MACH-HR Privacy Notice and Data Protection Policy
This policy explains how we collect, use, protect, and share personal information when providing our HR management platform to Nigerian businesses, non-governmental organisations, and businesses outside Nigeria, and their employees.
Quick Navigation
Important: MACH-HR is a business-to-business (B2B) platform. Your employer (the Subscribing Organization) controls what data is collected about you and how it is used for your workforce and employment records. If you have questions about your personal data, your first point of contact is usually your employer's HR department — see Section 11 for when you should contact us directly instead.
1. Introduction
Machi Kunzult Ltd (“we,” “our,” or “us”) operates MACH-HR, a cloud-based Human Resource Management System (HRMS). We provide this platform to Nigerian businesses, non-governmental organisations, and businesses outside Nigeria (“Subscribing Organizations”) who use it to manage their workforce.
In this relationship, we act as a processor when we handle workforce or applicant data solely on a Subscribing Organization's documented instructions. MACH-HR acts as a controller where it determines the purposes and means of processing for its own website, customer account administration, billing, security, support, marketing and cookies, our referral programme, our own staff and recruitment, and other corporate operations.
MACH-HR covers payroll processing (fully compliant with Nigeria Tax Act 2025), attendance and location tracking, productivity monitoring, leave management, performance reviews, misconduct management, recruitment, salary management, loans, benefits, financial accounting and bank reconciliation, invoicing and tax remittance, document management, training, expense management, asset and inventory management, real-time chat and communication, calendar and video-meeting integrations, single sign-on, and AI-powered HR assistance — across more than 40 modules in total.
This policy is governed by the Nigeria Data Protection Act (NDPA) 2023 and all other relevant data protection regulations in Nigeria. If you have any concerns about how your data is being used, please contact your employer's HR department in the first instance.
2. How We Obtained Your Information
We may obtain your personal information directly from you, from your employer or an authorised administrator, and from services connected to MACH-HR, such as Google or Microsoft. Where applicable, we may also receive information from payment, banking, or statutory service providers. We may collect information from your device, attendance records, or location activity when those features are enabled. We may also generate or infer information through the platform, including attendance calculations, productivity summaries, and AI-generated scores.
3. Information We Collect on Your Behalf
We collect personal information only as instructed by your employer. Your employer configures which data fields are used, which modules and integrations are enabled, and what information is entered. Not all categories below will apply to every employee — this depends entirely on how your employer has set up the platform.
Personal & Contact Information
Your name, date of birth, gender, marital status, home address, local government area, state of origin, phone number, personal email address, next of kin details, blood group, and nationality.
Why we collect this: Used to create and maintain your employee record.
Employment Information
Your company email, department, branch, job title, employment type, employment status, start date, probation period, confirmation date, and work location.
Why we collect this: Used to manage your employment and ensure correct payroll eligibility.
Financial & Payroll Information
Your salary structure, bank name, account number, account name, bank sort code, Pension Fund Administrator name, RSA PIN, pension account number, Tax Identification Number (TIN), NHF number, loan records, declared annual rent, and life insurance premium.
Why we collect this: Used to calculate and process your salary, statutory deductions, and statutory remittances.
Identity & Verification Documents
National Identification Number (NIN), Bank Verification Number (BVN), Tax Identification Number (TIN), driver's licence number, international passport number, and guarantor details.
Why we collect this: Used for identity verification, bank account confirmation, and compliance with Nigerian financial regulations.
Attendance, Location & Work Hours
Your clock-in and clock-out times, total work hours, overtime hours, late arrival minutes, and GPS or map-derived location data captured at the point of attendance (see Section 8 on monitoring).
Why we collect this: Used to calculate working time, overtime, and payroll deductions for absence or late arrival.
Device & Productivity Data
Where your employer has enabled productivity monitoring on a company-managed device, the websites you visit, application usage, and derived summaries such as most-visited domains during work hours.
Why we collect this: Used to help your employer understand work activity patterns on company equipment.
Leave Records
Leave requests you submit, leave type, dates, supporting documents such as medical certificates, your leave balance, accruals, and carry-over.
Why we collect this: Used to manage and approve your time off.
Performance & Conduct Records
Performance review scores and comments, goals, strengths, areas for improvement, training recommendations, misconduct case records, any penalties applied, your written responses, appeal submissions and outcomes, and investigation findings.
Why we collect this: Used to manage your performance, professional development, and, where necessary, formal disciplinary processes.
Recruitment & Onboarding Records
For job applicants: CV or resume, application form details, AI-generated screening score, interview notes, offer letters, and rejection decisions.
Why we collect this: Used to manage the hiring process on behalf of your employer.
Training & Development Records
Training courses attended, certification records, skill assessments, and training budget allocation.
Why we collect this: Used to track your professional development.
Communication & Chat Data
Messages, channel activity, and metadata generated when you use the platform's real-time chat and notification features.
Why we collect this: Used to enable workplace communication and deliver real-time alerts, such as approval requests and system notifications.
Single Sign-On (SSO) Profile Data
If your employer enables sign-in via Google or Microsoft, we receive your name, email address, and profile identifier from that provider at login.
Why we collect this: Used to authenticate you and link your account to your employee profile without requiring a separate password.
Documents
Employment contracts, certificates, identification documents, and any other files your employer uploads to your employee profile.
Why we collect this: Used to maintain a complete and secure digital employee file.
4. Sensitive Personal Data
We may process sensitive personal data where necessary for the use of MACH-HR, including health information contained in medical certificates, blood group information, and biometric data where biometric features are enabled. Such information will only be processed where there is a lawful condition for doing so under Section 30 of the Nigeria Data Protection Act 2023. We will apply appropriate safeguards, limit access to authorised persons, and ensure that sensitive personal data is used only for the purpose for which it was collected.
5. How We Use Your Personal Data
We process your personal data only in ways your employer has configured within the platform. Below is a plain-language explanation of each processing activity.
💰 Calculating and Processing Your Salary
We use your salary structure, statutory registration numbers, declared rent, and insurance details to calculate your gross pay, apply statutory deductions under the applicable Nigerian tax law (PAYE, Pension, NHF, NHIS, NSITF, ITF), and generate your payslip. Your net salary is then transferred to your bank account, and statutory taxes, VAT, and withholding tax may be remitted on your employer's behalf.
📍 Recording Your Attendance & Location
When you clock in or out using the MACH-HR app, we record the time and, if your employer has enabled it, your GPS location at that moment, using mapping and geolocation services to confirm you are within an approved work zone. This data is used to calculate your work hours and determine any late arrival or absence deductions.
🖥️ Productivity Monitoring
If your employer has enabled this feature on a company-managed device, we log website and application activity during work hours and summarize it (for example, most-visited domains) for your employer's review.
🏖️ Managing Your Leave
When you apply for leave, your request and any supporting documents are stored and routed through your employer's approval process. We track your leave balance, accruals, and carry-over as configured by your employer, and we may reference public holiday calendars to calculate working days.
📊 Performance Reviews and Misconduct
Your employer uses the platform to conduct performance appraisals, set goals, and record feedback. Where a formal misconduct case is raised, all details including the incident, investigation findings, any penalty applied, and your appeal (if submitted) are stored as a permanent record. Financial penalties, if applied, are automatically deducted from your next payroll run. Disciplinary records — including allegations, findings, penalties, responses, and appeals — are retained only for as long as necessary for legitimate employment, legal, regulatory, or dispute-resolution purposes, based on your employer's documented retention schedule, relevant limitation periods, possible legal claims, and any applicable statutory or regulatory requirements. Once no longer required, they are securely deleted or anonymised, except where preservation is required because of an ongoing investigation, legal claim, or other lawful retention requirement.
🤖 AI-Assisted Features
The platform may use AI tools to assist with activities such as applicant scoring, performance reviews, KPI suggestions, rating consistency checks, misconduct appeals, and responses to HR-related questions. Depending on the feature used, the information processed may include recruitment information, employment records, performance data, disciplinary information, and other relevant information provided through the platform. AI-generated outputs may include scores, summaries, recommendations, or suggested assessments, and may assist authorised persons in making decisions. Where an AI-generated output may materially affect an individual, that output is subject to appropriate human review and will not be used as the sole basis for a decision producing legal or similarly significant effects, except where permitted by law with the required safeguards in place. Where applicable under Section 37 of the NDPA 2023, you may request human intervention, provide additional information, express your point of view, or challenge a decision based on automated processing. MACH-HR will also provide appropriate information about the purpose of the AI processing, the significance of the output, and its possible effect on you.
💸 Managing Loans
If your employer offers staff loans, your loan application, guarantor details, repayment schedule, and monthly deductions are managed through the platform and processed automatically during payroll.
🧾 Accounting, Invoices & Bank Reconciliation
Where your employer uses the platform for financial accounting, invoicing, or bank reconciliation, your timesheet entries and billable hours may be included in client invoices and financial reports. If your employer connects a business bank account for reconciliation, or syncs records to an external accounting platform, related transaction data may be shared with that provider.
📁 Document Storage
Your employment contracts, certificates, and other official documents are stored securely in your digital employee file within the platform.
💬 Communication
If your employer has enabled the real-time chat module, messages sent within the platform are stored as part of the organizational communication record and are processed using our real-time messaging and notification providers.
📅 Calendar & Sign-In Integrations
If your employer enables Google or Microsoft sign-in, or connects a Google or Microsoft calendar, we exchange the minimum data needed to authenticate you and keep meetings or schedules in sync with your work calendar.
6. How We Protect Your Personal Data
We take the security of your personal data seriously. The following technical and organisational measures are in place to protect it.
Encryption
All data is encrypted while being transmitted over the internet (TLS 1.2 or higher) and while stored in our systems. Your payroll and financial data receives additional protection.
Secure Access
Only authorised personnel within your organisation can access your data, based on role-based permissions your employer has configured. Access is controlled, logged, and reviewed.
Audit Trails
Every action taken on your data — who accessed it, what was changed, and when — is recorded in a tamper-evident audit log.
Regular Backups
Your data is backed up automatically, stored securely, and can be restored in the event of a technical failure.
Infrastructure Security
Our platform is hosted on secure, professionally managed cloud infrastructure with a managed database service. We conduct regular security reviews.
Breach Notification
Where MACH-HR acts as processor, we will notify the controller (your employer) or engaging processor without undue delay on becoming aware of a breach, and provide the information the controller needs to meet its own statutory duties. Where MACH-HR acts as controller, we will notify the NDPC within 72 hours. Where a breach is likely to result in a risk to rights and freedoms and the statutory high-risk threshold is met, we will notify affected individuals directly.
Payment Security
Salary disbursements and subscription payments are processed through trusted payment infrastructure providers operating on PCI-DSS compliant infrastructure.
Staff Confidentiality
All Machi Kunzult staff with access to production systems are bound by confidentiality agreements and receive data protection guidance.
Your employer's responsibilities: While we implement robust security on our side, your employer is responsible for ensuring that only the right people in their organisation have access to your data, for choosing which optional modules and third-party integrations to enable, and for revoking access promptly when someone leaves.
7. Who We Share Your Data With
We do not sell your personal data. We do not share it for advertising or marketing purposes. Your data is shared only in the following circumstances.
7.1 Your Employer
Your employer has access to the data they have entered about you through the platform. What each person within your employer's organisation can see is controlled by your employer — they decide who has access to what. Machi Kunzult does not determine those boundaries; your employer does.
7.2 Technology Service Providers
To operate the platform, we use a number of trusted third-party technology service providers. All providers we work with are permitted to use your data only for the specific purpose of providing their service to us — none of them may use it for their own purposes or for advertising. These providers include:
- •Payment processing & disbursement
- •Statutory tax & pension remittance
- •Open banking & bank reconciliation (organisation-level bank connections)
- •Cloud infrastructure, hosting & database services
- •Secure file & document storage
- •Transactional email delivery
- •Real-time communication, chat & notifications
- •AI-assisted features
- •Calendar & single sign-on
- •Mapping & geolocation
- •Accounting integrations (only where enabled by your employer)
- •Public holiday reference data
All third-party providers we work with are carefully vetted and, where required, bound by data protection or processing agreements. We don't publish the specific vendor behind each category here, since our provider mix can change as we improve the platform. If you would like the current, named list of our third-party processors, you may request it by contacting us at support@machi-kunzult.com.
7.3 Legal Obligations
We may be required by Nigerian law, court order, or a regulatory authority to disclose certain data. In such cases, we will disclose only the minimum data necessary and will notify your employer as soon as we are legally permitted to do so.
7.4 What We Will Never Do
- Sell your personal data to any third party
- Share your data with advertisers or marketing companies
- Use your data to build profiles for any purpose outside your employer's HR management
- Transfer your data outside Nigeria without appropriate legal safeguards, as described in Section 7.5
- Allow AI or other service providers to use your personal data to train their own underlying models
7.5 International Data Transfers
Some of the service providers listed in Section 7.2 — including AI-assisted feature providers, calendar and single sign-on providers, messaging and notification providers, and optional accounting integrations — may process or store personal data outside Nigeria, depending on the provider and the location of its infrastructure.
Where personal data is transferred outside Nigeria, we will ensure that the transfer is made in accordance with Sections 41–43 of the NDPA 2023. Depending on the country and service provider involved, we may rely on an adequacy decision of the NDPC, an approved cross-border data transfer instrument, appropriate contractual or other recognised safeguards, or another lawful basis permitted under the Act. Where we act as a data processor, such transfers will also be carried out in accordance with our contractual obligations and the instructions of the relevant employer or organisation.
We will only transfer personal data that is necessary for the relevant service and will take reasonable steps to ensure that the receiving service provider applies appropriate security and data protection safeguards. Where reasonably available, information about the country or region in which personal data is processed and the safeguards applied to the transfer may be obtained by contacting us through our designated privacy or Data Protection Officer contact.
We also maintain appropriate records of cross-border transfers, including the service provider, destination of the transfer, categories of personal data involved, purpose of the transfer, applicable transfer mechanism, and relevant safeguards. These arrangements are reviewed periodically to ensure that personal data transferred outside Nigeria continues to receive an appropriate level of protection.
8. Monitoring Technologies
Your employer decides: All monitoring features described below are optional. They must be deliberately enabled by your employer. If you are unsure whether any of these are active in your organisation, ask your HR department.
GPS Location at Attendance
When you clock in or out, the app may record your GPS coordinates at that moment, checked against your employer's configured work zone using mapping and geolocation services. This is a snapshot — not continuous tracking. Your location is not monitored between clock-in and clock-out events unless your employer has enabled periodic verification checks.
Periodic Location Verification
Your employer may configure the system to periodically confirm that you remain within an approved work zone during your working hours. If enabled, these checks happen at intervals set by your employer. You will be informed by your employer if this feature is active.
Productivity and Website Activity Monitoring
If your employer has enabled the productivity monitoring module, the platform logs the websites you visit on your work device during work hours and generates summaries such as your most-visited domains, for your employer's review. This feature is off by default and can only be enabled by your employer for company-managed devices. Your employer is responsible for informing you if this monitoring is active.
Biometric Data
MACH-HR does not currently provide a live biometric attendance device integration. If biometric functionality is introduced in the future, biometric data will only be processed where there is an appropriate lawful basis and a valid condition for processing sensitive personal data under the Nigeria Data Protection Act 2023. Where consent is relied upon, it will be obtained in accordance with the Act. A Data Privacy Impact Assessment will also be carried out, and appropriate security measures will be put in place before biometric data is processed.
10. How Long We Keep Your Data
We keep your personal data for as long as your employer's subscription is active and for any additional period required by Nigerian law. The key retention periods are:
11. Your Rights
Under the Nigeria Data Protection Act 2023, you have certain rights in relation to your personal data. The way you exercise these rights depends on whether your employer or Machi Kunzult Ltd is responsible for the particular processing.
Right to Access
You may request access to the personal data held about you and obtain a copy of that information, subject to applicable law.
Right to Rectification
You may request the correction of personal data that is inaccurate or incomplete.
Right to Erasure
You may request the deletion of your personal data where permitted by law. This right may be limited where the information must be retained for legal, regulatory, employment, or other lawful purposes.
Right to Restriction of Processing
You may request that the processing of your personal data be restricted in circumstances permitted by law. Where processing is restricted, the information may be retained but its further use will be limited unless there is a lawful reason to continue processing it.
Right to Object
You may object to certain processing of your personal data, including processing based on legitimate interests or monitoring activities, where permitted by law.
Right to Data Portability
Where applicable, you may request to receive personal data you have provided in a structured, commonly used, and machine-readable format, or request that it be transferred to another organisation where technically possible.
Right to Withdraw Consent
Where we or your employer rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal of consent will not affect processing that was lawfully carried out before the withdrawal.
Rights Relating to Automated Decisions
Where a decision that produces legal or similarly significant effects is made solely through automated processing, you have the right, where applicable under the NDPA 2023, not to be subject to such a decision. You may also request human intervention, provide additional information, express your point of view, and challenge the decision.
How to Exercise Your Rights
Where MACH-HR processes your workforce, recruitment, or employment information solely on behalf of your employer, your employer is responsible for handling your request. You should therefore contact your employer's HR department or other designated contact. MACH-HR will assist the employer in responding to your request where required.
Where Machi Kunzult Ltd determines the purpose and manner of processing — including certain website, customer account, support, security, marketing, cookie, or other corporate processing activities — you may exercise your rights directly by contacting our Data Protection Officer or privacy contact (see Section 14).
Privacy Complaints and Grievances
If you have a concern about how your personal data has been processed, you may first raise the matter with your employer, where the employer is responsible for the processing, or with Machi Kunzult Ltd's Data Protection Officer where Machi Kunzult Ltd is responsible for the processing. Where appropriate, you may also submit a Data Subject's Standard Notice to Address Grievance (SNAG). Using an internal grievance process does not prevent you from lodging a complaint with the Nigeria Data Protection Commission or exercising any other right or remedy available under applicable law.
12. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, processing activities, legal requirements, or data protection practices. Where a change is significant — such as the collection of new categories of personal data, the introduction of new monitoring features, or the sharing of personal data with new third parties — we will provide appropriate notice before the change takes effect.
Where MACH-HR acts as a data processor, we will notify the relevant employer or organisation of material changes so that it can provide any necessary information to affected individuals. Where Machi Kunzult Ltd acts as the data controller, we will communicate material changes directly to affected individuals where appropriate.
If a new processing activity requires consent or any other specific legal step under the NDPA 2023, the required consent or other lawful basis will be obtained or established before the new processing begins. Continued use of the platform will not, by itself, be treated as consent to new processing activities that require consent.
The “Last Updated” date at the top of this document shows when the policy was last revised.
13. Children and Young Workers
MACH-HR is primarily intended for use in managing employees and other authorised workplace users. However, an employer may in some circumstances use the platform to process personal data relating to young workers, apprentices, interns, or other persons who may be under the age of 18.
Where personal data relating to a child or a person lacking legal capacity is processed, the employer and MACH-HR will ensure that the processing is carried out in accordance with the NDPA 2023 and other applicable laws. Where consent is relied upon as the lawful basis for processing, the required consent will be obtained from the appropriate person in accordance with the law.
14. Contact Us
If you have a question about this Privacy Policy, wish to exercise your data protection rights, make a privacy complaint, submit a Data Subject's Standard Notice to Address Grievance (SNAG), or raise any other data protection concern relating to processing for which Machi Kunzult Ltd is responsible, you may contact our Data Protection Officer through our dedicated privacy contact below.
Data Protection Officer / Privacy Contact
Company
Machi Kunzult Ltd
Phone
+234 803 607 9526Address
3rd Floor, 35 Olowu Street Ikeja, Lagos, Nigeria
Where your employer is the data controller for your employment or workforce information, you may also contact your employer's HR department or Data Protection Officer directly.
Nigeria Data Protection Commission
If you are not satisfied with how we or your employer handles your privacy complaint or data protection request, you may lodge a complaint with the regulatory authority:
Website
https://ndpc.gov.ngLegal Framework
Nigeria Data Protection Act (NDPA) 2023
Our Commitment
Your personal data is entrusted to us through your employer. We take that responsibility seriously. We will never use your data beyond what is necessary to provide the HR management services your employer has subscribed to, and we will always handle it in accordance with the Nigeria Data Protection Act 2023.