1. Controllership
For tenant administrators and compliance officers who create accounts on VerityChain, we act as a data controller for account, billing, and platform security data.
For personal data contained in vendor documents and extracted fields that a tenant uploads or invites vendors to submit, the tenant organization is the data controller. Careerlinkk Digital Ventures Ltd acts as a data processor / service provider under our Data Processing Addendum (/dpa) and only processes that data on documented instructions.
Company details: Careerlinkk Digital Ventures Ltd, RC 9652318, Lagos, Nigeria. Website: careerlinkk.com.
2. Personal data we process
- Account data: name, work email, password hash, organisation membership and role.
- Vendor workflow data: vendor identity, contact emails for magic-link invitations, document metadata, extracted trade entities, screening results, risk scores, and approval decisions.
- Audit & integrity data: hash-chained audit log entries, document fingerprints, timestamps.
- Billing data: plan, payment references, amounts, and gateway transaction identifiers (Paystack / Flutterwave). We do not store full card numbers.
- Technical logs: IP address, user agent, and security event logs for abuse prevention — without logging document contents or unnecessary PII.
3. Lawful bases (NDPA)
We process personal data only where a lawful basis applies, including:
- Contract: to provide the SaaS service you subscribed to.
- Legitimate interest: securing the platform, preventing sanctions-list abuse, and improving reliability — balanced against data subject rights.
- Legal obligation: responding to lawful requests by competent authorities where required.
- Consent: where required for optional communications (you may withdraw at any time).
4. Purposes
We process data to operate vendor onboarding, document verification, sanctions and entity screening, risk scoring, audit trails, billing, support, and security monitoring. We do not sell personal data.
5. Sharing & processors
We share personal data only with:
- Infrastructure providers (hosting, database, object storage) under contract.
- Payment processors: Paystack and Flutterwave.
- SSO / identity providers when an enterprise tenant enables SAML/SCIM.
- Professional advisors or DPCO partners assisting with NDPA compliance, under confidentiality.
- Authorities when legally compelled.
6. International transfers
Where personal data is transferred outside Nigeria, we implement safeguards consistent with the NDPA and document residency options agreed in the tenant contract.
7. Retention
Account, audit, and billing data are retained according to tenant settings, tax requirements, and lawful claim needs. Verified deletion requests are honoured unless law requires retention.
8. Security
Encryption in transit and at rest for documents, least-privilege access, signed temporary file URLs, password hashing, rate limiting, and a hash-chained audit ledger for material actions.
9. Your rights (data subjects)
Subject to NDPA exceptions, individuals may request access, correction, deletion, restriction, objection, and portability, and may lodge a complaint with the NDPC. Email: info@careerlinkk.com.
10. Children
VerityChain is a B2B compliance product and is not directed at children under 18.
11. DPCO & governance
Where required, Careerlinkk Digital Ventures Ltd will engage a licensed DPCO under NDPC frameworks for audits and DPIAs. Enterprise customers may request our diligence pack during procurement.
12. Changes
Material changes to this Policy will be posted on this page with a revised date.