure, we will work with the organization to apply it in a way that respects these records and our legal duties.
- Unconfirmed sign-ups, where nobody confirms the email address, are removed automatically after a short period.
- Backups are kept for [BACKUP PERIOD] and then deleted.
8. How we protect it
- All traffic to Strivr is encrypted in transit.
- Passwords are stored only as salted hashes.
- Each organization's data is separated from every other organization's at the database level.
- Access inside an organization depends on roles and permissions the organization controls.
- Fields marked sensitive are encrypted.
- The activity log is append-only, and people can review and end their own sign-in sessions.
No system is perfectly secure. If a personal data breach is likely to put people's rights at risk, we will notify the NDPC within 72 hours of becoming aware of it, and we will tell the affected organizations, and affected individuals where the law requires, without undue delay.
9. Your rights
Under the NDPA you have the right to be informed about how your data is used, to access it, to have it corrected, to have it erased in the cases the law provides, to restrict or object to its use, to receive it in a portable form, to withdraw consent you have given, and not to be subject to certain automated decisions. You may also complain to the Nigeria Data Protection Commission.
For Customer Data, please contact the organization that holds your information. For information we hold as controller, email us at CONTACT_EMAIL_HERE. We may need to confirm who you are before acting on a request, and we will respond within the time the law allows.
10. Cookies and similar technology
The Strivr app keeps you signed in by storing a session token in your browser's local storage. This is strictly necessary for the service to work. We do not use cookies or trackers for advertising. If we add analytics later, we will update this policy and ask for consent where the law requires.
11. Children
Strivr is for organizations and their staff. It is not intended for people under 18, and we do not knowingly collect their personal data.
12. Changes
We may update this policy. We will change the date at the top, and for significant changes we will notify account owners by email or inside the app.
13. Contact us
[COMPANY NAME], [ADDRESS]
Email: CONTACT_EMAIL_HERE
Data Protection Officer: [DPO NAME AND CONTACT]
NDPC registration: [NDPC REGISTRATION NUMBER, once registered]