Privacy Notice

This notice explains how EriWave Limited collects, uses, shares, protects, and retains personal data when you use EriWave as a worker, business owner, support contact, administrator, or website visitor.

EriWave helps businesses and workers create verified, signed employment records. We use personal data only for defined purposes connected with providing, securing, and supporting that service.

EriWave does not sell personal data.

EriWave Limited is responsible for deciding how personal data is used within the EriWave service.

Office: 23, Bisola Durosinmi Etti, Lekki Phase 1, Lagos State, Nigeria

Privacy questions: privacy@eriwave.com
General support: support@eriwave.com

Depending on how you use EriWave, we may collect:

• Account information, including your name, email address, phone number, role, workspace, and login activity.
• Business information, including a business name, CAC registration details, workspace information, and registry-verification status.
• Agreement information, including employment terms, responsibilities, salary terms, signatures, timestamps, and sealed-record identifiers.
• Worker-record information, including employment profiles, incident reports, responses, record requests, consent decisions, and access history.
• Identity-verification information, including a masked NIN, a protected keyed NIN reference, registered name, date of birth used to confirm 18+ eligibility, verification result, liveness result, face-match result, and verification timestamps.
• A liveness reference image processed transiently when it is needed for signing or another stated identity check.
• Support-contact information supplied for an agreement, including the person's name, role, phone number, email address, and acknowledgement status.
• Technical and security information, including limited device, session, network, rate-limit, and audit information.
• Communications sent to support, privacy, or operational teams.

EriWave is designed not to retain a raw NIN after verification.

A date of birth returned by the identity provider is used only to confirm that the person is 18 or older. EriWave stores the time that this check passed, not the date of birth itself.

The government photograph returned during NIN verification is used temporarily for comparison and is not intentionally saved to the EriWave database.

Employers do not receive a worker's raw NIN, government photograph, liveness selfie, face-match score, or liveness score.

We use personal data to:

• Create and manage EriWave accounts and workspaces.
• Verify the identity of owners, workers, and signers.
• Verify business registration details.
• Prepare, sign, seal, display, and preserve agreements.
• Give workers access to their agreements and work records.
• Obtain worker approval before disclosing the complete eligible EriWave employment-history snapshot shown for that request.
• Record who requested or accessed a worker record.
• Deliver invitations, security messages, and service communications.
• Prevent abuse, identity fraud, unauthorised access, and excessive provider use.
• Investigate support requests, security events, and complaints.
• Meet applicable legal, regulatory, and record-keeping obligations.

EriWave uses the lawful basis appropriate to each processing purpose. This may include taking steps requested before entering an agreement, performing a contract, meeting a legal obligation, protecting legitimate interests, and obtaining specific consent where required.

Identity and biometric processing receives additional protection because it can create greater risk to the individual. EriWave records the identity notice accepted by the user and the time of acceptance.

EriWave uses carefully selected service providers to operate the platform. These currently include:

• Dojah for Nigerian identity and business-registry verification.
• Paystack for hosted payment checkout, confirmation, refunds, disputes, and settlement reconciliation when online payments are enabled.
• Amazon Web Services for face liveness, face comparison, infrastructure, and security services used by EriWave.
• Email and messaging providers for invitations and service communications.
• Hosting, database, monitoring, and support providers needed to operate the service.

These providers may process personal data only for the service they provide and subject to appropriate contractual and security controls.

EriWave does not retain customer payment instruments, authorization objects, raw Paystack webhooks, webhook signatures, or full provider responses. It retains the company and owner link, reference, accounting amounts, terms version, normalized lifecycle events, and reconciliation state needed to confirm and account for a purchase.

Some service providers may process personal data outside Nigeria. Before production, EriWave will document where relevant processing occurs and the transfer safeguards used to protect the data.

Contact privacy@eriwave.com if you want information about the safeguards relevant to your data.

EriWave keeps personal data only for as long as it is needed for its stated purpose, a legitimate security need, an applicable legal requirement, or the establishment or defence of a legal claim.

NIN registry photographs and liveness reference images are used transiently for comparison and are not retained in EriWave user accounts.

Incident reports currently have a two-year product retention period. An expired incident must not be included in an external record disclosure.

EriWave uses access controls, encryption, protected identity references, short-lived tokens, rate limits, audit records, and restricted provider credentials to protect personal data.

No system can promise absolute security. If EriWave identifies a personal-data breach, it will investigate, contain, record, and notify affected people or the Nigeria Data Protection Commission where required.

Depending on the circumstances, you may ask EriWave to:

• Confirm whether your personal data is being processed.
• Give you access to your personal data.
• Correct inaccurate, incomplete, or misleading information.
• Delete information that is no longer required and has no other lawful basis for retention.
• Restrict processing while a request or dispute is reviewed.
• Consider an objection to processing.
• Record the withdrawal of consent where processing relies on consent.
• Provide human review of a decision based solely on automated processing that significantly affects you.

Visit Data Subject Rights and Complaints or email privacy@eriwave.com to make a request.

EriWave is designed for lawful employment and business-agreement use. It is not intended to collect a child's identity or biometric data without the legally required authority and safeguards.

If you believe a child's personal data has been submitted incorrectly, contact privacy@eriwave.com immediately.

Start by contacting privacy@eriwave.com so EriWave can investigate the concern.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission. Visit https://ndpc.gov.ng for current complaint information.

EriWave may update this notice when the product, providers, or legal requirements change. The page will always show its current effective date. Material changes affecting identity verification will require a new notice version and, where required, fresh acknowledgement.