Privacy Notice

1. Who we are

FieldBas Technologies Ltd is the data controller for personal data described in this notice. You can reach our Data Protection Officer at privacy@fieldbas.com.

FieldBas connects businesses that need physical work verified ("Clients") with vetted individuals who carry it out ("Field Partners"). For some processing — job instructions and results — the Client is an independent controller and their own privacy policy also applies.

2. Personal data we collect

Account data: name, phone number, email address, password (hashed), and role.

Identity data (Field Partners): Bank Verification Number (BVN) or National Identification Number (NIN), date of birth and gender returned by the verification, and the name matched against your profile. The government ID number is encrypted at rest and is never shown in the app or API — only the last four digits are visible.

Payout data (Field Partners): bank name, account number and account name, and payout history.

Location data: for a job you accept, the GPS coordinates, accuracy and timestamp captured when you check in and when you capture evidence. We do not track your location in the background or when you have no active job.

Work product: photos, notes, checklist answers and other evidence you submit for a job, including any metadata embedded in files.

Device and usage data: app version, device model, IP address, and diagnostic logs.

Communications: messages you send us and support requests.

3. Why we use it and our lawful basis

To create and operate your account and provide the service — performance of a contract.

To verify Field Partner identity and prevent fraud — legal obligation and legitimate interest in a trustworthy marketplace.

To match jobs to Field Partners by location and skills, and to validate check-ins against a job's geofence — performance of a contract.

To process payouts and keep financial records — performance of a contract and legal obligation.

To produce the verification report a Client relies on — performance of a contract with the Client.

To send you transactional messages (job offers, status, payouts) by SMS, WhatsApp, email or push — performance of a contract. Marketing messages, where sent, rely on your consent, which you can withdraw at any time.

To secure the platform, investigate incidents and comply with law — legitimate interest and legal obligation.

4. Identity verification

Field Partner identity is checked through a licensed verification provider (currently Dojah) using your BVN or NIN. We send the number to the provider to confirm it is valid and that the name matches your profile; we receive back your name, date of birth, gender and registered phone number.

We store the ID number encrypted so that, only in a documented fraud investigation, an authorised officer can retrieve it for law enforcement. Access is permission-gated and logged.

5. Sharing

With the Client whose job you performed: your first name, the verification result, and the evidence and location data for that job. Clients do not receive your ID number, contact details or payout details.

With service providers under contract: identity verification (Dojah), payments (Flutterwave), cloud hosting, SMS and WhatsApp delivery, and error monitoring. They may only process data on our instructions.

With authorities: where required by law, court order, or to establish, exercise or defend legal claims, or to prevent fraud or harm.

In a corporate transaction: to a buyer or successor, subject to this notice.

We do not sell personal data.

6. International transfers

Some providers process data outside Nigeria. Where they do, we rely on adequacy decisions or contractual safeguards approved under the NDPA, and we limit what is transferred to what is necessary.

7. Retention

Account data: for as long as your account is active and up to 6 years after closure for legal and tax records.

Verification reports, evidence and audit logs: up to 7 years, because Clients rely on them for their own regulatory obligations.

Encrypted ID numbers: for the life of the account plus the minimum period needed for fraud and legal purposes, then deleted.

Diagnostic logs: up to 90 days.

8. Your rights

Under the NDPA you may request access to your data, correction of inaccurate data, deletion, restriction or objection to certain processing, and portability of data you provided. You may also withdraw consent where processing is based on consent.

To exercise a right, email privacy@fieldbas.com. We will respond within one month. Some data — for example a verification report a Client is relying on, or records we must keep by law — may not be deletable on request.

You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

9. Security

We use encryption in transit and at rest for sensitive fields, role-based access controls, audit logging, and a least-privilege model for staff access. Evidence files are integrity-checked with a cryptographic hash at the point of capture. No system is perfectly secure; if a breach affects your rights we will notify you and the NDPC as required.

10. Children

The platform is not for anyone under 18. We do not knowingly collect data from children.

11. Changes

We may update this notice. Material changes will be notified in the app or by email before they take effect. The date below shows the current version.

12. Contact

Data Protection Officer, FieldBas Technologies Ltd, Lagos, Nigeria — privacy@fieldbas.com.