Nigeria Data Protection Act (NDPA) Compliance Statement

1. Data Controller & Statutory Authority

The Data Controller for this platform is the Federal Ministry of Labour and Employment (FMLE), headquartered in Abuja, Nigeria. Processing is executed under statutory provisions mandated to regulate, verify, license, and audit Private Employment Agencies operating within or executing international placement migration streams from the Federal Republic of Nigeria.

2. Classifications of Collected Personal Data

To process structural corporate recruitment permits, the platform securely stores and validates the following datasets:

• Identity Metrics: Full Names, National Identification Numbers (NIN), Passports, signatures, and biometric indicators of corporate directors.
• Corporate Metadata: Corporate Affairs Commission (CAC) Registration Numbers (RC), Tax Identification Numbers (TIN), structural incorporation details, and official email paths.
• Compliance Verification Logs: NSITF registration tokens, financial security values, and background legal/criminal declarations.
• System Network Signatures: Remote IP addresses, Device Browser User Agents, and chronological audit timestamps captured automatically across user sessions.

3. Purposes and Lawful Basis for Processing

In accordance with Section 25 of the NDPA, processing is executed solely under the following lawful metrics:

• Statutory Obligation: To fulfill the regulatory mandate of the Ministry in issuing, checking, and monitoring recruitment licenses.
• Explicit Consent: Granted voluntarily by applicants during Step 1 of the platform configuration wizard workspace.
• Third-Party Verification Handshakes: Asynchronous background compliance lookups targeting federal database endpoints including CAC, FIRS, and NIMC portals.

4. Technical Cybersecurity & Safeguards

The NELEX PEA platform deploys severe technical safeguards to ensure absolute database isolation and shield workflows from malicious structural interference:

• Heuristic Virus Scans: Integrated ClamAV daemon sweeps run in real-time on all uploaded document buffers before they reach the compliance vault.
• Data Optimization & Truncation: Server-side Ghostscript routines automatically strip hidden user metrics and compress documents safely into ebook resolutions.
• Immutable Security Forensics: A tamper-proof background log records all updates, failed auth loops, and out-of-bounds permission denials, ensuring 100% forensic transparency.

5. Data Retention Limits & Disposal

Corporate user registries and license tokens are retained for the duration of the agency's active regulatory operation. System security logs are subject to a strict 90-day retention cutoff, after which background automated cron routines purge legacy entries to maintain clean, compliant database boundaries.

6. Rights of Data Subjects

Under the NDPA, users possess full, explicit operational authority to exercise the following titles:

• The right to access and review all records matching their account profile.
• The right to demand rectification of erroneous information profiles (restricted during live review gates).
• The right to lodge operational complaints directly with the Nigeria Data Protection Commission (NDPC).