DailyWorkman Privacy Policy

Data Controller	FridayTechnologies (operating as DailyWorkman)
Website	dailyworkman.com
Contact	support@dailyworkman.com
Governing Law	NDPR 2019 · NDPA 2023 · Nigerian Cybercrimes Act 2015
Regulatory Body	National Information Technology Development Agency (NITDA)
Effective Date	April 2026
Applies To	All users — Clients, Professionals, and Visitors

1. Who We Are & How to Contact Us

DailyWorkman is a digital marketplace platform that connects clients with construction and trade professionals across Nigeria. It is owned and operated by FridayTechnologies, a technology company registered in Nigeria.

Company Name	FridayTechnologies
Trading As	DailyWorkman
Website	dailyworkman.com  ·  fridaytechnologies.ng
Role Under NDPR	Data Controller — we determine the purpose and means of processing your personal data
Privacy Enquiries	support@dailyworkman.com
Contact Page	https://dailyworkman.com/pages/contact.php

2. What Personal Data We Collect

The personal data we collect depends on whether you are a Visitor, a Client, or a Professional.

2.1 Data Collected from All Users (Clients & Professionals)

Data Category	Specific Data Points	When Collected
Identity Data	First name, last name	Registration
Contact Data	Email address, phone number	Registration
Account Data	Password (hashed — never stored in plain text), role (Client/Professional), account status, active mode	Registration & account updates
Profile Data	Profile photo (avatar), biography/description, location (state, city, address)	Profile setup
Location Data	GPS coordinates (latitude/longitude) — with your permission	When location permission is granted
Usage Data	Pages visited, search queries, features used, timestamps	Continuous during Platform use
Device Data	Browser type, operating system, IP address, device type	Automatic on visit
Communications	Chat messages sent and received on the Platform	When you use the chat feature
Transaction Data	Order history, payment amounts, Escrow transactions, Service Fee records	When transactions occur

2.2 Additional Data Collected from Professionals Only

Data Category	Specific Data Points	Purpose
Professional Profile	Skills, service category, years of experience, hourly rate, service radius, availability status, headline	Profile creation & search visibility
Portfolio	Portfolio images (up to 9 photos of past work)	Displaying work history to Clients
Identity Verification (KYC)	BVN, NIN, Government ID (type + image), Selfie photo — see Section 3	Identity verification & fraud prevention
Financial Data	Bank name, bank code, account number, account name (verified via gateway), earnings balance, withdrawal history	Processing withdrawals
Payment Records	Onboarding fee payment reference, subscription payment history	Account activation & subscription management
Ratings & Reviews	Star rating, review count, review text received from Clients	Quality assurance & marketplace transparency

2.3 Data Collected from Visitors (Non-Registered)

If you visit DailyWorkman without registering, we collect only basic device and usage data (IP address, pages visited, browser type) for security monitoring and analytics. We do not collect personal identity data from visitors.

3. Sensitive Data — BVN, NIN & Identity Documents

3.1 What We Collect & Why

Sensitive Data	Why We Collect It	Legal Basis
BVN (11 digits)	To verify that a Professional is a real person with a valid Nigerian banking identity — reduces fraud and fake profiles	Consent (provided during KYC setup) + Legitimate interest in platform safety
NIN (11 digits)	Government identity confirmation — cross-references with national ID database	Consent + Legitimate interest
Government ID Image	Document-based identity verification — confirms the ID belongs to the person registering	Consent
Selfie / Liveness Photo	Biometric verification — ensures the person uploading documents matches the photo on the ID	Consent

3.2 How We Handle This Data

• BVN and NIN numbers are stored in our secure database and accessed only by authorised admin staff for KYC review.
• Government ID images and selfie photos are stored in a restricted uploads directory on our server, accessible only to authorised Company staff.
• This data is never sold or shared with third parties for commercial purposes.
• This data is shared with law enforcement or regulatory bodies only where required by Nigerian law.
• Once KYC is verified and the Professional's account is active, access to raw BVN/NIN data is restricted to senior administrative staff only.
• You may request deletion of your KYC data by closing your account — subject to our legal retention obligations (see Section 15).

4. How We Collect Your Data

We collect your personal data through the following means:

Method	Examples
Direct input by you	Registration forms, profile setup, KYC wizard, withdrawal request, chat messages, review submissions, contact form
Automatic collection	Server logs (IP address, timestamps), browser/device data, GPS coordinates (when you grant permission), typing indicators, last-seen timestamps
Payment gateway	Paystack and Flutterwave return transaction status, payment references, and (for withdrawals) account verification results to our Platform
Social login (if enabled)	Google, Facebook, or Apple may share your name and email address if you choose to log in using those services — subject to their own privacy policies
Third-party verification	For bank account verification, we query Paystack's account resolution API with your account number and bank code to confirm your account name before processing withdrawals

5. Why We Process Your Data (Legal Basis)

Under the NDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

Legal Basis	When We Rely on It
Consent	Processing of sensitive data (BVN, NIN, ID documents, selfie); push notification subscriptions; location access; marketing communications. You may withdraw consent at any time — see Section 16.
Contract	Processing necessary to create and manage your account, process Orders, handle Escrow payments, and facilitate withdrawals — all of which are necessary to provide you with the Platform's core services.
Legitimate Interests	Platform security and fraud prevention; keyword monitoring of chat messages to enforce our off-platform payment prohibition; analytics to improve the Platform; login alert notifications to protect your account.
Legal Obligation	Retaining financial transaction records as required by Nigerian law; responding to lawful requests from regulatory bodies (NITDA, EFCC, FIRS); complying with court orders.

6. How We Use Your Personal Data

6.1 To Provide the Platform

• Create and manage your account and profile.
• Display your Professional profile to Clients in search results.
• Enable messaging between Clients and Professionals.
• Process Orders, Escrow payments, and withdrawals.
• Enable location-based search — showing nearby Professionals to Clients.
• Deliver push notifications and in-app alerts about your orders, messages, and account activity.

6.2 For Safety & Fraud Prevention

• Verify Professional identities through the KYC process to reduce fake profiles and fraud.
• Monitor chat messages for restricted keywords (e.g. phone numbers, email addresses) to enforce our off-platform payment prohibition.
• Send login alert emails when a new login is detected from a new IP address.
• Review flagged messages and disputed transactions.
• Detect and investigate suspicious activity on the Platform.

6.3 For Communication

• Send transactional emails — order confirmations, payment receipts, withdrawal status updates, review notifications.
• Send security alerts — password resets, login notifications.
• Send platform announcements — policy updates, new features, service changes.
• Respond to your enquiries and support requests.

6.4 For Legal & Compliance Purposes

• Maintain records of financial transactions as required by Nigerian financial regulations.
• Respond to lawful requests from Nigerian regulatory authorities (NITDA, EFCC, CBN, FIRS).
• Enforce our Terms of Service and resolve disputes.
• Protect the legal rights and interests of FridayTechnologies and Platform users.

6.5 For Platform Improvement

• Analyse usage patterns to improve Platform features and user experience.
• Generate aggregated, anonymised analytics to understand Platform performance (these do not identify individual users).
• Assess the performance of regional operations (e.g. Calabar branch activity metrics).

7. Data Sharing & Third Parties

7.1 When We Share Your Data

We share your data only in the following circumstances:

Recipient	What Is Shared	Why
Other Platform Users	Your Professional profile (name, photo, skills, ratings, location, availability) is visible to Clients. Your name is visible to Professionals you have an Order or conversation with.	Core marketplace function — connecting Clients with Professionals
Paystack	Payment amount, your email, transaction reference. For withdrawals: your account number and bank code (to verify and transfer).	Payment processing and withdrawal execution
Flutterwave	Same as Paystack — depending on which gateway is active	Payment processing and withdrawal execution
Google / Facebook / Apple (if social login used)	We receive your name and email from them; we do not share data back to them from our platform	Social login authentication
Nigerian Regulatory & Law Enforcement Bodies	Identity data, transaction records, communications — only what is specifically requested	Compliance with lawful court orders, NITDA directives, EFCC investigations, or CBN requirements
FridayTechnologies Staff	Authorised staff access data strictly on a need-to-know basis for their assigned role (e.g. KYC reviewers see identity documents; finance staff see transaction records)	Platform operations and administration
Regional Managers (e.g. Calabar Branch)	Aggregated regional performance metrics — not individual user personal data	Regional business management

7.2 What We Never Share

• Your password (stored as a one-way hash — even we cannot see it).
• Your BVN or NIN number with any third party, except where required by Nigerian law.
• Your bank account details with any party other than Paystack/Flutterwave for the purpose of processing your withdrawal.
• Your private chat messages — except where flagged under our keyword restriction system and reviewed for Terms enforcement, or where required by law.
• Your personal data with advertisers — DailyWorkman does not run advertising and does not share data for ad targeting.

8. Payment Data & Financial Information

8.1 Card & Payment Details

DailyWorkman does not store your debit card, credit card, or bank card details on our servers. All card data is collected and stored exclusively by our payment processors (Paystack and/or Flutterwave), which are PCI-DSS compliant. We receive only a payment reference and a success/failure status from the gateway.

8.2 Escrow & Transaction Records

We maintain detailed records of all Escrow transactions (deposits, releases, refunds, partial releases) and all Order payment records. These records are retained for a minimum of 6 years from the date of the transaction in compliance with Nigerian financial record-keeping obligations.

8.3 Earnings Wallet

Your Earnings Wallet balance is stored in our database and represents funds released from Escrow. We record all credits and debits to your wallet including earnings credits, withdrawal debits, and any adjustments made following a dispute resolution.

8.4 Bank Account Details (Professionals)

When you add a bank account for withdrawals, we store your bank name, bank code, account number, and the verified account name (confirmed via Paystack's account resolution API). This information is used exclusively to process your withdrawal requests and is never shared with third parties for any other purpose.

9. Cookies & Tracking Technologies

9.1 What Cookies We Use

Cookie Type	Name / Purpose	Duration	Can You Opt Out?
Session Cookie	PHP session cookie — keeps you logged in during your visit	Session (expires when you close browser)	No — essential for Platform functionality
Persistent Login Cookie	Remembers your login for up to 30 days if you stay logged in	30 days	Yes — log out to clear it
CSRF Token	Security token to prevent cross-site request forgery attacks on forms	Session	No — essential for security
Flash Message	Stores one-time success/error messages between page loads	Single page load	No — essential for UX

9.2 What We Do Not Use

• We do not use advertising cookies or ad tracking pixels.
• We do not use Google Analytics or any third-party analytics tracker.
• We do not use Facebook Pixel or any social media tracking.
• We do not share cookie data with any advertising network.

9.3 Managing Cookies

You can disable cookies in your browser settings. However, disabling session cookies will prevent you from logging in to DailyWorkman. You can also clear cookies at any time by logging out or clearing your browser data.

10. Location Data

To enable the Platform's proximity-based search (showing Clients nearby Professionals), we may request access to your device's GPS location. Specifically:

• When you grant location permission, your GPS coordinates (latitude and longitude) are sent to our server and stored on your profile.
• For Professionals, your location is used to determine your distance from Clients searching in your area.
• You can revoke location permission in your browser or device settings at any time. If revoked, you can still manually enter your state and city on your profile.
• We do not track your location continuously in the background — location is only updated when you actively use the Platform with location permission granted.
• Your precise GPS coordinates are not displayed publicly. Clients see only your stated city/region, not your exact location.

11. Push Notifications

With your permission, DailyWorkman may send push notifications to your browser or device for Order updates, new messages, payment alerts, and platform announcements.

• Push notifications use the Web Push protocol with VAPID encryption — your notification data is encrypted in transit.
• We store your browser's push subscription endpoint and encryption keys in our database to deliver notifications.
• You can revoke push notification permission at any time in your browser settings or device notification settings.
• Revoking push permission does not affect your ability to use the Platform — you will still receive in-app notifications and emails.
• We do not sell or share your push subscription data with any third party.

12. Chat Messages & Communications

All chat messages sent through the Platform's messaging system are stored in our database. We process chat message content for the following purposes:

• Delivery: Storing and retrieving messages between Clients and Professionals.
• Keyword scanning: Automatically checking messages against a list of restricted keywords (including phone number patterns and email formats) to enforce our off-platform payment prohibition. This is an automated process — messages that trigger a keyword flag are hidden from the conversation and stored in a separate flag log for admin review.
• Dispute resolution: Where a dispute is raised, authorised Company staff may review the relevant conversation history as evidence.
• Legal compliance: We may be required by court order or law enforcement to provide chat records.

By using the chat feature, you acknowledge and consent to this processing. We do not read chat messages for any other commercial purpose.

13. User-Generated Content

Content you post on the Platform — including your Professional profile, bio, portfolio images, reviews you write, and Gig listings — may be visible to other users and to the public. Please do not include sensitive personal data (such as your phone number, home address, or financial details) in public-facing profile fields or Gig descriptions.

Reviews you write about other Professionals are attributed to your account name and displayed publicly. You may not withdraw a published review unless the Company removes it following a moderation decision.

14. Data Security & Protection

14.1 Technical Measures

• HTTPS/TLS encryption on all pages — your data is encrypted in transit between your browser and our server.
• Password hashing using bcrypt (cost factor 12) — your password is never stored in plain text and cannot be recovered even by our staff.
• Prepared SQL statements (PDO) — all database queries use parameterised inputs to prevent SQL injection attacks.
• CSRF protection on all forms — prevents cross-site request forgery attacks.
• Session security — session cookies are HTTP-only and use SameSite=Lax to prevent cross-site attacks.
• Input sanitisation — all user-submitted data is sanitised before display to prevent XSS attacks.
• Restricted upload directories — KYC identity documents and selfie photos are stored in server directories not directly accessible via web URL.

14.2 Organisational Measures

• Access to user personal data is restricted to authorised Company staff on a strict need-to-know basis.
• All technical staff with access to the codebase and database must sign a Non-Disclosure Agreement (NDA).
• Admin panel access is protected by separate login credentials and role-based permissions.
• Admin actions (including impersonation of users for support purposes) are logged with timestamps and IP addresses.

14.3 Data Breach Response

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify NITDA within 72 hours of becoming aware of the breach, as required by the NDPR.
• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights.
• Take immediate steps to contain the breach and prevent further unauthorised access.

15. Data Retention & Deletion

Data Category	Retention Period	Reason
Account & profile data	Duration of account + 12 months after closure	To resolve any post-closure disputes or queries
Financial transaction records (Orders, Escrow, withdrawals)	Minimum 6 years from transaction date	Nigerian financial record-keeping requirements
Chat messages	Duration of account + 24 months after closure	Dispute resolution and legal compliance
KYC documents (ID images, selfie)	Duration of account + 12 months after closure	Regulatory compliance and fraud prevention
BVN / NIN numbers	Duration of account + 12 months after closure	Regulatory compliance
Server logs (IP address, access logs)	90 days	Security monitoring
Keyword flag logs (flagged chat messages)	24 months	Platform safety audit trail
Admin impersonation logs	36 months	Internal audit and accountability
Push notification subscriptions	Until you revoke permission or account is closed	Delivering notifications you've requested

15.1 Requesting Deletion

You may request deletion of your account and associated personal data at any time via the Delete Account page or by emailing support@dailyworkman.com. We will process your request within 30 days.

Please note that certain data may be retained beyond this period where required by Nigerian law (particularly financial transaction records) or where necessary to resolve an active dispute involving your account.

16. Your Rights Under the NDPR & NDPA

As a data subject under the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at support@dailyworkman.com or via the Contact page. We will respond within 30 days. We may need to verify your identity before processing your request.

17. Children's Privacy

DailyWorkman is intended exclusively for users aged 18 years and above. We do not knowingly collect, store, or process personal data from anyone under 18.

If you are a parent or guardian and believe your child has registered on DailyWorkman or provided us with their personal data, please contact us immediately at support@dailyworkman.com. We will verify the claim and delete the data promptly.

18. International Data Transfers

DailyWorkman is a Nigerian platform and your data is stored on servers located in Nigeria or on servers operated by hosting providers serving the Nigerian market. We do not intentionally transfer your personal data to countries outside Nigeria.

Limited data may pass through international systems in the following circumstances:

• Payment gateways: Paystack and Flutterwave may route payment processing through international infrastructure, subject to their own privacy policies and data transfer agreements.
• Social login: If you use Google, Facebook, or Apple login, authentication data passes through their international infrastructure.
• Email delivery: Emails sent via SMTP may pass through international mail relay infrastructure.

Where such transfers occur, we ensure they are made only to services with adequate data protection safeguards. We do not transfer Nigerian users' BVN, NIN, or identity document data outside Nigeria.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Platform features, or applicable Nigerian law. When we make changes:

• We will update the "Last updated" date at the top of this page.
• For material changes — particularly changes that affect how we process sensitive data — we will notify you by email and/or in-app notification at least 14 days before the change takes effect.
• Continued use of the Platform after the updated Privacy Policy takes effect constitutes your acceptance of the new terms.
• The previous version of this Privacy Policy will be made available on request.

20. How to Exercise Your Rights & Contact Us

For any privacy-related questions, data subject requests, or complaints, please reach us through the following channels:

Platform	DailyWorkman  ·  dailyworkman.com
Data Controller	FridayTechnologies  ·  fridaytechnologies.ng
Privacy Email	support@dailyworkman.com
Contact Page	https://dailyworkman.com/pages/contact.php
Response Time	Within 30 days for data subject requests; within 3 business days for general enquiries
Regulatory Authority	National Information Technology Development Agency (NITDA)  ·  nitda.gov.ng