Privacy policy

1Who we are and our role

Hirably Technologies Limited ("Hirably", "we", "us") is a company incorporated in Nigeria and operates hirably.com, a consent-led verification service used by businesses and households to confirm the details a employee has given them.

For account data - the details of the employer, its team members and its billing - Hirably is the data controller. For verification data about a candidate or employee, Hirably acts as a data processor on the instruction of the employer who requested the check, and as a controller for the limited purposes of fraud prevention, service security, dispute handling and legal compliance.

We process personal data lawfully, and where a client or employee is located in a jurisdiction with a higher standard of protection, we apply that higher standard.

2Personal data we collect

From employers and household clients

• Contact and account details: full name, work email, phone number, password credential.
• Organisation details: business name, registration number, registered address, role of the account holder.
• Billing records: verification selected, amount paid, payment reference, invoice history. We never see or store full card numbers.
• Team and permission records showing who in the dashboard saw which case.

From the candidate or employee being verified

• Identity details submitted by the employee: full name, date of birth, gender, phone number and a national identification number.
• A facial image where a likeness check forms part of the requested verification.
• Residential address details, and the outcome of an in-person address visit, where residence verification was requested and consented to.
• Guarantor details supplied by the employee, and each guarantor's own confirmation of what they attested to.
• Previous engagement details where employment history verification was requested.
• The consent record itself: what was agreed, when, from which device and network, and whether it was later withdrawn.

Automatically

• Technical data: IP address, device and browser characteristics, and timestamped service logs.
• Security telemetry used to detect account takeover, impersonation and misuse of the service.

We do not require, and ask you never to send us, health records, religious or political affiliation, trade union membership, biometric templates beyond the likeness check described above, or any other special category data.

3Why we process it, and our lawful basis

Every processing activity we carry out sits under one of the following bases.

• Consent - verification of a employee's identity, address, guarantors and previous engagements. Nothing is checked before the employee has given their own recorded consent through their own private link.
• Contract - creating and running an employer account, processing payment, issuing reports and providing support.
• Legal obligation - tax and accounting records, and responses to a lawful request from a court or a competent authority.
• Legitimate interest - preventing fraud, protecting the service and the people in it, and keeping an audit trail that lets a employee challenge a record about them. We balance this against the rights of the person concerned and keep the data minimal.

We do not use personal data for advertising, we do not sell it, and we do not build profiles for any purpose other than the specific verification requested.

4No scores, no automated decisions about people

Hirably reports facts. A report states what was confirmed, what could not be confirmed, and when each check was carried out. We do not produce a risk score, a rating, a ranking or a recommendation, and no report tells an employer whether to hire someone.

No decision that produces a legal effect on a person is made by automated means alone. Hiring decisions belong to the employer, and our reports carry a clear statement to that effect. Where a check cannot be completed, that is reported as an unconfirmed result and never as an adverse finding about the person.

5Who we share data with

Verification results are released only to the employer who requested them, and to the employee themselves.

To operate the service we use a small number of vetted processors, each under a written data processing agreement that restricts them to our instructions:

• Our licensed verification provider, a regulated Nigerian identity and registry data source, which performs lookups against authoritative national and corporate registry sources on our behalf. The partner's identity is commercially confidential.
• A messaging provider that delivers consent requests and status updates by WhatsApp and SMS.
• Cloud hosting, database and file storage providers.
• A licensed payment processor for card and transfer payments.
• A transactional email provider for account and case notifications.
• Vetted field agents, where and only where a physical address visit was requested and consented to.

We may disclose data where we are legally compelled to do so. Where the law permits, we tell the affected person first. We also share data with professional advisers under duty of confidence, and, on a corporate reorganisation, with a successor entity bound by this policy.

6International transfers

Verification data relating to Nigerian identity sources is processed in Nigeria. Some infrastructure, email and support tooling processes data outside Nigeria. Where that happens we rely on an adequacy determination, or on equivalent contractual safeguards, together with encryption in transit and at rest.

7How long we keep it

• Verification cases and reports - kept while the requesting employer holds an active account, then deleted or irreversibly anonymised.
• Identification numbers - never stored in readable form. We keep a one-way hash so a repeat check can be recognised without the number itself being retrievable.
• Consent records - kept for the life of the case plus six years, because a consent trail is the evidence that a check was lawful.
• Evidence files - held in private storage reachable only through short-lived expiring links, and deleted with the case.
• Financial records - kept for the period Nigerian tax law requires.
• Security logs - kept up to 12 months.

8Your rights

Subject to the law, you may ask us to:

• confirm what personal data we hold about you, and give you a copy;
• correct data that is inaccurate or incomplete;
• delete data we no longer have a lawful reason to keep;
• restrict or object to a particular use;
• port your data to another service in a structured format; and
• withdraw a consent you gave, at any time, without penalty.

Withdrawing consent stops future checks. It does not undo a check already lawfully completed, and the record that consent was given and then withdrawn is retained.

Write to privacy@hirably.com. We verify who you are before we act, and respond within 30 days. If you are not satisfied you may complain to the Nigeria Data Protection Commission.

9Children

Hirably is not for anyone under 18. We do not knowingly verify a minor, and we delete any record we discover relates to one. If you believe a minor's data has been submitted to us, tell us at privacy@hirably.com and we will remove it.

10Security and breach notification

If a breach is likely to result in a risk to the rights of the people affected, we notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and we tell the affected employers and employees what happened, what data was involved and what to do next.

11Changes to this policy

We update this policy as the service changes. Material changes are announced in the product and by email to account holders at least 14 days before they take effect. The date at the top of this page always reflects the current version.