Privacy policy

This policy explains how FIXXA [registered company name to be added], as data controller, processes personal data in line with the Nigeria Data Protection Act 2023 (NDPA), the GAID 2025 issued by the Nigeria Data Protection Commission (NDPC), and, where still applicable, the Nigeria Data Protection Regulation 2019 (NDPR).

Customers: name, email, phone, addresses, job descriptions, voice notes, photos and video you send, payment references (not full card numbers), messages and ratings. If you book for someone else, their name, phone and address.

Professionals: identity details including NIN, documents, guarantor details, police reports (childcare), bank details for payouts, location while on an active job.

To provide and coordinate services (contract); to verify professionals and keep people safe (legitimate interest and, where required, consent); to meet legal and tax obligations (legal obligation); to send updates you ask for (contract) and marketing only with your consent.

We share only what is needed: job details and approximate location with the assigned professional; payments with Paystack; identity checks with our verification partner; messages via WhatsApp (Meta). Phone numbers are not shared between customers and professionals.

Some providers process data outside Nigeria. We rely on the transfer bases in Part VIII of the NDPA. [List of processors and transfer safeguards to be completed.]

Live location is collected from professionals only during an active job. Customer location is shared in a safety alert only if you choose to include it.

[Retention periods to be set per data category.] Photos used as job evidence are kept for [X months] after completion unless a dispute is open.

Under the NDPA you may access, correct, delete or port your data, object to processing, and withdraw consent. Contact our Data Protection Officer at privacy@thefixxa.com [placeholder]. You may also complain to the NDPC.

Data is stored with access controls and encryption in transit. Photos are compressed and location metadata is removed before upload. We will notify the NDPC of a qualifying breach within 72 hours.