01
Who we are
Asiri Compliance Ltd is registered in Nigeria under RC 9545197. Our registered address is 2 Famuyiwa Obodo Street, Lambasa, Ajah, Lagos State, Nigeria. You can contact us at hello@asiri.ng.
Our appointed Data Protection Officer and compliance lead is Frank Elendu. Contact him about privacy, your rights or a complaint at dpo@asiri.ng.
This notice explains Asiri’s handling of personal data in operating its website and service and in its business interactions, including enquiries, recruitment and payroll. Where a customer places personal data in its workspace and determines why it is processed, Asiri acts on that customer’s instructions. The customer’s notice explains its own processing purposes; this notice does not replace it.
02
What we collect
The information we handle depends on how you interact with Asiri.
Account and contact information: names, work email addresses, organisation details, account-access information, sessions and remembered-device records.
Service and communication records: information you enter into forms, enquiries, support messages, correspondence and newsletter preferences.
Billing and payment records: billing contacts, invoices, payment amounts and payment references. Subscription payments are handled through Paystack.
Website and application information: usage events, diagnostic and error information, and technical information used for website protection, such as IP addresses and browser information. Optional analytics and session replay are described in our consent controls.
Customer workspace content: registers, evidence, messages and other records that customers place in Asiri. The customer decides what personal data those records contain; we handle it on the customer’s instructions.
Recruitment and employment information: information supplied through LinkedIn and recruitment emails, plus the employee payroll and salary-payment records we manage. Business prospect information is handled through Apollo and HubSpot for sales outreach.
DRAFT REVIEW REQUIRED BEFORE PUBLICATION: confirm the specific recruitment, payroll and prospect-data fields, the sources of prospect information, and any sensitive personal data processed.
03
Purposes and lawful bases
We use account, contact and billing information to provide access to Asiri, administer subscriptions and carry out our agreements. Payroll information needed to calculate and pay employee remuneration is processed to perform employment arrangements.
We use communication records to answer support requests and enquiries, and diagnostic information to investigate faults and maintain the service. Our register records legitimate interests for these activities and for customer win-back campaigns. The associated balancing assessments must support those interests. You can object to direct marketing by contacting dpo@asiri.ng.
Newsletter subscriptions and optional analytics or session replay rely on consent as recorded for those activities. Where we rely on consent, you may withdraw it; withdrawal does not change the lawfulness of processing before it was withdrawn.
We also handle recruitment applications, business prospect interactions and internal communications through the tools described in this notice.
For personal data that a customer places in its workspace, the customer determines the purpose and lawful basis. Asiri processes that content on its instructions; Asiri’s commercial agreement with the customer does not automatically establish the customer’s lawful basis for every person in its records.
DRAFT REVIEW REQUIRED BEFORE PUBLICATION: complete the lawful-basis assessments for recruitment, sales outreach and internal Workspace processing, and the pending legitimate-interest balancing reviews. Do not publish this draft as though those assessments are complete.
04
How we handle information
We handle personal data through our website, application and business tools, as well as through manual work by our team. This includes collecting information you submit, storing and organising records, responding to messages, managing account access, processing payments and reviewing information needed to provide our services.
Our business uses Gmail for email, Drive for file storage, Docs for document collaboration and Meet for meetings. We use HubSpot for sales and customer support and Apollo for sales outreach. Recruitment takes place through LinkedIn and email. Payroll is managed manually, payroll files are stored in Google Drive, and salary payments are made through Wema Bank.
When a customer places personal data in its Asiri workspace, we process that workspace content on the customer’s instructions. The customer determines the purposes of that processing and who may access its workspace. Our use of AI assistance is described separately below.
06
International transfers
Some providers used by Asiri process personal data outside Nigeria. Our current transfer register names South Africa, the United States and Germany. The destination and protection required depend on the provider, service and information involved.
DRAFT — NOT READY FOR PUBLICATION: the transfer register does not yet identify verified safeguards or another applicable transfer ground for these entries. Accepted standard service terms alone must not be described as an assessed international-transfer mechanism. The locations and arrangements for Google Workspace, Apollo, LinkedIn and Wema Bank also need to be checked for the services Asiri actually uses.
Before publication, document the applicable transfer ground and supporting evidence for each transfer, then replace this review note with an accurate description of the safeguards and how people can obtain relevant information from dpo@asiri.ng.
07
How long we keep information
We retain personal data for the purpose for which it is used and for applicable legal obligations, rather than indefinitely. Different records have different retention periods. A request for deletion is considered alongside any obligation to retain particular records or an applicable legal hold.
Our current company retention rules include: customer-support records for 24 months after the last activity; customer win-back campaign records for 24 months after the last activity; and payroll working files for three years after employment ends. Payroll payment transaction records are retained separately for seven years from each transaction date. The payroll-file period does not override applicable accounting or tax retention duties. These are company retention decisions, not a statement that the NDPA or CBN prescribes those periods.
You can contact dpo@asiri.ng to ask about retention of your information or to request deletion. For content held in a customer’s workspace, the customer’s instructions and applicable processing agreement determine the permitted retention and deletion arrangements.
DRAFT REVIEW REQUIRED BEFORE PUBLICATION: confirm and record retention periods and triggers for accounts, recruitment, sales prospects, newsletter subscriptions, website enquiries and diagnostic data. Resolve the existing six-year workspace-content rule against customer instructions and contract terms. Confirm backup expiry and how deletion is carried out.
08
Automated decisions
Asiri uses Eri as an AI assistant. We do not use AI outputs to make decisions about people without human review. Eri’s suggestions are reviewed by people; they are not a substitute for human judgement.
If you believe a decision involving your personal data was made solely by automated processing and significantly affects you, contact our DPO at dpo@asiri.ng. You can ask for an explanation, express your view and request human review or challenge the decision where the law provides those rights.
09
Your rights
You can ask for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it while something is being sorted out, object to what we are doing with it, ask for it in a form you can take elsewhere, object to a decision made about you by a machine alone and withdraw your agreement, where you gave it. To do any of these, write to us using the address above and we will answer without undue delay.
10
How to reach us
If you think we have got something wrong, write to us at dpo@asiri.ng and we will look into it and reply. You do not have to complain to anybody else first, and you can do both.
11
Complaints to the NDPC
If you are not satisfied with how we have handled your data or your request, you have the right to lodge a complaint with the Nigeria Data Protection Commission. You can do that whether or not you have raised it with us first.
Need something explained?
Ask us about these documents, your account or the way Asiri handles information.
Contact Asiri →