1. Introduction

Soft Alliance and Resources Limited (“Soft Alliance”, “we”, “our”, “us”, or “the Company”) takes the privacy and protection of Personal Data seriously. This Privacy Policy applies to Personal Data collected from or about You through SOFTSUITE and the SoftSUITE V2 customer-facing features (collectively, the “Service”).

SoftSUITE V2 is a Human Capital Management application that enables organizations and their authorized users to manage employee information, payroll, recruitment, onboarding, attendance, leave, claims, performance, employee self-service, reporting, and related workforce activities.

This Privacy Policy explains the Personal Data collected through the Service, how it is used, disclosed, stored, and protected, and the rights available to You under applicable law.

By accessing or using the Service, You acknowledge that You have read and understood this Privacy Policy.

2. Definitions

“Account” means a unique account or profile created for You to access SOFTSUITE.
“Company” refers to Soft Alliance and Resources Limited. For the purpose of the NDPA, the Company is the Data Controller for SOFTSUITE
“Country” refers to Nigeria.
“Consumer” means a natural person who is a Nigerian Citizen or an individual who is domiciled in Nigeria for other than a temporary or transitory purpose.
“Cookies” means small files placed on Your Device through SOFTSUITE to support functionality, authentication, security, preferences, and service analytics.
“Data Controller” means the person or organization that determines the purposes and means of processing Personal Data.
“Data Processor” means the person or organization that processes Personal Data on behalf of a Data Controller.
“Data Subject” means the identified or identifiable individual to whom Personal Data relates.
“Device” means a computer, mobile phone, tablet, or other device used to access SOFTSUITE.
“Employer” means the organization that uses SOFTSUITE to manage its employees, applicants, contractors, or other workforce members.
“NDPA” means the Nigeria Data Protection Act, 2023.
“NDPC” means the Nigeria Data Protection Commission.
“Personal Data” means any information relating to an identified or identifiable individual, including identity, contact, employment, payroll, banking, recruitment, attendance, leave, claims, performance, Account, and Usage Data processed through SOFTSUITE.
“Service” means the SoftSUITE V2 Human Capital Management application and its customer-facing features.
“Service Provider” means a third party engaged to support the hosting, operation, security, communications, authentication, payment, or maintenance of the Service.
“Usage Data” means technical and activity information collected automatically when SOFTSUITE is accessed or used.
“You” or “Your” means the individual accessing or using SOFTSUITE, including an employee, applicant, manager, administrator, contractor, or authorized representative.

3. Acceptance of Terms

We collect and process Personal Data in accordance with this Privacy Policy and applicable law. Where consent is required, we will obtain Your consent for the specified purpose.

BY ACCESSING OR USING SOFTSUITE OR SUBMITTING PERSONAL DATA THROUGH THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY.

IF YOU DO NOT AGREE WITH THIS PRIVACY POLICY, PLEASE DO NOT USE THE SERVICE OR SUBMIT PERSONAL DATA THROUGH IT.

4. Obtaining and Using Personal Data

4.1 Categories of Data Collected and Purpose of Processing

To provide the features of SOFTSUITE, we may collect and process the following categories of Personal Data:

Identity Information: Your full name, photograph, date of birth, gender, employee number, and other identifiers may be collected to create and maintain Your employee or applicant profile and verify Your identity.
Contact Information: Your email address, telephone number, residential address, and emergency contact details may be collected for Account administration, workforce communications, notifications, and support.
Account Credentials: Your username, encrypted password, authentication information, access rights, and login records are processed to authenticate You, secure Your Account, and manage access to the Service.
Employment Information: Your job title, department, work location, employment status, reporting line, grade, employment history, and contract details may be processed to manage Your employment records and workforce activities.
Payroll and Compensation Information: Your salary, allowances, bonuses, benefits, deductions, tax information, pension information, and payroll records may be processed to calculate and administer compensation and statutory deductions.
Banking Information: Your bank name, account name, account number, and payment records may be processed to facilitate salary payments, claims, reimbursements, and other authorized payments.
Statutory Information: Information required for tax, pension, insurance, National Housing Fund, employment, and other statutory or regulatory purposes may be processed to fulfil legal obligations.
Recruitment Information: Your curriculum vitae, qualifications, employment history, references, application records, interview assessments, and supporting documents may be processed to administer recruitment and onboarding.
Attendance and Leave Information: Your work schedules, attendance records, absences, leave requests, and approvals may be processed to administer attendance and leave.
Performance Information: Your goals, appraisals, assessments, feedback, and development records may be processed to support performance management.
Claims and Expense Information: Your expense claims, supporting documents, approval records, and reimbursement details may be processed to review and settle authorized claims.
Uploaded Documents: Identification documents, certificates, employment records, claim receipts, and other supporting documents may be processed for authorized human resource purposes.
Technical Information: IP address, Device information, browser type, operating system, login time, and access logs may be collected to operate and secure the Service, troubleshoot issues, monitor usage, and improve performance.
Support Requests and Correspondence: Information is collected when You contact us or Your Employer for assistance, submit an inquiry, make a complaint, or provide feedback.
Other Necessary Information: Other Personal Data may be processed where necessary to provide the Service, perform authorized workforce functions, or comply with legal and regulatory requirements.

Important Security Note: Access to employment, payroll, banking, and other confidential information processed through SOFTSUITE is restricted to authorized users and personnel based on assigned access rights and legitimate responsibilities.

4.2 Sources of Data

We obtain Personal Data from the following sources:

Directly from You: Information provided when accessing Your Account, updating Your profile, submitting requests, uploading documents, applying for employment, or otherwise using the Service.
Your Employer: Information provided by Your Employer and its authorized human resource personnel, payroll officers, managers, supervisors, and administrators.
Authorized Users: Information entered by managers, administrators, recruiters, supervisors, or other authorized users during approved workforce processes.
Integrated Systems: Information received from authorized payroll, banking, recruitment, attendance, benefits, authentication, and other systems connected to SOFTSUITE.
Service Providers: Information received from authorized providers supporting hosting, communications, authentication, payment processing, verification, and other operational functions.
Automated Technologies: Technical and Usage Data collected through cookies, access logs, security-monitoring tools, and similar technologies.

4.3 Automatically Collected Data and Cookies

We may use cookies and similar technologies to maintain user sessions, support authentication, remember usernames or preferences, protect the Service, analyze usage patterns, and improve functionality. Technical information such as IP address, browser type, Device information, operating system, access time, and activity logs may be collected automatically when You use SOFTSUITE.

Where required by law, non-essential cookies will be used only after obtaining Your consent.

5. Non-Personal Information

Non-Personal Information may be collected, processed, and used in accordance with applicable law. Aggregated or anonymized data collected through SOFTSUITE may be used to monitor platform performance, analyze workforce and usage trends, improve the Service, strengthen security, develop reports, and support operational planning. We will not attempt to identify You from properly anonymized information unless permitted or required by law.

6. Data Controller and Data Processor Roles

Where Your Employer determines why and how Your Personal Data is processed through SOFTSUITE, Your Employer acts as the Data Controller and Soft Alliance acts as a Data Processor on its behalf. Soft Alliance may act as a Data Controller where it independently determines the purposes and means of processing, including for Account security, service administration, technical support, billing, legal compliance, and protection of its systems. Requests concerning employment records should ordinarily be directed to Your Employer. We may refer a request to Your Employer where it is responsible for determining how the relevant Personal Data is processed.

8. Data Storage, Retention and Location

Data Storage: Personal Data processed through SOFTSUITE is stored on authorized systems and infrastructure using appropriate technical and organizational safeguards.
Cross-Border Transfers: Where Personal Data is transferred outside Nigeria, the transfer will comply with applicable provisions of the NDPA and be protected by appropriate legal, contractual, and security safeguards.
Retention: Personal Data is retained only for as long as necessary to provide the Service, administer workforce and payroll activities, maintain employment and financial records, resolve disputes, enforce agreements, and comply with legal or regulatory obligations. At the end of the applicable retention period, Personal Data will be securely deleted, anonymized, or returned to the relevant Data Controller, subject to contractual, legal, technical, and backup requirements.

9. Technical Security and Confidentiality

We implement commercially reasonable technical and organizational safeguards to protect Personal Data processed through SOFTSUITE. These safeguards include encryption in transit, access controls, authentication mechanisms, role-based permissions, activity logging, security monitoring, and backup procedures designed to maintain the confidentiality, integrity, and availability of Personal Data. Access is restricted to authorized persons who require it for legitimate and approved purposes.

10. Location Information

Our mobile application may collect and process your device's location information when you use location-enabled features of the application. Location data is collected to support and facilitate workforce and attendance management functionalities, including:

Geo-fencing: To determine whether you are within an authorised geographical area or designated workplace location.
Geo-location: To verify and record your location in connection with applicable workforce management activities.
Clock-in/Clock-out: To validate and record attendance based on your location at the time of clock-in or clock-out.

Location information is used only for the purposes for which it is collected and in accordance with applicable laws and our data protection obligations. Where location access is required for a particular functionality, the application may request permission to access your device's location services.

Depending on the functionality being used, location data may be collected while the relevant feature is active and may be associated with your employee or user account and attendance records. You may manage location permissions through your device settings; however, disabling location access may prevent certain location-dependent features, such as geo-fencing and location-based clock-in/clock-out, from functioning correctly.

11. Legal Bases for Processing Your Personal Data

Under Section 25 of the NDPA 2023, Personal Data is processed through SOFTSUITE on one or more of the following legal bases:

Performance of a Contract: Where processing is necessary to provide the Service, manage Accounts, administer employment-related activities, or take steps at Your request.
Compliance with Legal Obligations: Where processing is necessary to comply with employment, payroll, tax, pension, financial reporting, audit, data-retention, regulatory, or other legal obligations.
Legitimate Interests: Where processing is necessary to operate, maintain, secure, and improve SoftSUITE V2, prevent fraud and misuse, troubleshoot technical issues, maintain records, and support authorized workforce administration, provided these interests do not override Your rights and freedoms.
Consent: Where required, we rely on Your consent for a specified processing activity, including non-essential cookies or optional communications. You may withdraw consent at any time without affecting processing lawfully carried out before withdrawal.
Protection of Vital Interests: Where processing is necessary to protect Your life, health, or safety, or that of another person.
Public Interest or Official Authority: Where processing is necessary for a task carried out in the public interest or in the exercise of official authority.

12. Links to External Sites

SOFTSUITE may contain links to third-party websites or services. We do not control and are not responsible for their content, security, or privacy practices. We encourage You to review the privacy policies of any third-party websites You visit.

13. Your Statutory Rights as a Data Subject

Subject to the NDPA 2023 and applicable limitations, You may exercise the following rights:

The right to request access to Your Personal Data and information about its processing.
The right to request correction of inaccurate or incomplete Personal Data.
The right to request deletion of Personal Data where there is no lawful reason for continued processing.
The right to object to or request restriction of processing where permitted by law.
The right to withdraw consent without affecting processing lawfully carried out before withdrawal.
The right to receive or request the transfer of Your Personal Data where applicable.
The right not to be subject to certain decisions based solely on automated processing where applicable.
The right to lodge a complaint with the Nigeria Data Protection Commission.
Any other right available under the NDPA 2023 or applicable regulations and guidelines.

Where Your Employer is the Data Controller, requests concerning Your employment, payroll, recruitment, attendance, performance, or other workforce records should ordinarily be submitted to Your Employer. Soft Alliance will provide reasonable assistance to the relevant Data Controller in responding to valid requests.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, our processing practices, or applicable legal requirements. Changes will be published with a revised “Last Updated” date. Where required by law, we will provide additional notice or obtain Your consent before a material change takes effect.

15. Contact Us and Grievances

If You wish to exercise Your data protection rights, submit a complaint, or raise a privacy concern, You may first contact Your Employer where the matter relates to Your employment records or Your Employer's use of SOFTSUITE.

You may also contact the Soft Alliance Data Protection Officer or privacy desk through the following details:

Soft Alliance and Resources Limited
Plot 9, NERDC Road Ojuolape House, Central Business District (CBD) Alausa.
P.O. Box 17309 Ikeja, Lagos.
Support Email: info@softsuite.com
Phone: +234 701 999 933

Please provide sufficient information to identify Your Account and explain Your request. Additional information may be requested to verify Your identity before acting on the request. If You are dissatisfied with the handling of Your complaint, You may lodge a complaint with the Nigeria Data Protection Commission.

Learn about our Privacy Policy