Privacy Policy
Last updated: September 2026
1. Introduction
Welcome to Aquafuji. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our internal operations and management platform (the "Platform"), which supports employee management, vehicle logbook tracking, production and inventory workflows, recruitment, and related business operations for our Lagos-based wellness and hydration company.
This policy is made in accordance with the Nigeria Data Protection Act, 2023 and the Nigeria Data Protection Regulation (NDPR) 2019, as issued by the Nigeria Data Protection Commission (NDPC).
Important: Data Controller vs Data Processor
For your business data: Aquafuji (the company) is the Data Controller for the personal data of its employees, job applicants, and customers entered into the Platform.
For account & platform data: Aquafuji is the Data Controller for information needed to provide and secure the Platform (login credentials, usage data).
2. Information We Collect
We collect and process the following categories of personal data through the Platform:
Account & Authentication Data
- Full name and email address
- Encrypted password
- Account role (company owner, employee, support agent)
- Login timestamps and session data
Employee Data
- Personal details (name, date of birth, gender, contact information)
- Identification numbers (Tax Identification Number, BVN, Pension PIN)
- Bank account details (encrypted)
- Employment records, job title, department, and role
- Emergency contact information
- Attendance, time tracking, and shift schedules
Vehicle & Logistics Data
- Vehicle registration and assignment records
- Driver mileage logs and trip details
- Trip purpose, start/end locations, and odometer readings
Recruitment & Job Applicant Data
- Applicant name, email, phone number, and address
- Uploaded CVs and cover letters
- Interview schedules, scores, and evaluation notes
- Application status and correspondence
Customer & Sales Data
- Customer name, email, phone, and delivery address
- Order history and transaction records
- Sales representative assignments and interactions
Usage & Technical Data
- IP address and browser information
- Pages visited and features used within the Platform
- Activity logs for audit and security purposes
3. How We Use Your Information
We use the collected information for the following purposes:
Core Business Operations
- Managing employee records, payroll, and HR functions
- Tracking vehicle assignments and driver mileage for operational reporting
- Managing production orders, inventory, and warehouse operations
- Processing customer orders and sales activities
Recruitment
- Processing job applications and evaluating candidates
- Scheduling and conducting interviews
- Communicating with applicants regarding their application status
Platform Security & Compliance
- Authenticating users and securing access to the Platform
- Maintaining audit trails for accountability and fraud prevention
- Fulfilling legal and regulatory obligations under Nigerian law
4. Legal Basis for Processing
Under the Nigeria Data Protection Act, 2023, we process personal data based on the following lawful bases:
Contract Performance
Processing employee and customer data necessary to fulfil employment contracts, sales orders, and service agreements.
Legal Obligation
Complying with Nigerian tax, employment, and regulatory requirements, including PAYE filings with FIRS and statutory remittances.
Legitimate Interests
Platform security, fraud prevention, audit logging, and operational improvement of our business processes.
Consent
For job applicants submitting CVs and for optional communications, we rely on your explicit consent, which you may withdraw at any time.
5. How We Share Your Information
We do not sell your personal data. We may share it only in the following circumstances:
Regulatory & Statutory Bodies
We may share data with Nigerian government agencies as required by law, including the Federal Inland Revenue Service (FIRS) for tax filings, pension administrators (PFAs), and other statutory bodies where legally obligated.
Service Providers
We use trusted third-party providers to deliver the Platform:
- • Payment processors (Stripe): For subscription billing — we do not store your card details.
- • Email delivery (Resend): For sending notifications, invitations, and platform emails.
- • Cloud hosting & storage: For secure data storage and infrastructure.
All service providers are bound by data protection agreements and process data only on our instructions.
Internal Access
Access to personal data within the Platform is restricted based on role (company owner, employee, support agent) and department assignments. Employees only see data relevant to their role and department.
6. How We Protect Your Data
We implement industry-standard security measures to protect the personal data processed through the Platform:
Encryption
- • SSL/TLS for all data in transit
- • Encryption for sensitive fields (bank details, credentials)
- • Password hashing
Access Controls
- • Role-based access permissions
- • Two-factor authentication (optional)
- • Principle of least privilege
- • Activity logging and audit trails
Infrastructure
- • Secure cloud hosting
- • Regular backups
- • Security updates and patching
Monitoring & Breach Response
- • Continuous security monitoring
- • Incident response procedures
- • Breach notification to the NDPC and affected individuals where required
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by Nigerian law:
Active Employment
Employee data is retained for the duration of employment and the legally required period thereafter.
Job Applicants
Unsuccessful applicant data is retained for up to 12 months after the recruitment process concludes, unless a longer period is required or consented to.
Account Closure
Account data is deleted within 30 days of account closure, except where retention is legally required.
Legal Requirements
Certain records (e.g., tax and payroll records) are retained for the period required by Nigerian law (typically 6 years for tax records).
8. Your Privacy Rights
Under the Nigeria Data Protection Act, 2023, you have the following rights regarding your personal data:
Right of Access
Request a copy of the personal data we hold about you
Right to Rectification
Correct inaccurate or incomplete personal data
Right to Erasure
Request deletion of your personal data where lawful
Right to Object
Object to processing for direct marketing or legitimate interests
Right to Withdraw Consent
Withdraw consent for processing based on consent at any time
Right to Data Portability
Receive your data in a structured, machine-readable format
To Exercise Your Rights:
Submit a request through our contact form or email us directly. We will respond within the timeframe required by the Nigeria Data Protection Act.
Lodge a Complaint:
If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
10. Children's Privacy
The Platform is intended for use by Aquafuji's employees, authorised staff, and job applicants who are 18 years of age or older. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us so we can delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. We will notify users of material changes by posting the updated policy on the Platform and updating the "Last updated" date below.
We encourage you to review this policy periodically to stay informed about how we protect your data.
12. Contact Us
If you have questions, requests, or comments about this Privacy Policy or your personal data, please contact us:
Aquafuji
Lagos, Nigeria
Email: service@projah.com
Submit an Inquiry
We respond within 24-48 hours