Website and mobile application privacy notice
| Document Owner | Legal / Compliance |
| Classification | Public |
| Version | 1.0 |
| Effective Date | 18 August 2026 |
- Introduction
PEARL TECHNOLOGY NIGERIA LIMITED, RC 8315402 (“Pearl”, “we”, “us” or “our”), is incorporated in Nigeria and operates from 267A, Etim Inyang Crescent, Victoria Island, Lagos. Pearl provides human-resources technology and employee salary-advance solutions to eligible users in Nigeria.
This Privacy Policy explains how we collect, use, disclose, store and protect personal data when employees, employers, representatives, website visitors and other users interact with our website, mobile application and related services (together, the “Services”).
We process personal data in accordance with the Nigeria Data Protection Act 2023 (“NDPA”), applicable directives and guidance issued by the Nigeria Data Protection Commission (“NDPC”), including the General Application and Implementation Directive 2025 where applicable, and other applicable Nigerian laws. - Who Is Responsible for Your Personal Data?
Pearl acts as a data controller where it determines the purposes and means of processing personal data. In some employer sponsored arrangements, Pearl may also process personal data on documented instructions from a participating employer. The precise role will depend on the relevant service arrangement.
For further clarification, reach out to the Data protection contact / DPO via: eji.okojie@sanaam.tech - Personal Data We May Collect
• Identity data: full name, date of birth, nationality, photograph, signature, employee identifier, and government-issued identification details where required.
• Contact data: email address, telephone number, residential address and other contact details.
• Employment and payroll data: employer name, job information, employment status, payroll cycle, salary information, accrued or earned salary information where relevant, salary-payment dates and other information necessary to assess or administer eligibility.
• Financial and transaction data: bank account information, payment details, salary-advance applications, disbursements, repayments, outstanding balances and transaction history.
• Verification and compliance data: BVN, NIN or other verification information only where lawfully required and actually collected; identity-verification results; fraud and risk indicators; sanctions or politically exposed person screening information where applicable.
• Technical and usage data: IP address, device identifier, device type, browser, operating system, app version, login information, timestamps, diagnostic information and activity within the Services.
• Communications data: customer-support requests, complaints, correspondence, call records where lawfully recorded and other communications with Pearl.
• Consent and preference data: privacy choices, marketing preferences, cookie preferences and records of consent where consent is relied upon. - How We Obtain Personal Data
• directly from you when you register, apply for or use the Services;
• from participating employers where necessary to operate an employer-linked salary advance programme;
• from identity verification, payment, banking, fraud prevention and technology service providers;
• from public records or lawful compliance databases where necessary;
• automatically through our website, app, devices, cookies and similar technologies, subject to applicable consent requirements. - Information Received From Your Employer
Where your employer participates in Pearl’s salary-advance programme, we may receive employment and payroll-related information from your employer to determine or confirm eligibility, administer salary advances, facilitate repayment, prevent fraud, reconcile payroll related information and meet legal obligations.
The information may include your name, employee identifier, employment status, salary information, payroll cycle, eligible advance amount and other information reasonably necessary to provide the Services. Pearl and participating employers must ensure that any sharing and processing of personal data is supported by an appropriate lawful basis and appropriate contractual or data-sharing arrangements. - Purposes and Lawful Bases
Purpose Typical lawful basis Provide and administer the Services Performance of a contract; steps at your request before entering a contract Assess or confirm salary-advance eligibility Contract; legitimate interests; legal obligations where applicable Verify identity and prevent impersonation or fraud Legal obligation where applicable; legitimate interests; substantial public interest where permitted Process disbursements and repayments Contract; legal obligation Customer support and complaint resolution Contract; legitimate interests; legal obligation Security, risk monitoring and service integrity Legitimate interests; legal obligation Regulatory, legal, audit and record-keeping obligations Legal obligation Improve our website, app and services Legitimate interests; consent where required Marketing communications Consent or other lawful basis permitted by applicable law - Identity Verification, Risk and Automated Tools
We may use manual and automated tools to support identity verification, eligibility checks, fraud detection, transaction monitoring, cybersecurity and risk assessment. Where a decision is based solely on automated processing and produces legal or similarly significant effects, we will provide any safeguards and rights required under applicable law, which may include the right to request human review. - How We Share Personal Data
We may share personal data only where reasonably necessary and lawful, including with:
• participating employers, to the extent necessary to operate the programme and reconcile payroll-related arrangements;
• banks, payment processors and other payment service providers;
• identity-verification, fraud-prevention and cybersecurity providers;
• cloud hosting, software, analytics and customer-support providers;
• professional advisers, auditors and insurers;
• competent courts, regulators, law-enforcement agencies, government authorities or financial intelligence authorities where lawfully required;
• a purchaser, investor or successor in connection with a lawful corporate transaction, subject to appropriate safeguards.
We do not disclose personal data for unrelated purposes merely because a third party requests it. We require service providers handling personal data on our behalf to apply appropriate confidentiality and data-protection safeguards. - International Transfers
If personal data is transferred outside Nigeria, Pearl will use a transfer mechanism or safeguard permitted by the NDPA and applicable NDPC directives, taking into account the destination, recipient, purpose of transfer and risks to data subjects. - Data Retention
Personal data obtained by PEARL TECHNOLOGY NIGERIA LIMITED will be retained for the duration of the contractual or service relationship and for up to five (5) years following the termination or completion of the contract or service, unless a longer retention period is required or permitted by applicable law, regulation, legal proceedings, regulatory obligations, fraud prevention, dispute resolution, or other legitimate purposes.
Where personal data is no longer required, it will be securely deleted, or otherwise disposed of in accordance with applicable data protection requirements. - Security
Pearl applies appropriate technical and organisational measures designed to preserve the confidentiality, integrity and availability of personal data and to protect it against accidental or unlawful destruction, loss, alteration, disclosure or access. Measures are selected based on risk and may include access controls, authentication controls, encryption where appropriate, logging, monitoring, backups, vulnerability management, staff confidentiality obligations and incident response procedures. - Your Data Protection Rights
Subject to the NDPA and other applicable law, you may have rights to:
• receive information about how your personal data is processed;
• request access to personal data held about you;
• request correction of inaccurate or incomplete personal data;
• request erasure where there is no lawful reason to continue processing;
• request restriction of processing in applicable circumstances;
• object to processing in applicable circumstances, including direct marketing;
• receive certain personal data in a portable format where applicable;
• withdraw consent at any time where processing is based on consent, without affecting prior lawful processing;
• obtain safeguards in relation to qualifying automated decision-making;
• lodge a complaint with the Nigeria Data Protection Commission.
To exercise a right, contact eji.okojie@sanaam.tech. We may request information reasonably necessary to verify your identity and protect your account before acting on a request. - Cookies and Similar Technologies
Our website and app may use cookies, software development kits (SDKs), local storage, pixels or similar technologies. Where consent is required for a technology that is not strictly necessary, we will request your choice before activation. See our Cookie Policy for further information. - Children
The Services are intended for eligible adult employees. Pearl does not knowingly provide salary-advance services to persons under 18 years of age. If we become aware that a child’s personal data has been collected contrary to law, we will take appropriate steps to address it. - Changes to This Policy
We may update this Privacy Policy to reflect changes in our Services, technology or legal obligations. Material changes will be communicated through the website, app, email or another appropriate channel. The current version and effective date will be displayed on this page. - Contact and Complaints
Data Protection Contact / DPO
PEARL TECHNOLOGY NIGERIA LIMITED
267A, Etim Inyang Crescent, Victoria Island, Lagos, Nigeria
Email: eji.okojie@sanaam.tech
If you believe your data-protection rights have been infringed, you may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) using the Commission’s official complaint channels.
