Data
protection.

Our commitment

VettingMate is built consent-first: no check runs without the subject's recorded agreement, every access is logged, and personal data is collected for specified purposes only. This page summarises how we meet our obligations under the Nigeria Data Protection Act 2023 (NDPA), and how you can exercise your rights. It complements the privacy policy and the controls on our security page.

Roles & responsibility

For checks run through the platform, the requesting party (employer, landlord, agent or organisation) determines the purpose and is the controller for their use of results. VettingMate acts as processor, or as an independent controller for platform operation, consent records and Trust Score operation, as set out in each agreement. Our data protection lead oversees compliance and can be reached at [email protected].

Data minimisation & purpose limitation

Each check type has a defined data set, and we collect nothing beyond it. Data obtained for one check is never reused for another purpose without a new lawful basis. Optional data fields are marked as such, and subjects can see exactly what a requesting party will receive before consenting.

Retention schedule

We keep personal data only as long as necessary, then delete or anonymise it. Indicative retention periods:

Shorter periods apply where the controller instructs, and deletion requests are honoured subject to legal holds.

Your rights & how to exercise them

You can exercise your NDPA rights at any time:

• Access, request a copy of your data (subject access request) via your account or [email protected].
• Rectification, correct inaccurate records from your account or via support.
• Erasure, request deletion where there is no overriding legal basis to retain.
• Restriction & objection, ask us to pause or stop specific processing.
• Portability, receive your data in a structured, machine-readable format.
• Withdraw consent, stop future checks at any time; completed checks remain as records of what was verified at the time.

We respond within one calendar month. Identity verification may be required to protect against fraudulent requests.

Disputes & corrections

If you believe a finding on your record is wrong, raise a dispute through your account or [email protected]. Disputed items are flagged while reviewed, re-verified against source where possible, and corrected or removed if found inaccurate. Requesting parties who received the report are notified of material corrections.

Subprocessors & transfers

We use vetted subprocessors for hosting, communications and verification data sources, all bound by written contracts with NDPA-standard clauses. Data is kept in Nigeria wherever possible; any international transfer follows the NDPA's cross-border safeguard requirements. A current subprocessor list is available on request.

Breach notification & complaints

Qualifying personal data breaches are reported to the NDPC within 72 hours and affected individuals are informed without undue delay where there is high risk. If you are unhappy with how we handle your data, contact us first, then you may complain to the Nigeria Data Protection Commission at ndpc.gov.ng.