Privacy Policy

1. Introduction and Who Is Responsible

PerfTrack ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information when you use our Service at perftrackapp.com. It applies together with the Nigeria Data Protection Act 2023 ("NDPA").

Who is responsible for your information depends on what it is:

• Employer data (PerfTrack is the processor). Information that an organisation puts into PerfTrack about its staff (HR records, payroll, leave, attendance, performance, documents and so on) is controlled by that organisation, your employer, which is the Data Controller. We process it only on your employer's behalf, under our Data Processing Agreement. If you are an employee, your employer decides what is collected, why, and how long it is kept. Please send requests about your employment data to your employer first. We will help your employer respond.
• Our own data (PerfTrack is the controller). We are the Data Controller of the information we collect about the administrators who sign up, billing and subscription records, website and security logs, and messages sent to us. This is what the rest of this policy mainly covers.

2. Information We Collect

Information organisations and their users provide

• Account information: your name, work email address, company name, job title, and role within the platform
• HR Records: employee profiles, job titles, departments, employment dates, documents, and contact details added for team members
• Payroll data: salary structures, gross pay, deductions, allowances, net pay amounts, bank details used for payroll, payslips, and payroll approval records
• Leave and attendance information: leave requests, leave types, balances, approval decisions, and history; clock-in and clock-out records and, where an employer switches on location-based attendance, device location at the time of clock-in
• Onboarding data: onboarding task templates, task assignments, and completion status for new hires
• Goals and KPIs: goal titles, descriptions, progress updates, target dates, weights, and status
• Performance reviews: review templates, ratings, written assessments, reviewer assignments, and completed review records
• 360-degree feedback: feedback submitted between employees, including ratings and written comments
• Recognition: peer recognition messages, badge awards, and leaderboard activity
• Documents: files uploaded to an employee record or a document library
• Payment information: processed securely through Flutterwave. We do not store card numbers or full payment credentials.
• Communications: messages, queries, and support requests you send to our team

Information collected automatically

• Log data: IP address, browser type, pages visited, and time and date of visits
• Public website visits: for our public pages we record the page visited, referring page, browser type, and a one-way hash of your IP address and browser, used for aggregate statistics
• Usage and security records: features used, actions taken within the platform, sign-in events, and the last account activity timestamp used for inactivity monitoring and data retention. Employers can use activity information to run their own HR processes.
• Company Policies: where your employer uses this feature, we record which policy you opened and when, and your name and email are printed on every page of the policy you view. Your employer can see who has opened each policy.
• Acceptance records: when an administrator accepts our Terms, Privacy Policy and DPA we record the version, time, IP address and browser, as evidence of the agreement
• Device information: browser type, operating system, and screen resolution
• Session data: authentication tokens and session cookies to keep you securely logged in

We do not knowingly ask for special-category data (such as health, religious or political information). Leave records (for example sick leave) and documents uploaded by an employer may nevertheless reveal such information. Employers are responsible for entering only what they have a lawful basis to process.

3. How We Use Information and Our Lawful Bases

For the data for which we are the controller, we rely on these lawful bases under the NDPA:

• Performing our contract with you or your organisation: providing, maintaining, and supporting the Service; processing payments and managing subscriptions; sending service communications such as account notices, review assignments and verification emails
• Legitimate interests: securing the Service, detecting and preventing fraud or abuse, keeping audit logs, producing aggregate statistics, and improving the Service, where these do not override your rights
• Legal obligation: complying with Nigerian law and valid legal process
• Consent, only where we ask for it explicitly, and you may withdraw it at any time

For employer data, the employer decides the purpose and lawful basis, and we process it only to provide the Service to the employer. We do not use employer data for advertising, and we do not sell it.

4. Who We Share Data With

We do not sell, rent, or trade your personal information. We share data only with the service providers that help us run PerfTrack (our "sub-processors") and where the law requires:

• Flutterwave: payment processing
• Brevo (Sendinblue): transactional email delivery
• Render: cloud hosting infrastructure and database
• Cloudinary: storage of uploaded documents and files
• Google: delivery of web fonts, and the Google document viewer that opens some uploaded files (such as Word documents or PDFs) for in-browser preview when a user chooses to open them
• YouTube (Google) and Vimeo: only if your employer adds an introduction video to a policy. When you open that policy, your browser connects directly to the video provider. This is the employer's choice, not a PerfTrack service provider.
• Legal authorities: when required by Nigerian law or valid legal process

The current list, with the purpose of each provider, is in the Annex to our Data Processing Agreement. Within an organisation, what each person can see is controlled by the organisation's own administrators through roles and permissions.

5. International Transfers

Some of our providers store or process data on servers outside Nigeria. Where personal data is transferred outside Nigeria, we use providers that apply appropriate safeguards, and we put contractual protections in place consistent with the NDPA.

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), secure database storage, hashed passwords, tenant separation between organisations, and role-based access controls. See our Security page. However, no method of transmission over the internet is 100% secure. If a personal data breach affects data we process for an organisation, we will tell that organisation without undue delay, as set out in the DPA. If a breach affects data for which we are the controller, we will notify the Nigeria Data Protection Commission and affected individuals where the law requires.

7. Data Retention

We retain data for as long as an account is active or as needed to provide the Service. Upon account termination, we retain data for 30 days before permanent deletion, unless required by law to retain it longer. Backup copies are overwritten in the ordinary backup cycle. Security and audit logs are kept for a limited period needed for security, fraud prevention and dispute resolution. Employers decide how long they keep records about their staff, and are responsible for deleting data they no longer need.

Inactivity policy: Accounts with no login or platform activity for 60 days will receive an inactivity warning email. If the account remains inactive for a total of 90 days, we reserve the right to permanently delete the organisation's data in line with this policy. You will be notified before any deletion takes place.

8. Your Rights

Under the NDPA you have the right to:

• Be informed about how your data is used
• Access the personal information held about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Restrict or object to processing, including direct marketing
• Receive your data in a portable format
• Not be subject to a decision based solely on automated processing that significantly affects you
• Withdraw consent where processing is based on consent
• Complain to the Nigeria Data Protection Commission

For data we hold as controller, contact us at hello@perftrackapp.com and we will respond within 30 days. For your employment data, contact your employer, who controls it. If you send such a request to us, we will pass it to your employer and, where the law allows, tell you we have done so.

9. Cookies

We use cookies to maintain your session and improve your experience. See our Cookie Policy for more details.

10. Children's Privacy

The Service is not directed at children under 18. We do not knowingly collect personal information from children. Employers are responsible for the lawful handling of any records they hold about young workers or apprentices.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification at least 30 days before they take effect.

12. Contact Us

Questions about this Privacy Policy or our data practices? Contact us at hello@perftrackapp.com.