Privacy Policy

1. Introduction

BridgeHedge Limited ("BridgeHedge", "we", "us", or "our") provides BridgeHR, a human resources and payroll management platform ("the Platform") used by Nigerian businesses to manage employee records, payroll, leave, attendance, onboarding, and related HR functions. This Privacy Policy explains what personal data we collect, why we collect it, how it is used, and the rights available to you as a data subject, in line with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR).

2. Who This Policy Applies To

This policy applies to:

• Customers — the companies that subscribe to BridgeHR ("Data Controllers" for their own employee data);
• Employees of customers — individuals whose HR and payroll records are processed on the Platform on behalf of their employer ("Data Subjects");
• Visitors to our marketing website who request information, a demo, or sign up for a trial.

Where a customer uses BridgeHR to manage its employees, that customer is the Data Controller of its employees' information, and BridgeHedge acts as a Data Processor on the customer's behalf, in accordance with our terms of service and any applicable data processing agreement.

3. Information We Collect

Depending on how the Platform is used, we may collect:

• Identity data — full name, date of birth, gender, marital status, nationality, state of origin, photograph;
• Contact data — email address, phone number, residential address;
• Government identifiers — National Identification Number (NIN), Bank Verification Number (BVN), Tax Identification Number, pension RSA PIN, where required for statutory payroll compliance;
• Employment data — job title, department, employment type, hire date, compensation, performance and disciplinary records, onboarding progress;
• Financial data — bank account details, salary, payslip history, statutory deduction records (PAYE, pension, NHF, NHIA, NSITF, ITF);
• Attendance data — clock-in/out timestamps and, where enabled by a customer, IP address used for attendance verification;
• Account and usage data — login credentials (stored as a salted hash), session activity, device and browser information.

4. How We Use Your Information

We process personal data to:

• Provide and maintain the core HR functions of the Platform — employee records, payroll calculation, leave management, attendance tracking, onboarding, and disciplinary case management;
• Calculate and remit statutory deductions accurately (PAYE, Pension, NHF, NHIA, NSITF, ITF) as required by Nigerian law;
• Send transactional notifications (e.g. payslip availability, leave status, document shares, disciplinary actions);
• Maintain account security, including authentication and fraud prevention;
• Improve and troubleshoot the Platform;
• Comply with our legal and regulatory obligations.

5. Legal Basis for Processing

We process personal data on the following legal bases under the NDPA: performance of an employment-related contract between the customer and its employee, compliance with statutory obligations (tax and pension remittance), the legitimate interests of the customer in managing its workforce, and, where applicable, consent.

6. Data Sharing and Disclosure

We do not sell personal data. We may share data with: the customer (employer) that controls the data; regulatory and statutory bodies where required for compliance (e.g. SIRS, PenCom, NHF, NSITF); infrastructure and hosting providers who process data strictly on our instructions under confidentiality obligations; and professional advisers or authorities where required by law.

7. Data Retention

Personal data is retained for as long as the customer's subscription is active, and thereafter for the period required to meet statutory record-keeping obligations (including tax and pension regulations), after which it is securely deleted or anonymised, unless a longer retention period is required by law.

8. Data Security

We apply technical and organisational measures to protect personal data, including encrypted password storage, role-based access controls, session security, and restricted administrative access. While we take reasonable steps to protect your data, no system can be guaranteed to be 100% secure.

9. Your Rights

Subject to applicable law, you may have the right to: access the personal data we (or your employer, as Data Controller) hold about you; request correction of inaccurate data; request deletion of data no longer required for a lawful purpose; and object to certain types of processing. Requests relating to your employment records should generally be directed to your employer's HR department in the first instance, as they control your account.

10. Cookies

Our marketing website uses minimal cookies necessary for basic site functionality (such as session state). The Platform itself uses secure, HTTP-only session cookies required to keep you signed in; these are essential to the service and cannot be disabled without affecting functionality.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform or via email to account administrators. Continued use of the Platform after changes take effect constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or how your data is handled, please contact us at info@bridgehedge.org.