Privacy notice

Who we are

[CAISE legal entity name], RC [number], of [registered office address], Nigeria (“CAISE”, “we”), runs this website and the CAISE HR and CAISE Spend services. This notice explains how we handle personal data under the Nigeria Data Protection Act 2023 (NDPA) and the regulations of the Nigeria Data Protection Commission (NDPC).

Our Data Protection Officer is [Data Protection Officer name], [dpo email address]. Contact them about anything in this notice.

Two roles we play

• Controller for data about website visitors, enquirers, our customers' account administrators and billing contacts.
• Processor for the employee, payroll and expense data our customers put into CAISE HR and CAISE Spend. The customer (the employer) is the controller of that data and decides why it is processed. We process it only on their instructions, under a data processing agreement. Employees with questions about their own records should first contact their employer.

What we collect

• Enquiries: name, work email, company, phone number, team size and your message, when you use the contact form or email us.
• Accounts: name, email, role, sign-in history, two-step sign-in settings and, if you use it, the Google or Microsoft account linked to your login.
• Customer data in CAISE HR (as processor): employee identity details (including NIN and BVN where the employer records them), contact and address details, next of kin and dependants, bank details, salary, tax, pension and statutory identifiers, leave, attendance, performance and documents.
• Customer data in CAISE Spend (as processor): expense claims, receipts, bank details for refunds, card and budget records.
• Technical data: IP address, browser and device details, and request logs, used to run and secure the services.
• Billing: billing contact, invoices and payment references.

Why we use it, and our lawful basis

• To answer enquiries and send quotes: your consent and our legitimate interest in responding to people who contact us.
• To provide CAISE HR and CAISE Spend to customers: performance of our contract with the customer.
• To bill customers and keep accounting and tax records: legal obligation and contract.
• To keep the services secure, prevent fraud and investigate misuse: legitimate interest and legal obligation.
• To send product and service emails (for example payslip notices or approval requests): performance of the contract with the employer.
• Marketing emails only with your consent; you can withdraw it at any time.

Optional automated features, such as reading the details on an uploaded receipt, are used only to fill in forms for the person to check. We do not make decisions with legal or similarly significant effects about people solely by automated means.

Who we share it with

We do not sell personal data. We share it only with service providers who help us run CAISE, under contracts that require them to protect it, and only as far as needed:

• Hosting and infrastructure: [hosting providers and locations].
• Email delivery: [email provider, e.g. Zoho ZeptoMail].
• Receipt reading (only when a customer turns it on): [AI provider].
• Payment processing, once enabled: [payment provider].
• Card issuing, for customers who use CAISE Spend cards: [card partner].
• Authorities, where the law requires it.

When customers use CAISE HR to prepare statutory files (for example PAYE, pension or NHF schedules), they send those files to the authorities themselves.

Transfers outside Nigeria

[Describe where data is stored and any transfer outside Nigeria.] Where personal data is transferred outside Nigeria, we rely on the grounds allowed by Part VIII of the NDPA, such as an adequacy decision of the NDPC or appropriate safeguards in our contracts.

How long we keep it

• Enquiries that do not become customers: [24 months] after the last contact.
• Customer account and billing records: for the life of the contract and [6 years] after, to meet tax and accounting law.
• Customer payroll and HR data: as the customer instructs; deleted or returned within [90 days] of the contract ending, unless the law requires us to keep it.
• Security logs: [12 months].

How we protect it

Role-based access, two-step sign-in, approval controls, audit logs and support access that the customer must grant. Read more on our security page. If a personal data breach is likely to put people at risk, we notify the NDPC within 72 hours of becoming aware of it, and tell affected people and customers without undue delay.

Your rights

Under the NDPA you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete data we no longer have a reason to keep;
• restrict or object to some processing, including direct marketing;
• send your data to you or another organisation in a portable format;
• withdraw consent where we rely on it.

Email our Data Protection Officer at [dpo email address]. We reply within 30 days. If your data is held by your employer in CAISE HR or CAISE Spend, we will pass your request to them and help them answer it. You can also complain to the Nigeria Data Protection Commission.

Cookies

This website uses only the cookies and storage needed to work. The apps store your sign-in on your device. If we add analytics, we will ask for your consent first and update this notice.

Changes

We will post any change to this notice here and, for significant changes, tell customers by email.