Privacy Policy

Plugin Agency Limited ("Plugin", "we", "our" or "us") operates Plugin, a marketplace through which clients hire verified professionals, including designers, developers, marketers, tradespeople and event vendors, through WhatsApp and our web platform. We are committed to protecting your privacy and to handling your personal data lawfully, fairly and transparently. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have.

This Policy applies to everyone who uses our WhatsApp service, our website at https://www.pluginafrica.org our web platform and any related services (together, the "Services"), including people who request and pay for work ("Clients") and people who offer their services through Plugin ("Professionals"). Other words beginning with a capital letter, such as "Job", "User" and "Payment Partner", have the meanings given to them in our Terms of Use.

Plugin Agency Limited, of 258 Borno Way, Ebute Metta, Lagos, Nigeria, is the data controller responsible for your personal data, and you can contact us using the details in Section 12. This Policy is issued pursuant to the Nigeria Data Protection Act 2023 (the "NDPA"), the General Application and Implementation Directive issued under it, and other applicable data protection laws.

Before you use the Services, we ask you to read this Policy and to confirm that you accept our Terms of Use and this Policy. Where we rely on your consent for a particular use of your personal data, we say so below, and you may withdraw that consent at any time.

Our Services are not directed at persons under 18 years of age, and we do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and become aware that a minor has provided us with personal data, please contact us using the details in Section 12 so that we can delete it.

1.1Information you provide to us

When you register, use the Services or contact us, we collect the following information:

• All Users: your name, WhatsApp phone number, city or area and, if you choose to provide it, your email address.
• Clients: details of the work you need, including job descriptions, budgets, the address or location where work is to be carried out, and any files you share.
• Professionals: your National Identification Number (NIN); your bank account details (bank name, account number and account name); your portfolio and samples of your work; links to your social media profiles, including private profiles, which you provide so that we can verify your work; your skills, service categories, pricing and availability; and, if you operate as a registered business and ask to be paid into the business's bank account, the business's name, its registration number with the Corporate Affairs Commission ("CAC") and evidence that you are a proprietor, partner or director of the business.
• Waitlist: before the Services launch, if you join our waitlist on our website, your email address, whether you are joining as a Client or a Professional, which sign-up form you used, the date and time you joined and, if you are joining as a Professional, up to three (3) service categories that you choose or type in.
• Communications: all messages, files, images and voice notes exchanged between Clients and Professionals through the Services, automatic transcriptions of those voice notes, and your communications with our support team.
• Transaction information: quotes, agreed job terms, amounts paid, fees, confirmations of delivery, refunds, dispute submissions and the outcome of disputes.
• Consent records: the version of our Terms of Use and this Policy that you accepted, and the date and time you accepted them.

We do not collect or store your card details. Card and bank payments are processed directly by our Payment Partner.

1.2Information we collect automatically

When you use the Services, we automatically collect certain technical information, including:

• your IP address and the browser information your device sends (such as browser type and operating system), when you use our website or web platform, which we use as described in Section 8;
• log data, such as the date and time of access, the pages viewed, the website that referred you and how long a page was open;
• security data, such as failed login attempts and unusual patterns of activity; and
• information that WhatsApp provides to us when you message us, namely your phone number, WhatsApp profile name and message metadata (such as delivery and read status).

1.3Information we obtain from third parties

We obtain information about you from the following third parties:

• our Payment Partner, which confirms whether payments succeed and returns the name registered to a Professional's bank account so that we can match it against the name on the Professional's NIN or, for a business bank account, against the business's registered name;
• identity verification providers and/or the National Identity Management Commission, which confirm the details associated with a Professional's NIN;
• the CAC's public register, which we search, directly or through identity verification providers, to confirm a business's registered name and registration number and that a Professional is a proprietor, partner or director of the business, where the Professional asks to be paid into the business's bank account;
• Meta Platforms, which operates WhatsApp, as described above; and
• other Users, for example where a Client provides feedback about a Professional or either party provides information in a dispute.

We only process your personal data where we have a lawful basis to do so under the NDPA. We use your personal data for the following purposes:

• To provide the Services, including creating and managing your account, matching Clients with Professionals, recording Jobs and sending service messages. Lawful basis: performance of our contract with you.
• To verify Professionals before they can receive Jobs or payouts, including verifying their NIN, matching their bank account name against their NIN name (or, where a Professional is paid into the bank account of a registered business, checking that the account name matches the business's name as registered with the CAC and that the Professional is a proprietor, partner or director of that business), and reviewing their portfolio and social media profiles. Lawful basis: the Professional's consent, which we ask for separately during onboarding. A Professional may withdraw this consent at any time, but if they do, we will not be able to verify them and they will not be able to receive, or continue to receive, Jobs or payouts. We may keep the verification records we already hold for the periods described in Section 5 where we need them to comply with the law, to prevent fraud or to deal with a legal claim.
• To process payments, including collecting, holding, releasing and refunding payments and keeping transaction records. Lawful basis: performance of our contract with you, and compliance with our legal obligations (including tax and financial record-keeping).
• To record, store and transcribe communications between Clients and Professionals, so that there is an accurate record of what was agreed and delivered for use in resolving disputes and investigating fraud, abuse or safety concerns. Lawful basis: performance of our contract with you, and our legitimate interests in resolving disputes fairly and protecting Users.
• To detect, prevent and investigate fraud, money laundering, abuse and other unlawful activity, and to keep the Services secure. Lawful basis: our legitimate interests in keeping the marketplace, the Services and Users safe, and compliance with legal obligations.
• To run our waitlist before the Services launch, including adding you to the waitlist, sending you a welcome email and updates about Plugin's launch and, if you are joining as a Professional, understanding the services you offer so that we can plan our launch. Lawful basis: your consent, which you give when you join the waitlist. You may withdraw it at any time by replying "unsubscribe" to any of our emails, by using the unsubscribe option where an email provides one, or by contacting us, and we will then remove you from the waitlist.
• To send you marketing messages about Plugin and Plugin4Good. Lawful basis: your consent, which you may withdraw at any time by replying "STOP" on WhatsApp, by replying "unsubscribe" to a marketing email or by contacting us.
• To analyse and improve the Services, including counting visits to our website as described in Section 8, using aggregated or de-identified data wherever possible. Lawful basis: our legitimate interest in understanding how the Services are used so that we can improve them.
• To comply with the law and with requests from regulators, courts and law enforcement agencies, and to establish, exercise or defend legal claims. Lawful basis: compliance with legal obligations and our legitimate interest in establishing, exercising or defending legal claims.

Some personal data is required for the Services to work. Your WhatsApp phone number is needed to provide the Services to you and, if you are a Professional, your NIN and bank account details are needed for verification and payouts. If you do not provide information that we need to perform our contract with you or to comply with the law, we will not be able to provide the Services to you or, if you are a Professional, to verify you, send you Jobs or pay you. Joining the waitlist and receiving marketing messages are optional.

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. The automatic release of payment after the seven (7) day period described in our Terms of Use follows a timeline you agree to, you can prevent it by raising a dispute, and disputes are decided by a member of our team.

We do not sell your personal data.

We share your personal data only where necessary, and only with the following recipients:

• Clients and Professionals: when a Job is agreed, we share the information each party needs to carry it out, for example the Client's name, WhatsApp number and job location with the Professional, and the Professional's name, profile and portfolio with the Client. We never share a Professional's NIN or bank account details with Clients, and we do not display the private social media links that Professionals provide for verification.
• Payment Partner: any licensed payment service provider or bank we use, to process payments, payouts and refunds and to verify bank accounts.
• Meta Platforms, which operates the WhatsApp Business Platform through which the Services are delivered.
• Identity verification providers, the National Identity Management Commission and the CAC, to verify NINs and, where relevant, business registration details.
• Service providers acting on our behalf, including cloud hosting, data storage, email delivery, speech-to-text transcription, customer support and analytics providers, who may only process your data on our instructions and must keep it secure.
• Professional advisers, including lawyers, accountants and auditors, who are bound by duties of confidentiality.
• Regulators, tax authorities, law enforcement agencies and courts, where required by law or a lawful request, or where necessary to protect the safety of any person.
• Parties to a business transfer, such as a merger, acquisition, restructuring or sale of assets, provided they agree to protect your personal data in line with this Policy.

We require everyone who processes personal data on our behalf to do so under a written agreement containing appropriate data protection obligations.

Some of our service providers, including Meta Platforms (WhatsApp), certain cloud hosting and transcription providers, and the cloud database and email delivery providers that store our waitlist and website visit records and send our emails, process or may process personal data outside Nigeria. Where we transfer personal data outside Nigeria, we do so only in accordance with the cross-border transfer requirements of the NDPA, for example where the recipient country provides an adequate level of protection, where appropriate contractual safeguards are in place, where the transfer is necessary to perform our contract with you, or where you have consented to the transfer after being informed of the possible risks. Those risks include that the laws of some countries may not protect personal data to the same standard as the NDPA. You may contact us for more information about the safeguards we use.

We keep personal data only for as long as we need it for the purposes described in this Policy, unless a longer period is required or permitted by law. Our standard retention periods are:

• Account and profile information: for as long as your account is open and for two (2) years after it is closed.
• Professional verification information (NIN, bank and business registration verification results): for as long as the Professional's account is open and for two (2) years after it is closed.
• Messages, files, voice notes and transcriptions: for twelve (12) months after the Job is completed or, where a dispute is raised, for twelve (12) months after the dispute is closed.
• Transaction and payment records: for six (6) years after the end of the financial year in which the transaction took place, to meet our tax and financial record-keeping obligations.
• Marketing preferences: until you withdraw your consent or close your account.
• Waitlist information: until you unsubscribe or ask us to remove you, or six (6) months after the Services launch, whichever is sooner.
• Website visit records and security logs: for twelve (12) months.

We may keep personal data for longer where it is needed to respond to a legal claim or regulatory enquiry, to investigate fraud, illegal activity or misuse of the Services, or where a statutory retention period applies. At the end of the applicable retention period, your personal data will be securely deleted or anonymised. We review the data we hold regularly to ensure that it remains accurate, relevant and necessary.

We use appropriate technical and organisational measures to protect your personal data, including:

• limiting access to NINs, bank details and message records to authorised personnel who need that access for verification, payments or dispute resolution, and who are bound by duties of confidentiality;
• encrypting sensitive data, such as NINs and bank account details, in transit and at rest;
• processing payments through our Payment Partner, so that card details are not stored on our systems;
• logging access to personal data and regularly reviewing access permissions; and
• regularly testing our systems for security vulnerabilities and malware.

No system is completely secure. You are responsible for keeping your phone, SIM card and WhatsApp account secure. We will not be liable for any loss caused by unauthorised access to your personal data where we have taken all reasonable steps to protect it.

We maintain a procedure for dealing with personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within seventy-two (72) hours of becoming aware of it. Where a breach is likely to result in a high risk to your rights and freedoms, we will also inform you immediately, in plain language, and tell you what steps you can take to protect yourself.

If you become aware of a breach of personal data or believe that your account has been compromised, please contact us immediately using the details in Section 12.

Our website does not set cookies for visitors. The only cookies we use are set on the sign-in area used by Plugin's own staff, to keep authorised staff members signed in securely.

We count visits to our website without cookies and without storing anything on your device. For each visit to a page, we record:

• a random visit code, which is created when the page loads and is held only in your browser's memory for that page load;
• the page visited and the date and time of the visit;
• the host name of the website that referred you, if any (for example, "google.com"), but not the full address of the page you came from; and
• how long the page was open on your screen.

So that we can count how many different people visit each day without identifying them, we also record a visitor code. The visitor code is created by combining the current date in Lagos, your IP address and the browser information your device sends, and converting them into a shortened, one-way code using a secret key. The same browser therefore receives the same visitor code for one day and a different code the next day, so we cannot link your visits on different days. Your IP address is used only to create the visitor code and is not stored. We also use your IP address briefly, without keeping a record of it, to protect our website and forms from misuse, for example by limiting repeated requests.

We use this information only to understand how many people visit our website, which pages they view and how they found us, so that we can improve the website. We rely on our legitimate interest in understanding how our website is used, and we keep these records for the period described in Section 5.

If you are a Professional preparing a portfolio entry on our web platform, your draft is saved in your own browser's local storage until you submit it, so that you do not lose your work. The draft stays on your device and we do not receive it until you submit it. It is removed from your browser when you submit it, and you can also clear it at any time through your browser settings.

We process your personal data in accordance with the principles in the NDPA. In particular, your personal data will be:

• processed lawfully, fairly and transparently;
• collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes;
• adequate, relevant and limited to what is necessary for those purposes;
• accurate and, where necessary, kept up to date;
• kept for no longer than is necessary; and
• kept secure, using appropriate technical and organisational measures.

Subject to the NDPA, you have the right to:

• be informed about how we process your personal data and request access to the personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• object to, or request restriction of, the processing of your personal data;
• receive your personal data in a commonly used, machine-readable format, or ask us to transfer it to another controller;
• withdraw your consent at any time, where we rely on consent, without affecting the lawfulness of processing carried out before withdrawal;
• not be subject to a decision based solely on automated processing which produces legal or similarly significant effects concerning you; and
• lodge a complaint with the Nigeria Data Protection Commission (www.ndpc.gov.ng; email: info@ndpc.gov.ng).

To exercise any of these rights, please contact us using the details in Section 12. We may need to verify your identity before acting on your request. We will respond without undue delay and in any event within thirty (30) days.

If you have a complaint about how we handle your personal data, we encourage you to contact us first so that we can try to resolve it, but you may complain to the Nigeria Data Protection Commission at any time.

Some requests may affect our ability to provide the Services to you. For example, a Professional who asks us to delete their NIN or bank details will no longer be able to receive Jobs or payouts, and we may need to keep certain records, such as transaction records and records relating to an open dispute, for the periods described in Section 5.

You may opt out of marketing messages, including emails about our waitlist and launch, at any time by replying "STOP" on WhatsApp, by replying "unsubscribe" to any of our emails or using the unsubscribe option where an email provides one, or by contacting us.

The Services may contain links to third-party websites and services, including those of our Payment Partner. We are not responsible for the privacy practices or content of those third parties, and we encourage you to read their privacy policies.

If you have any questions, requests or complaints about this Policy or our handling of your personal data, please contact our Data Protection Officer at: Data Protection Officer, Plugin Agency Limited, 258 Borno Way, Ebute Metta, Lagos, Nigeria. Email: support@pluginafrica.org. WhatsApp: +234 907 610 8413.

We may update this Privacy Policy from time to time. Where we make material changes, we will notify you through WhatsApp, by email or on our website before the changes take effect and, where required, ask you to accept the updated Policy before you continue to use the Services. The "Last updated" date on this Policy shows when it was last changed.