Privacy notice

This notice explains how Asiko (“Asiko”, “we”, “us”) handles personal data on asikohr.com, app.asikohr.com and the Asiko apps. We follow the Nigeria Data Protection Act 2023 (NDPA) and, where it applies to you, the EU and UK General Data Protection Regulation.

The short version

• When an employer or recruitment agency uses Asiko for its staff and candidates, that organisation decides what happens to the data. We process it for them, on their instructions.
• For your own Asiko account, course purchases, support requests and this website, we decide, and this notice tells you how.
• Our AI suggests and explains. It never rejects a candidate, never issues a payslip and never decides who leaves. A person decides.
• We do not sell personal data, and we do not use it for advertising.
• Our app servers and database are in Africa (Johannesburg). Uploaded files and some providers we use are outside Nigeria; see “Transfers”.

1. Our two roles

When we act for an employer (processor)

Employers and agencies (“customers”) use Asiko to recruit and to manage their people: job applications, CVs, interview notes, employee records, leave, attendance, payroll, performance, training and HR cases. For this data the customer is the data controller and Asiko is the data processor. We use it only to provide the service to that customer, under our terms with them. If you applied for a job or work for one of our customers, please contact that organisation first about your data; if you contact us, we will pass your request to them.

When we decide (controller)

Asiko is the data controller for:

• accounts of people who sign in to Asiko, and workspace billing details;
• course purchases, the CV & LinkedIn service, CV revamp orders, and job seekers who buy them;
• support requests, demo requests and messages you send us;
• visits to our own website pages (not employers’ careers pages);
• security, audit and fraud-prevention records about use of the service.

2. What we collect

• Account details: name, work email, phone number, organisation, role, and sign-in records.
• Billing: plan, invoices and payment status. Card details are entered with our payment provider (Paystack) and are not stored by us.
• Course buyers: email address, purchase and access records and, for the CV & LinkedIn service, the CV, target role and LinkedIn text you choose to upload.
• CV revamp customers: your name, email address, the target role, the text of the CV you upload (we read the file into text and do not keep the file) and any LinkedIn text you add, the revamped CV we send you, and the payment record.
• Support and contact: what you tell us and our replies.
• Technical data: IP address, device and browser type, pages requested and error reports, used to run, secure and rate-limit the service.
• Customer data (as processor): whatever our customers put in Asiko or collect through it, including candidate applications and employee records. Some of it can be sensitive, such as health information in a leave request; customers control what they collect.

3. Why we use it, and our lawful basis

• To provide the service you signed up or paid for — performance of a contract.
• To keep accounts and records, including tax and accounting records — legal obligation.
• To secure the service, prevent fraud and abuse, and improve it — our legitimate interests, balanced against yours.
• To send product news or marketing — your consent, which you can withdraw at any time with the link in each message.
• Website analytics — where switched on, we use cookieless analytics that do not identify you (see our cookie notice).

4. How we use AI

Asiko uses large language models (currently from Anthropic) to help with specific tasks: reading a CV into a profile, screening an application against a role, drafting messages, answering questions from a workspace’s own records, the first automated answer to a support request, the CV & LinkedIn review, and the first draft of a CV revamp, which an Asiko staff member checks and corrects before anything is sent to you.

• AI screening is advisory. It gives a suggestion with the reasons and the parts of the CV it relied on. It never rejects a candidate or moves them on by itself; a person at the employer decides and can overrule it.
• No decision with legal or similarly significant effect is made solely by automated means. You have the right to ask for human review of any decision about you, to express your view and to contest it.
• Payroll is not calculated by AI. Tax, pension and other deductions come from fixed, tested rules.
• We send the AI provider only what a task needs. Under our agreement with the provider, the data we send is not used to train its models. AI output can be wrong, so it is labelled as AI and shown for a person to check.
• Requests about your data (access, deletion and so on) are never answered by the AI.

5. Who we share it with

We share personal data only with providers who help us run Asiko, under written agreements that require them to protect it and use it only for us:

• hosting and database (Fly.io, Johannesburg, South Africa);
• file storage for CVs and documents (Tigris, which stores files on a global network);
• sign-in and account security (Clerk);
• AI processing (Anthropic);
• email delivery (Amazon Web Services);
• payments (Paystack);
• WhatsApp messaging, when a customer turns it on (Meta);
• error monitoring and, if switched on, privacy-friendly website analytics.

We may also disclose data where the law requires it, to protect people’s safety, or as part of a sale or reorganisation of our business, in which case this notice continues to apply. We never sell personal data.

6. Transfers outside Nigeria

Some providers above process data outside Nigeria, including in South Africa, the European Union and the United States. Where we transfer personal data out of Nigeria we do so as the NDPA allows: to a country with adequate protection, or with appropriate safeguards such as contractual clauses that bind the recipient to standards at least as protective as the NDPA.

7. How long we keep it

• Customer data: for as long as the customer’s workspace exists, and as the customer instructs. After a workspace is closed we delete or return it within 90 days, except where the law requires us to keep it.
• Candidate applications: kept by the employer under its own policy. A candidate who did not agree to be kept for future roles is not added to a talent pool.
• Billing and payment records: six years, for tax and accounting law.
• Course access and CV service uploads: access records for as long as the course is offered; uploaded CVs, review results and CV revamp orders (the CV text and the revamped CV) for 12 months after purchase, unless you ask us to delete them sooner.
• Support requests: two years after they are closed.
• Security and server logs: up to 12 months.

8. How we protect it

Encryption in transit, each workspace’s data separated at the database level, permissions so people see only what their role allows, audit records of sensitive actions, and staff access limited to named people for support. No system is perfectly secure; if a breach is likely to put your rights at risk, we will tell the Nigeria Data Protection Commission and, where required, you, within the time the law sets.

9. Your rights

Under the NDPA (and the GDPR where it applies) you can ask us to:

• tell you whether we hold data about you, and give you a copy;
• correct data that is wrong or incomplete;
• delete data, or restrict how we use it;
• give you your data in a commonly used, machine-readable format;
• stop using it for direct marketing, or where we rely on legitimate interests;
• withdraw consent, without affecting what was done before;
• have a person review a decision made by automated means.

Email privacy@asikohr.com. We may need to confirm who you are. We reply within the time the law allows and do not charge unless a request is clearly unfounded or excessive. Where we hold the data for an employer, we will pass your request to them and help them answer it. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

10. Children

Asiko is for employers and adult job seekers. It is not meant for anyone under 18, and we do not knowingly collect their data.

11. Changes and contact

We will update this notice when our practices change and show the date at the top. Significant changes will be announced in the app or by email. Our data protection contact is privacy@asikohr.com; for anything else, write to hello@asikohr.com.