Privacy Policy

EdgeTime ("EdgeTime", "the App", "we", "us", or "our") is a workforce attendance and time-tracking application developed, owned, and operated by MarketEdge Advisory ("MarketEdge", "the Company"), a marketing and technology company incorporated and operating in the Federal Republic of Nigeria, with its registered office at 10, Ayo Fasugba Street, Magodo-Isheri, Lagos, Nigeria, registration number [Insert CAC/RC Number], and Nigeria Data Protection Commission registration number [Insert NDPC Registration Number]. MarketEdge Advisory is the parent company responsible for the development, operation, and data protection compliance of EdgeTime, and acts as either data controller or data processor in respect of personal data processed through the App, as described in Section 4.

We recognise that trust is central to our relationships with the organisations that subscribe to EdgeTime ("Organisations" or "Employers") and the individuals whose attendance and personal data flow through the App ("Employees" or "Users"). This Privacy Policy ("Policy") explains what personal data we collect through EdgeTime, why and how we collect it, who we share it with, how long we keep it, and the rights available to you under the Nigeria Data Protection Act, 2023 ("NDPA") and its subsidiary instruments, as administered by the Nigeria Data Protection Commission ("NDPC"), together with any other data protection law that may apply to our processing activities.

This Policy applies to personal data we process through the EdgeTime mobile application, the EdgeTime web administration dashboard, EdgeTime's marketing website(s), and general business operations connected to EdgeTime. It applies to Organisations that subscribe to EdgeTime and their authorised administrators, Employees who use EdgeTime to record attendance, visitors to EdgeTime's digital properties, prospective clients, job applicants, and other individuals who interact with us in connection with EdgeTime ("you").

This document is a governance and disclosure policy and is not a substitute for legal advice. We recommend that a qualified Nigerian data protection lawyer review this Policy against EdgeTime's specific data flows and each Organisation's employment contracts before it is published or relied upon.

In this Policy, the following terms carry the meanings set out below, consistent with the NDPA:

Personal Data

Any information relating to an individual who can be identified, directly or indirectly, by reference to an identifier such as a name, ID number, location data, an online identifier, or one or more factors specific to that individual.

Data Subject

The individual to whom personal data relates — for example, an Employee, Organisation administrator, website visitor, or job applicant.

Processing

Any operation performed on personal data, including collection, recording, storage, use, disclosure, combination, restriction, or erasure.

Data Controller

The entity that determines the purpose and means of processing personal data. In most EdgeTime engagements, the Organisation is the controller of its Employees' attendance data, and MarketEdge acts as controller for its own account, billing, and marketing data.

Data Processor

An entity that processes personal data on behalf of, and under the instructions of, a data controller. MarketEdge/EdgeTime typically acts as a processor for Employee attendance data on behalf of the Organisation.

Consent

Any freely given, specific, informed, and unambiguous indication of a data subject's wishes, by which they signify agreement to the processing of their personal data.

Sub-processor

A third-party vendor engaged by MarketEdge to process personal data on our behalf, such as a hosting, notification, or payment provider.

NDPC

The Nigeria Data Protection Commission, the independent regulatory body established under the NDPA to oversee data protection in Nigeria.

Organisation / Employer

The business or entity that registers for an EdgeTime account and enrols its workforce to record attendance through the App.

User / Employee

The individual enrolled by an Organisation who uses the App to record their own attendance.

Attendance Data

Personal data generated when a User clocks in or out, including the timestamp and geofence verification result.

Geofence

A virtual perimeter defined by an Organisation around a physical work location, used to verify that a User is within an approved area when clocking in or out.

Cookie

A small data file placed on your device by a website or application to store information about your visit or preferences.

This Policy applies to personal data we process in the following contexts:

• Organisations. Businesses that register for an EdgeTime account and configure it for their workforce, including administrators who manage the account;
• Employees. Individuals enrolled by an Organisation to record attendance through the EdgeTime mobile app;
• Digital properties. Visitors to EdgeTime's website and any landing pages or microsites we operate to market the App;
• Prospects. Organisations or individuals who enquire about or trial EdgeTime;
• Business partners. Vendors and contractors engaged in delivering EdgeTime;
• Job applicants. Individuals who apply for a role at MarketEdge Advisory in connection with EdgeTime;
• Employees and contractors of MarketEdge Advisory: MarketEdge's own personnel data is governed separately under MarketEdge's internal HR and workplace privacy policy;
• Controller/processor engagements: where an Organisation is the data controller of its Employees' attendance data and MarketEdge/EdgeTime acts as a processor, that Organisation's own workplace privacy notice and our data processing agreement govern that relationship, and this Policy describes our supplementary obligations as a processor.

4.1 Information the Organisation Provides to Us

• Organisation details: business name, industry, and address;
• Administrator contact details: name, email address, phone number, and role;
• Billing information: billing address, payment details processed via our payment providers, and tax identification details where applicable;
• Employee roster data: submitted by the Organisation to set up accounts, including employee name, employee ID/staff number, department, role/job title, work schedule, assigned work location(s), and employment start date.

4.2 Information Employees Provide Directly

• Account credentials: username/password or single sign-on details;
• Contact and profile information: phone number and, optionally, a profile photograph;
• Communications: enquiries and correspondence with our support team.

4.3 Information We Collect Automatically Through the App

• Attendance data: the date and time of each clock-in and clock-out;
• Location data: GPS coordinates captured at the moment of clock-in and clock-out, used solely to verify that the Employee is within an Organisation-configured geofence. EdgeTime does not track a User's location continuously or outside of the clock-in/clock-out action;
• Device data: device type, operating system, app version, and device identifiers, used for app functionality and troubleshooting;
• Dashboard usage data: IP address, browser type, and pages visited on the web administration dashboard, collected for security and analytics purposes.

4.4 Information We Collect from Third Parties

• Payment processors, who confirm successful subscription payments;
• Identity or directory verification services an Organisation may choose to integrate, such as single sign-on providers, where enabled by the Organisation.

4.5 Information We Process on Behalf of Organisations

For most of our services, the Organisation is the data controller of its Employees' attendance and location data, and MarketEdge/EdgeTime acts as a data processor that handles that data strictly on the Organisation's instructions and under a data processing agreement. Where this applies, the Organisation's own workplace privacy notice governs how Employee attendance data is used internally (for example, for payroll or disciplinary purposes), and this Policy describes our supplementary obligations as a processor, including confidentiality, security, and sub-processor management commitments. Employees with questions about how their Organisation uses their attendance data should first contact their employer's HR department or EdgeTime administrator.

In line with the NDPA, we ensure that all personal data we process is:

• Lawfulness, fairness and transparency: processed lawfully, fairly, and in a transparent manner;
• Purpose limitation: collected for specified, explicit, and legitimate purposes, and not further processed in a way that is incompatible with those purposes;
• Data minimisation: adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed — for example, we only capture location data at the point of clock-in/clock-out, not continuously;
• Accuracy: accurate and, where necessary, kept up to date. We take reasonable steps to correct or erase inaccurate personal data without undue delay, and we aim to resolve any complaint about inaccurate data within 21 days wherever practicable;
• Storage limitation: kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which it is processed, after which it is deleted or irreversibly de-identified;
• Integrity and confidentiality: processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, so that its confidentiality, integrity, and availability are not compromised;
• Accountability: processed in a manner that allows us to demonstrate our compliance with these principles, including through the accountability measures described in Section 14.

Where reasonably practicable, we communicate our major data processing activities in plain language, and, where appropriate, in major Nigerian languages or through info-graphics, so that data subjects can be meaningfully aware of how their personal data is used.

Under the NDPA, we only process personal data where we can rely on one of the following lawful bases:

• Consent: you have given clear, specific consent — for example, to an optional profile photograph or optional communications;
• Performance of a contract: processing is necessary to perform our subscription agreement with the Organisation, and to enable the Organisation to perform its employment relationship with its Employees, including recording attendance;
• Legal obligation: processing is necessary to comply with a legal or regulatory obligation, such as tax, accounting, or lawful disclosure requests;
• Legitimate interests: processing is necessary for our legitimate interests, or those of an Organisation or third party, provided this is balanced against your rights and reasonable expectations — for example, securing the App, preventing attendance fraud, or improving EdgeTime;
• Vital or public interest: in limited circumstances, to protect someone's life, health, or safety, or where processing is necessary in the public interest.

Where we rely on legitimate interests to support security or product-improvement activities, we first carry out a documented legitimate interest assessment, as described in Section 14, to confirm that the processing is necessary and does not override your rights and freedoms.

Where we rely on consent, you may withdraw it at any time as described in Section 15, without affecting the lawfulness of processing carried out before withdrawal.

By providing your consent to the processing of your personal data, you also authorise MarketEdge to carry out routine checks on that data at any time after it has been provided to us. These routine checks may include verifying the accuracy and completeness of the data, confirming it remains current, and ensuring that it continues to be processed in compliance with this Policy and applicable law. Such checks are carried out solely for these purposes and do not extend the uses of your data beyond what is described in this Policy.

We use personal data for the following purposes:

• Recording and verifying attendance: registering clock-in/clock-out events and validating them against Organisation-configured geofences;
• Attendance reporting: generating timesheets, attendance summaries, and reports for Organisation administrators, including for payroll support;
• Anomaly detection and security: identifying irregular patterns, such as clock-ins outside a geofence or from an unrecognised device, to protect against attendance fraud and misuse;
• Account and billing administration: invoicing Organisations, contract management, and maintaining accurate business records;
• Communications: responding to enquiries, sending service updates, and app notifications such as reminders to clock in or out;
• Security and fraud prevention: detecting, investigating, and preventing fraud, security incidents, or misuse of the App;
• Legal compliance: complying with applicable laws, regulatory requests, and lawful orders from courts or public authorities;
• Product improvement: analysing aggregated, de-identified usage data to improve EdgeTime's features and reliability;
• Recruitment: reviewing applications, assessing suitability, and communicating with candidates during hiring at MarketEdge Advisory.

We do not use personal data for purposes that are incompatible with those described above without notifying you and, where required, obtaining your consent.

8.1 How Geofencing Works

EdgeTime uses GPS location data to confirm that an Employee is within an Organisation-defined work location (a "geofence") at the moment of clocking in or out. Location is captured only at the point of the clock-in/clock-out action; EdgeTime does not continuously track an Employee's location in the background, and location services can typically be disabled by the User outside of that action, subject to the Organisation's configuration. EdgeTime does not currently use biometric attendance verification (such as fingerprint or facial recognition); if this changes in future, this Policy will be updated accordingly and, where required, your consent will be obtained before such a feature is enabled.

8.2 Device Permissions

The EdgeTime mobile app requests certain device permissions to function, including:

• Location access: required to verify clock-in/clock-out against the configured geofence;
• Camera access: only where an Organisation enables photo capture at clock-in/out for identity verification, and used only for that purpose;
• Notifications: to send clock-in/out reminders and service updates.

You can manage these permissions through your device settings. Disabling location access may prevent you from being able to clock in or out through the App, as this is core to its function.

8.3 Cookies on the Web Administration Dashboard

Our web-based administration dashboard, used by Organisation administrators, uses:

• Strictly necessary cookies: required for the dashboard to function and to maintain login sessions;
• Performance and analytics cookies: help us understand how administrators use the dashboard so we can improve it.

We do not use advertising or targeting cookies within EdgeTime.

8.4 Managing Your Preferences

You can control cookies through your browser settings on the web dashboard. Rejecting non-essential cookies will not affect your ability to use the core functions of the dashboard.

We may share personal data with:

• Organisations: attendance, geofence verification results, and account data are shared with the Employee's Organisation/employer, who uses it for payroll, HR, and workforce management purposes;
• Service providers and sub-processors: such as cloud hosting providers, notification/SMS providers, customer support tools, and payment processors, engaged and managed as described in Section 10;
• Professional advisers: such as auditors, lawyers, and consultants, on a confidential, need-to-know basis;
• Regulators and authorities: the NDPC, courts, law enforcement, or other public authorities, where required or permitted by law;
• Successors in a business transaction: in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to appropriate confidentiality protections.

We do not sell personal data to third parties. We do not share Employee attendance or location data with advertising networks, and we do not use it for advertising purposes.

Where we engage a third-party vendor to process personal data on our behalf as a data processor or sub-processor, we carry out due diligence and put safeguards in place before and during the engagement, including:

• Written data processing agreements: that set out the scope, purpose, and duration of the processing and the vendor's obligations;
• Ongoing monitoring: of the vendor's ongoing compliance with that agreement and applicable law;
• Regulatory status checks: confirming, where relevant, that the vendor is duly registered with the NDPC as a data controller or processor of major importance;
• Certification checks: obtaining evidence of relevant security certifications or the vendor's adherence to recognised data protection standards;
• Secure storage and transfer: assessing the methods the vendor uses to securely store and transfer personal data;
• DPIA involvement: involving the vendor, where relevant, in any data protection impact assessment connected to the processing;
• Incident response: requiring the vendor to maintain clear incident response and breach notification protocols; and
• Sub-processor oversight: where the vendor engages its own sub-processors, requiring evidence that those sub-processors meet equivalent standards.

When a data processing agreement with a vendor ends, we require the vendor, as applicable, to delete the personal data and confirm deletion in writing, return the personal data to us, anonymise the personal data, make relevant audit records available for our review, and revoke any access it had to our systems and data.

Some of the cloud hosting and infrastructure providers we rely on to operate EdgeTime are located or operated outside Nigeria, including in jurisdictions such as the United States, the European Union, and the United Kingdom. Where we transfer personal data outside Nigeria, we rely on one of the following grounds recognised under the NDPA:

• Adequacy decision: an adequacy decision issued by the NDPC in respect of the destination country;
• Approved transfer instrument: a cross-border transfer instrument, such as standard contractual clauses, approved by the NDPC;
• Informed consent: you have given consent to the transfer after being informed of the possible risks arising from the absence of adequate data protection safeguards in the destination country;
• Contract necessity: the transfer is necessary for the performance of a contract with you, or to take steps you have requested before entering into a contract;
• Sole benefit of the data subject: the transfer is for your sole benefit, it is not reasonably practicable to obtain your consent, and you would likely give it if asked;
• Public interest: the transfer is necessary for important reasons of public interest;
• Legal claims: the transfer is necessary to establish, exercise, or defend legal claims; or
• Vital interests: the transfer is necessary to protect your vital interests, or those of another person, where you are physically or legally unable to give consent.

We document and periodically assess our cross-border data transfers, including the categories of personal data and the destination countries involved, as part of our accountability obligations under the NDPA. You may contact us using the details in Section 21 for more information about the safeguards applied to a specific transfer.

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by law. In general:

• Attendance records: retained for the duration of the Organisation's subscription and for a period afterwards as instructed by the Organisation or required by applicable Nigerian labour, tax, or limitation laws, to support payroll and record-keeping obligations;
• Account and administrator data: retained for the duration of the subscription and thereafter for the period required by Nigerian tax and accounting laws;
• Location/geofencing data: retained only as part of the attendance record associated with each clock-in/clock-out event; we do not separately retain a continuous location trail;
• Device data: retained for as long as needed for app functionality and troubleshooting;
• Dashboard cookies and identifiers: retained in line with the durations disclosed in our cookie settings, typically ranging from the duration of your browser session up to 24 months;
• Recruitment data: retained for the duration of the recruitment process and for a limited period afterwards in case suitable future roles arise, unless you ask us to delete it sooner.

When an Organisation's subscription ends, we follow the deletion, return, or anonymisation instructions set out in our data processing agreement with that Organisation. When personal data is no longer needed, we securely delete, anonymise, or aggregate it so that it can no longer be used to identify you.

We maintain technical and organisational measures designed to protect personal data — including attendance and location data — against unauthorised access, loss, misuse, or alteration, including:

• Encryption of data, including location and attendance data, in transit and, where appropriate, at rest;
• Access controls restricting access to personal data to employees and contractors who need it to perform their role, using user-specific credentials and, where appropriate, two-factor or multi-factor authentication;
• Endpoint and network security such as anti-malware, anti-ransomware, and anti-spyware protections on our systems and devices;
• Confidentiality safeguards so that files and registers containing personal data are kept confidential and are not accessible to unauthorised persons, whether in physical or digital form;
• Data segregation so that one Organisation cannot view the attendance or personal data of another Organisation's Employees;
• Confidentiality obligations and training for all personnel handling personal data, including our internal Basic Privacy Checklist of do's and don'ts;
• Vendor due diligence before onboarding sub-processors, as described in Section 10;
• Periodic security reviews to identify and remediate vulnerabilities, and a documented schedule for monitoring, evaluating, and maintaining our data security systems;
• A business continuity and disaster recovery plan designed to restore personal data and resume affected services with minimal disruption in the event of an incident; and
• An incident response process to detect, investigate, and respond promptly to suspected security incidents.

We periodically benchmark our security programme against recognised industry frameworks and continue to strengthen our controls as our business and the threat landscape evolve. No system can be guaranteed 100% secure. If you have reason to believe your interaction with EdgeTime is no longer secure, please contact us immediately using the details in Section 21.

We maintain accountability measures that allow us to demonstrate our compliance with the NDPA, including:

• Data Protection Impact Assessments (DPIAs): before introducing new technology or a new method of processing personal data — including EdgeTime's geofencing and location-verification features, given their use of location data — we assess the risks the processing poses to data subjects and put in place measures to address them;
• Legitimate Interest Assessments (LIAs): where we rely on legitimate interests as our lawful basis, we document an assessment confirming that the processing is necessary and does not override the rights of the affected data subjects;
• Records of Processing Activities: we maintain records describing our processing activities, the categories of personal data and data subjects involved, and the safeguards in place;
• Governance and reporting: our Data Protection Officer monitors our compliance with the NDPA, submits periodic data protection reports to management, and coordinates our response to data subject requests, complaints, and any engagement with the NDPC; and
• Internal compliance audits: we maintain a written internal policy for routine checks on our data protection compliance practices, which may be carried out at any time, including without prior notice to staff, to verify ongoing compliance with the NDPA.

These measures are reviewed and updated periodically to reflect changes in our processing activities, our technology, and the law.

Subject to applicable exceptions, the NDPA gives you the following rights in relation to your personal data:

• Right to be informed: to know how your personal data is collected and used, as set out in this Policy;
• Right of access: to request a copy of the personal data we hold about you;
• Right to rectification: to ask us to correct inaccurate or incomplete personal data;
• Right to erasure: to ask us to delete personal data where there is no longer a valid reason for us to hold it;
• Right to restriction of processing: to ask us to limit how we use your personal data in certain circumstances;
• Right to data portability: to receive certain personal data you have provided to us in a structured, commonly used, machine-readable format;
• Right to object: to object to processing based on legitimate interests at any time;
• Right to withdraw consent: where we rely on consent, at any time and free of charge;
• Right in relation to automated decisions: not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, without appropriate safeguards (see Section 16);
• Right to lodge a complaint: with the Nigeria Data Protection Commission if you believe your rights have been infringed (see Section 22).

If you are an Employee, your Organisation is typically the controller of your attendance data, so we recommend directing requests about that data to your Organisation's HR department or EdgeTime administrator in the first instance; MarketEdge/EdgeTime supports Organisations in fulfilling such requests. For requests concerning data for which MarketEdge is the controller — such as marketing website data or job applications — please contact our Data Protection Officer using the details in Section 21.

We log and track data subject requests and complaints, and we aim to acknowledge and resolve them within the timeframes required by the NDPA, including correcting flagged inaccuracies within 21 days wherever practicable. We may need to verify your identity before responding. Some rights may be limited where an exception under the NDPA applies, for example, where retention is required by law.

EdgeTime uses automated processing to support workforce management — for example, automatically comparing a clock-in/clock-out event's GPS coordinates against an Organisation's configured geofence to determine whether it falls within or outside the approved area, and flagging late arrivals or missed clock-outs against an Employee's configured work schedule. These automated checks support, but do not themselves make, disciplinary or pay-related decisions — such decisions remain the responsibility of the Organisation, which can review and override automated flags.

Where an Organisation configures EdgeTime to feed automated flags directly into payroll or disciplinary processes in a way that could produce a legal or similarly significant effect on you, appropriate safeguards should be applied by that Organisation, including the ability for you to request human review, express your point of view, and contest the outcome. Please contact your Organisation's administrator, or us using the details in Section 21, for more information about automated processing that may affect you.

EdgeTime is designed for use by employees of working age and is not intended for use by children. Organisations are responsible for ensuring that individuals they enrol in EdgeTime meet the minimum age of employment under applicable Nigerian labour law. We do not knowingly collect personal data from children through EdgeTime.

More broadly, we recognise that some data subjects may be more vulnerable than others, including because of age, disability, or personal circumstances. Where our data protection impact assessments identify that data subjects affected by our processing fall within a recognised vulnerability index, we apply additional care and, where appropriate, additional safeguards.

If you believe a child or another vulnerable individual has provided personal data to us without appropriate consent, please contact us so we can investigate and, where appropriate, delete that data.

EdgeTime's website and App may contain links to third-party websites, platforms, or services that we do not control. This Policy does not apply to those third parties, and we encourage you to review their privacy notices before providing them with personal data.

We maintain procedures to detect, investigate, and respond to personal data breaches, and we keep an internal register of breaches and the steps taken in response. Where a breach poses a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, or such other timeframe as the NDPA requires. We will notify affected Organisations, and, where the breach is likely to result in a high risk to individuals and it is appropriate for us to do so directly, affected Employees, without undue delay, together with guidance on steps that can be taken to protect themselves.

We may update this Policy from time to time to reflect changes in our practices, the App, or legal requirements. We will post the updated Policy on the EdgeTime website and/or within the App with a revised effective date, and where changes are material, we will provide additional notice, such as an email notification or a prominent notice within the App, before the changes take effect.

If you have questions about this Policy, wish to exercise your rights, or want to raise a concern about how EdgeTime handles personal data, please contact our Data Protection Officer:

• Address: 10, Ayo Fasugba Street, Magodo-Isheri, Lagos, Nigeria
• Email: DPO/it@marketedgeadvisory.com
• Phone: 0815715555

We aim to acknowledge and address all privacy-related enquiries promptly and within any timeframe required by applicable law.

If you are not satisfied with our response to a privacy concern, or believe we have processed your personal data unlawfully, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the independent body responsible for enforcing the NDPA. We recommend confirming the Commission's current contact details and complaint procedure on its official website, as these may be updated from time to time.