This notice explains how ShiftNaija Digital Technology Limited ("ShiftNaija", "we") handles personal data when you use our website, join our early-access list, or use the ShiftNaija worker app and the ShiftNaija for Business app. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA).
Who we are
ShiftNaija Digital Technology Limited (RC 9697455) is the data controller. Our registered office is 14B Kingsbay Estate, Lekki County Homes, Lekki, Lagos State, Nigeria. You can reach our data protection contact at dpo@shiftnaija.com.
What we collect
If you join the early-access list
Your phone number or email address, whether you want shifts or need staff, your name and business name if you give them, your consent, and a one-way scrambled (hashed) version of your IP address that we use only to block spam.
If you work through ShiftNaija
- Identity details: your name, phone number, National Identification Number (NIN) and Bank Verification Number (BVN).
- A selfie, used to match your face to your identity record. This is biometric data and we treat it as sensitive.
- The bank account you choose to be paid into.
- Your skills, sectors and availability.
- Your location, to show shifts near you and to confirm you have arrived at a venue when you check in.
- Your shift history, check-in and check-out times, ratings, reliability score and messages with businesses.
If you hire through ShiftNaija
- Your business name, CAC registration number, venue addresses, and the contact person's details.
- Wallet top-ups, payments, shifts posted, timesheets, invoices and ratings.
Device and usage data
App version, device type and crash reports, so we can fix problems. Our website uses cookieless analytics that count visits without identifying you.
How we use it
- To run your account and match shifts, because we need to in order to provide the service you signed up for.
- To verify identity (NIN, BVN and face match), with your consent and to meet our legal and payment-provider obligations. This protects workers and businesses alike.
- To confirm attendance through GPS or QR check-in, so hours and pay are accurate.
- To pay workers and bill businesses, and to keep the records the law requires.
- To keep the platform safe: preventing fraud, handling disputes and enforcing our terms, which is in our and our users' legitimate interests.
- To send service messages such as shift offers, reminders and payment confirmations by push, SMS or WhatsApp. We send marketing only if you have agreed to it, and you can opt out at any time.
Who we share it with
- Businesses you work for see your name, photo, verification badges, rating, reliability score and your check-in times for their shifts.
- Workers who take your shifts see your business name, venue address and rating.
- Service providers who work for us, under contract and only for these purposes: identity verification providers, our payment provider (Paystack), messaging providers for SMS and WhatsApp, and our cloud hosting providers.
- Authorities, when the law requires it.
We do not sell personal data, and we do not use it for third-party advertising.
Transfers outside Nigeria
Some of our providers, such as cloud hosting, may process data outside Nigeria. When that happens we use providers and safeguards that meet the NDPA's requirements for cross-border transfers.
How long we keep it
We keep account data while your account is open. After you close it, we keep payment, tax and shift records for as long as the law requires, and delete or anonymise the rest. We keep verification data only as long as we need it to verify you and meet our legal obligations. Early-access details are kept until we have told you the apps are live, or until you ask us to delete them.
Your rights
Under the NDPA you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong or incomplete;
- delete your data, where we don't need to keep it by law;
- restrict or object to how we use it;
- send your data to you or another service in a portable format;
- withdraw your consent at any time, without affecting what we did before.
Email dpo@shiftnaija.com to make a request. If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission (NDPC).
Security
Data is encrypted in transit. Bank account details are encrypted when stored. Access to personal data is limited to the people and systems that need it to run the service.
Age
ShiftNaija is for people aged 18 and over. We do not knowingly collect data from anyone younger.
Changes and contact
If we change this notice we will update the date above, and tell you in the app when the change matters. Questions: dpo@shiftnaija.com, or write to us at 14B Kingsbay Estate, Lekki County Homes, Lekki, Lagos State, Nigeria.