Privacy
policy.

Who we are

VettingMate Ltd ("VettingMate", "we", "us") is the data controller for personal data processed through the VettingMate platform, registered in Nigeria with the Corporate Affairs Commission (CAC). Where we run a check on behalf of an employer, landlord, letting agent or organisation (the "requesting party"), that party is the controller for their use of the results and VettingMate acts as processor or joint controller as set out in the relevant agreement.

You can reach our data protection lead at [email protected] or via the contact page.

What data we collect

Depending on the checks requested, we may process:

• Identity data, name, date of birth, addresses, identity document details and verification results.
• Contact data, email address, telephone number.
• History data, employment, education, qualification and reference information you or your referees provide.
• Screening data, results from credit reference, criminal record (via authorised channels), sanctions and other lawful sources, where a check requires it.
• Technical data, account credentials, usage logs, device and IP information needed to secure the service.

We collect the minimum necessary for the checks requested, and we do not sell personal data.

Lawful bases

We process personal data under the Nigeria Data Protection Act 2023 (NDPA) on the following bases:

• Consent, every verification check requires the subject's recorded consent before it runs.
• Contract, to provide accounts and services you request.
• Legitimate interests, fraud prevention, platform security and service improvement, balanced against your rights.
• Legal obligation, record-keeping and regulatory requirements.

Special category and criminal offence data is processed only where a lawful condition applies (e.g. explicit consent or other lawful conditions under the NDPA), with appropriate safeguards.

How we use data

We use personal data to: create and manage accounts; collect and record consent; perform requested verification checks; compile reports and Trust Scores; operate disputes and corrections; secure the platform; and meet legal obligations. We do not use your data for advertising, and automated scoring is always explainable and contestable, see our Trust Score methodology.

Who we share it with

Data is shared only with: the requesting party you have consented to; verification data sources (e.g. credit reference agencies, document verification providers, referees and institutions) strictly as needed to run the check; service providers acting under contract (hosting, communications); and authorities where legally required. A current list of subprocessors is available on request.

International transfers

We keep personal data in Nigeria wherever possible. Where a transfer outside Nigeria is necessary, it is protected by appropriate safeguards consistent with the NDPA's cross-border transfer requirements.

Retention

We keep personal data only as long as needed: consent records and audit trails for the life of the relevant relationship plus a defensible limitation period; check results for the period agreed with the controller; account data while your account is active. Our full retention schedule is set out on the data protection page.

Your rights

Under the NDPA you have the right to access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time (without affecting prior lawful processing). You can exercise most rights from your account, dispute a finding through the disputes channel, or email [email protected]. You also have the right to complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Security

We protect data with encryption in transit and at rest, role-based access, audit logging and the controls described on our security page. No method of transmission is 100% secure, but we design for breach resistance and will notify the NDPC and affected individuals of qualifying breaches as the law requires.

Changes & contact

We may update this policy; material changes will be notified through the platform or by email, with the version and date updated above. Questions, requests and complaints: [email protected] or via the contact page.