Draft for Nigerian legal and licensed DPCO review. Version DRAFT-0.1-2026-09-29. Do not use this notice to load live staff or applicant data until the controller identity, contacts, lawful bases, processors and retention schedule are approved.
Aboveboard HOME Employee and Applicant Privacy Notice
Controller and scope
The final notice will identify each Aboveboard legal entity acting as controller for its staff and applicants, the Group coordinating entity, the responsible privacy contact and the Data Protection Officer or privacy lead. It covers employees, workers, directors, applicants, referees, dependants and emergency contacts whose information is processed through HOME.
Information handled
- identity, contact, employment, role and reporting information;
- attendance, leave, performance, training and disciplinary records;
- payroll, bank, tax, pension and benefit information when production modules are approved;
- recruitment, interview, referee and onboarding information;
- account, access, device, security and audit logs; and
- health, disability or other sensitive information only where necessary and lawfully authorised.
Purposes and indicative lawful bases
| Purpose | Basis requiring final validation |
|---|---|
| Recruitment and employment administration | Steps before contract and performance of employment contract |
| Payroll, tax, pension, workplace and reporting duties | Legal obligation and contract |
| Security, audit, fraud prevention and business continuity | Legal obligation and legitimate interests balanced against staff rights |
| Health, safety and reasonable accommodation | Applicable employment, health or other lawful condition for sensitive data |
| Optional communications not needed for employment | Consent only where freely given and easy to withdraw |
Employment processing must not be described as consent-based where staff do not have a genuine choice. The approved processing inventory will assign one lawful basis to each purpose.
Access and sharing
Access is limited by role, business unit and need to know. Data may be shared with approved payroll, pension, tax, benefits, background-check, hosting, backup, professional-adviser and regulator recipients only where necessary and documented. Every processor must be approved and covered by a written data processing agreement. International access or storage requires a recorded transfer assessment and safeguard.
Retention and deletion
The Group retention schedule will set the period, trigger, owner and disposal method for each record. HOME must not retain records merely because storage is available. Account closure, restriction and legal erasure are separate states. A deletion request is identity-verified, mapped across the account and linked HR/payroll records, checked for legal duties and third-party rights, restricted first, and then erased or anonymised only where authorised. Legal holds suspend routine deletion only for the affected records and period. Backup restoration must replay completed deletion instructions so eligible data does not silently return.
Security and monitoring
HOME uses role-based access, secure password hashing, login throttling, secure session cookies on HTTPS, server-enforced inactivity and absolute session expiry, user and administrator revocation, audit trails, restricted administration and security headers. Production also requires MFA, encrypted off-server backups, a restoration test, patching, monitoring and periodic access review. Monitoring must be proportionate and disclosed.
Individual rights
Subject to applicable law, individuals may request information and access, correction, deletion, restriction, objection, portability and withdrawal of consent. The Security & Data Rights screen registers a case and reference. Requests are verified proportionately, logged and handled against a 30-calendar-day internal response target, subject to the DPCO's legal assessment. A response explains what was completed, restricted or lawfully retained. Individuals may complain to the Nigeria Data Protection Commission.
Automated decisions
HOME must not make a solely automated employment decision with significant effect unless Legal, HR and the DPCO approve the lawful basis, safeguards, human review and notice. Current scores and dashboards support human decisions only.
Incidents and contact
Suspected loss, unauthorised access or disclosure must be reported immediately through the approved internal incident channel. The response team will contain the issue, preserve evidence, assess risk and make any required notifications. Final privacy and security contacts must be inserted before production.