Privacy Policy

Last updated: 28 October 2026 · Version 2026-10

This policy explains what personal data Harvhills Payroll collects, why, who sees it, how long we keep it, and the choices you have. It is written to meet the Nigeria Data Protection Act 2023 (the “NDPA”) and, where it applies to you, similar laws such as the GDPR.

1. Who we are, and our two roles

Harvhills Payroll is operated by Harvhills Solutions, Lagos, Nigeria (“we”, “us”). You can reach us at admin@harvhills.com.ng or +234 805 924 4380.

We act in two different roles, and the rules differ:

As a data controller for the account and billing data of the people who sign up and manage a payroll account (the bureau or company owner and their team). We decide why and how that data is used.
As a data processor for the employee and payroll data that a bureau or company enters into Harvhills Payroll about its own staff and its clients’ staff. In that case the bureau or company is the controller: it decides what is collected and why, and we only process the data on its instructions, to provide the service.

2. What we collect

Data we collect, why, and the legal basis
Data	Why we need it	Legal basis (NDPA)
Account holders: name, work email, password (stored only as a one-way hash), two-factor authentication secret (stored encrypted) and recovery codes (hashed)	To create your account, verify your email, sign you in securely and send account emails (verification code, password reset, invitations).	Contract; legitimate interests (security)
Company details you give us: company name, and optionally website, phone number and address; RC number, TIN, pension and other statutory registration numbers you add later	To set up your workspace and print your company details on payslips and reports. Website, phone and address are optional.	Contract
Subscription and payment records: plan, billing period, amount, VAT, Paystack payment reference and status, receipt number	To bill you, issue receipts and meet tax and accounting duties. We never see or store your card number — you pay on Paystack’s own secure page.	Contract; legal obligation
Employee and payroll data entered by customers: names, date of birth, contact details, bank account details, tax ID (TIN), pension (RSA PIN), HMO and rent-relief information, salary, deductions, attendance, loans, payslips and uploaded documents	To calculate pay and statutory deductions (PAYE, pension, NHF, NSITF, ITF and similar), produce payslips and payment files. We are the processor of this data (see section 1).	Set by the customer (controller), typically contract and legal obligation
Security data: IP address and browser type attached to sign-in sessions, sign-in attempts (email + IP), and an audit trail of important actions (who did what, when)	To detect and block password-guessing, protect accounts, and give you a record of changes to your payroll data.	Legitimate interests (security and fraud prevention)
Your messages to us (support emails)	To answer you.	Legitimate interests

We do not use advertising or analytics trackers, we do not sell personal data, and we do not use it to build marketing profiles. We do not make decisions about people by automated means that have legal or similarly significant effects: payroll calculations are arithmetic on the rules and figures configured by the customer and platform, and a person approves them.

Only service providers that we need to run the product, each bound to protect the data:

Paystack — processes subscription payments. It receives your name/email, the amount and reference. It does not receive employee or payroll data.
Our email delivery provider (an SMTP service) — delivers account emails and, where a customer uses the feature, payslip emails (which contain the payslip PDF).
Hosting and infrastructure providers — the servers and backups the service runs on.

We may also disclose data where the law, a court or a regulator requires it, or to protect our rights and the safety of others. Within a customer’s own account, data is visible only to the people that customer gives access to, according to the roles they set. Customers cannot see one another’s data.

4. Transfers outside Nigeria

Some providers above (for example Paystack’s or an email provider’s infrastructure) may process data outside Nigeria. Where that happens we rely on appropriate safeguards required by the NDPA, such as contractual protections and the provider’s own security commitments.

5. How long we keep data

Sign-in attempts: 30 days. Rate-limit counters: 1 day. Sessions: until they expire (after 2 hours of inactivity or 24 hours in total — 30 minutes and 8 hours for people who can approve or pay payroll) and removed within a day after that. Password-reset, invite and verification tokens: deleted within 7 days after they expire or are used.
Account, company and payroll data: for as long as the account exists. Lapsed subscriptions are not deleted automatically — you can renew and carry on, or ask us to export or delete your data at any time.
Payment and billing records: as long as tax and accounting law requires us to keep them (commonly six years in Nigeria), even if you close your account.
Audit trail: for the life of the account, because it is part of the evidence of how payroll figures were produced.

When you ask us to delete an account, we delete or irreversibly anonymise its personal data within 30 days, except records we are legally required to keep. Backups roll off on our normal backup schedule.

6. How we protect data

Each customer’s data is separated from every other customer’s at the database level and in the application. Passwords are stored as one-way hashes; two-factor authentication is available and is required for company owners; two-factor secrets are encrypted; sessions time out after inactivity (stricter for people who can approve or pay payroll); repeated failed sign-ins are rate-limited; and connections are protected with HTTPS. Important actions are written to an audit trail. No system is perfectly secure, so if a breach affecting your data occurs we will tell you and the Nigeria Data Protection Commission within the time the law requires.

7. Your rights

You can ask us to: tell you what we hold about you (access); correct it; delete it; restrict or object to certain uses; give you a portable copy; and withdraw consent where we rely on it (withdrawing does not affect what happened before). Email admin@harvhills.com.ng and we will respond within 30 days. We may need to confirm who you are first.

If you are an employee whose data sits in a company’s or bureau’s payroll: that organisation is the controller of your payroll data, so please send requests about it to them. If you contact us instead, we will pass your request to them and help them respond.

If you think we have mishandled your data you may complain to the Nigeria Data Protection Commission (ndpc.gov.ng). We would appreciate the chance to fix it first.

8. Children

Harvhills Payroll is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children for our own purposes. Employers are responsible for lawfully handling any young workers’ data they enter.

9. Cookies

We set only the cookies needed to sign you in and keep forms secure. Details are in our Cookie Policy.

10. Changes to this policy

If we change this policy in a way that matters, we will update the date and version above and notify account holders by email before the change takes effect. Previous versions are available on request.

11. Contact

Harvhills Solutions · Lagos, Nigeria · admin@harvhills.com.ng · +234 805 924 4380