Privacy Policy

Last updated: 22 August 2026

On this page Overview What we collect Face verification & biometric data App permissions How we use it Sharing & international transfers Retention Security Your rights Contact

This Privacy Policy explains how SmartWorks360 (“we”, “us”, “our”) collects, uses, shares, and protects your personal information when you use our mobile app, employer dashboard, and related services (together, the “Services”). We are committed to handling your data in accordance with the Nigeria Data Protection Act, 2023 (NDPA) and other applicable laws.

By using the Services, you agree to the practices described in this policy. If you do not agree, please do not use the Services.

1. Information we collect

Information you or your employer provide

Identity & contact: name, email address, phone number, and (where required) date of birth.
Employment details: employer, role, staff ID, job title, department, and salary information, provided by your employer.
Financial & verification data: bank account details, and — only when you apply for a salary advance — your Bank Verification Number (BVN) and government ID, used to verify your identity.
Identity verification media: a photo of your ID document, and a face scan (“liveness check”). The face scan is biometric data and is described in full in section 2 below.

Information we collect automatically

Device & usage data: device type, operating system, app version, and basic usage/diagnostic logs.
Transaction data: records of payslips, advances, repayments, and related activity.

2. Face verification and biometric data

When you apply for your first salary advance, we ask you to complete a short face scan, also called a liveness check. We describe this step separately because the information involved is biometric data — a category of sensitive personal data that receives heightened protection under the NDPA 2023.

2.1 What happens during the scan

Your device camera records a short video of your face while you follow on-screen guidance.
That video is sent for analysis to Amazon Web Services (AWS), using the Amazon Rekognition Face Liveness service, which determines whether a real, live person is present rather than a photograph, mask, or recording.
AWS returns a confidence result along with up to two still images captured during the scan.
One of those images is compared against the photo of the government ID you uploaded, to confirm that the person completing the scan is the person shown on the ID.

2.2 What we do not do with it

We do not use your face data for advertising, marketing, or profiling.
We do not build a searchable database of faces and we do not index your face for later identification. Each check is a one-to-one comparison against your own ID document, and never a search against other people.
We do not use your face data to train machine-learning models.
We do not sell, rent, or trade your face data.
We do not share your face data with your employer. Your employer is told only whether verification succeeded or failed.

2.3 Your consent, and what happens if you decline

We process biometric data on the basis of your explicit consent, which you give when you choose to begin the face scan, together with our legal obligations to carry out identity (KYC) and anti-money-laundering checks before lending.

The scan is optional and you may decline. If you decline, you can continue to use the rest of the Services — viewing payslips, managing your profile, and other features are unaffected — but we will not be able to approve a salary advance, because confirming your identity is a condition of providing credit. You may withdraw your consent and request deletion of your biometric data at any time; see section 8.

2.4 Where your biometric data is stored

Face-scan images and your ID document photo are stored in encrypted storage operated by AWS in the Europe (Ireland) region. This means your biometric data is transferred to and stored outside Nigeria — see section 5 for how we handle international transfers. Access is restricted to authorised personnel on a need-to-know basis.

3. Permissions the app requests

The mobile app asks for the following device permissions, and only for the reasons given:

Camera — to photograph your government ID and to run the face scan described above. We ask only at the moment you begin identity verification. The app does not use the camera at any other time, and never in the background.
Photo library — optional, and only used if you choose to select an existing photo of your ID instead of taking a new one. We access only the image you pick.

You can review or revoke these permissions at any time in your device settings. Revoking camera access will prevent identity verification, and therefore new salary-advance applications, but will not otherwise affect the app.

4. How we use your information

To create and manage your account and deliver the Services.
To show your payslips and process payroll on behalf of your employer.
To assess eligibility for, disburse, and recover salary advances, and to calculate your internal credit score.
To verify your identity and prevent fraud, money laundering, and abuse.
To provide customer support and send you service-related notifications.
To operate, secure, and improve the Services and comply with legal obligations.

We do not sell your personal data. We share it only as needed to provide the Services:

Your employer: employers can see the workplace records and payroll data relating to their own employees. Employers cannot see or change your personal login credentials, and they do not receive your biometric data.
Payment & verification partners: licensed providers (for example, our payments partner, Monnify) that process disbursements, wallet funding, card payments, and BVN/identity checks.
Amazon Web Services (AWS): our cloud provider, which stores identity documents and performs the face-liveness analysis and face comparison described in section 2.
Service providers: cloud hosting, storage, email, and analytics providers that support our operations under confidentiality obligations.
Legal & safety: regulators, law enforcement, or other parties where required by law or to protect rights, safety, and the integrity of the Services.

International transfers. Some of these providers process or store data outside Nigeria — in particular, identity documents and face-scan images are held in AWS’s Europe (Ireland) region. Where personal data is transferred outside Nigeria we rely on the transfer conditions permitted by the NDPA 2023, including your explicit consent for biometric data and contractual safeguards with our processors requiring an adequate level of protection.

6. Data retention

We keep your information for as long as your account is active and as long as needed to provide the Services, comply with legal, tax, and regulatory obligations, resolve disputes, and enforce our agreements. Financial and transaction records may be retained for the periods required by law. When data is no longer needed, we delete or anonymise it.

Identity and biometric records. Your ID document photo and face-scan images are retained as part of the KYC record we are required to keep under anti-money-laundering law, for the statutory record-keeping period following the end of your relationship with us. We do not retain them for longer than that purpose requires, and you may request erasure at any time — we will honour the request except where retention is legally mandated, and we will tell you if that exception applies.

7. How we protect your data

We use industry-standard safeguards, including encryption of sensitive data (such as BVN and bank account numbers) at rest, encrypted connections in transit, access controls, and continuous monitoring. Biometric data is transmitted directly from your device to our verification provider over an encrypted connection. No system is perfectly secure, but we work hard to protect your information and to notify you and the relevant authorities of significant incidents where required.

8. Your rights

Subject to applicable law, you may have the right to:

Access the personal data we hold about you and request a copy.
Correct inaccurate or incomplete information.
Request deletion of your data, including your biometric data, subject to legal retention requirements.
Object to or restrict certain processing, and withdraw consent where processing is based on consent — including your consent to biometric face verification.

To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

9. Children

The Services are intended for employed adults (18+) and are not directed at children. We do not knowingly collect data from anyone under 18.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new “Last updated” date, and where appropriate, notify you in the app.

11. Contact us

Questions or requests about your privacy? Contact us at support@smartworks360.com, or our Data Protection Officer at privacy@smartworks360.com.