Data processing

Employers and agencies use Cadre to keep records about their people and to pay them. This page summarises how we handle that data. The binding terms are in the data processing agreement that forms part of each customer's agreement with us.

Who is responsible

For the data a customer puts into Cadre about its people, the customer is the data controller under the Nigeria Data Protection Act 2023, and Noddit Technology Limited, RC 7761794 is its data processor. We use that data only to provide Cadre to the customer, on the customer's documented instructions.

Where an employee chooses to open a Noddit wallet or to get paid early, Noddit provides that service to the employee under its own terms, and is responsible for the data it needs to do so. Cadre sends Noddit only what the employee agrees to.

What we commit to

• Process customer data only on the customer's instructions and for no purpose of our own.
• Keep each organisation's data separate: every record belongs to one organisation and every request is checked against it.
• Limit access to the people who need it to run the service, under a duty of confidentiality. Support access to an organisation is recorded in its audit log.
• Protect data with encryption in transit, access controls, backups and an audit log of changes.
• Tell the customer without undue delay about a personal data breach affecting its data, with what it needs to meet its own duties under the NDPA.
• Help the customer answer its people's requests to exercise their rights.
• Return or delete the customer's data when the agreement ends, as the agreement sets out.

Sub-processors

We use these providers to run Cadre. Each is bound by written terms at least as protective as ours.

• [TO CONFIRM: server hosting provider]: the servers Cadre runs on.
• Cloudinary: storage of documents and files uploaded to Cadre.
• Google Maps Platform: maps and address search for work locations, when an organisation uses them.
• Anthropic: the optional writing assistant for reviews, when an organisation switches it on.
• Noddit: salary payments, wallets and early pay, when an organisation or employee uses them.

We will tell customers before we add or replace a sub-processor, so they can object.

Where data is kept

[TO CONFIRM: where production data is hosted.] Where a sub-processor stores data outside Nigeria, we rely on the transfer safeguards the NDPA allows.

Questions

Customers can ask for the full data processing agreement, or write to privacy@cadrepeople.com.