Privacy policy

Who is responsible for your data

[[Add: business.legalName]], CAC registration [[Add: business.cacNumber]], of [[Add: business.street]], [[Add: business.city]], [[Add: business.state]], Nigeria, is the controller of the personal data described here. In this policy, "we" means [[Add: business.legalName]], trading as KitBroker. Contact us about your data at [[Add: business.privacyEmail]].

What we collect, and why

We do not collect card or bank details. You enter them on the payment provider's page. We do not ask for identity documents or ID numbers, and the chat assistant is told not to ask for them either.

Who receives your data

We use these service providers to run the site. They process data on our instructions.

• Supabase: database and sign-in. Data location: [[Add: Supabase region]].
• Paystack and Monnify: payment processing. They act as independent controllers for the payment details you give them.
• n8n: the automation that handles orders, payments and the chat.
• An AI language model provider (currently OpenAI): the text of your chat messages is sent to it to produce answers.
• Messaging and notification services we use to send order updates and internal alerts: we send order and request updates to customers, technicians and suppliers by email through Gmail, and internal alerts to our team through Telegram. We do not send customer messages by WhatsApp or SMS.
• Our web host: [[Add: hosting provider]].
• Google Analytics, only if you accept analytics cookies.
• The technician assigned to your order receives your name, phone number and address so they can do the job.
• The supplier of the materials for your job, when we order them for you, receives your name, phone number, the address of the site and a map link, so the driver can find you and call on arrival. They do not see your email address or any price you pay. We also give you a 6 digit delivery code: you give it only to the lead technician, who checks the delivery against the order and takes a picture and a serial or batch number of each item. We keep these delivery records for [[Add: retention period for delivery records, reviewed by your lawyer]].
• The lead technician of your job, once you have paid and the materials are in hand (or are not needed), receives your name, phone number and the address of the site, and chooses a start day. We email you that day, show it under My requests, and record the day and the time the technician says work began, with the rest of your job records.
• A technician's picture is optional. If a technician adds one, it is public on his page, so visitors can see who is coming.
• Pictures of the finished work are taken by the lead technician and stored privately. Only you, your technician and KitBroker can see them. We keep them, with your confirmation or the problem you report and our decision, as part of your job records for [[Add: retention period for work pictures and pay records]].
• Reviews and answers are public. When your job is confirmed or closed you can rate each technician who worked on it, the lead and any assistant, from 1 to 5 and add a comment for each. It appears on the technician's page at once, with your rating and comment but never your name, and you can change it for a few days. The technician can answer it or ask KitBroker to look at it (only KitBroker reads that complaint), and KitBroker can hide a review that breaks our rules. We keep reviews, answers and the record of who wrote them for [[Add: retention period for reviews]].
• An assistant technician on your job, when the lead technician needs help and you have paid, is first offered the task and roughly how far away the site is (in bands of kilometres), with no address, name or phone number. The one who accepts receives the address of the site and the lead technician's phone number. He does not receive your name or your phone number.
• Technicians we offer your inspection request to see only what you wrote, your pictures, the type of work and roughly how far away you are (in bands of kilometres). They do not see your address, map location, name or phone number. The one technician who says yes receives your name, address, map location and phone number only after you have paid the inspection fee.

We do not sell your data. We may disclose it where the law requires.

If you send an inspection request

Your request goes first to the technicians nearest to the place you give, then to others further away if nobody answers in time. Offers are shown only to technicians who are approved, have signed our agreement and are marked available. The pictures you upload are stored privately. A technician can open them only while an offer to him is open or while he is held for your request, through links that stop working after a few minutes. You see the inspection fee only after a technician has said yes, you decide whether to pay it, and nothing is charged if you decline or do not answer. We tell you and the technicians about offers and decisions by email and on the site.

Please do not photograph people, documents or anything you would not want a technician to see. Pictures should show the place and the equipment. We keep requests, pictures and the record of who was offered the request and what they answered for [[Add: retention period for inspection requests and their pictures, and for requests that were closed without a visit]]. [[Add: legal review of this section]]

If you apply to work with us as a technician

When you apply we collect the answers you give, your ID photo, selfie, photos of past work, your referees and emergency contact, and the home location you give us (map coordinates). We use them to decide whether to offer you work, and, if you are approved, to offer you jobs by distance. Your referees and emergency contact are asked to confirm only what you have told us.

Applications are first checked by software for missing or invalid details and for exact matches with other applications. An AI tool then reads your written answers and looks at the photos you upload (your ID, selfie, workbench photo and job photos) to check that each one is what it should be and that your answers fit together. The AI is not asked for your ID number or address and its notes do not include them. The photos are sent to the AI service provider for this check.

A person makes the decision on whether to approve you. The only things the system does by itself are these: it sends an application back, with the reason, when a photo cannot be used (for example it is not an ID, or it is too blurry to read); and it closes an application, with the reason, when a photo contains clearly inappropriate content or the same unusable files are sent again after we asked once. You are told the reason each time, and KitBroker can reopen an application closed by mistake. You can make up to 3 applications.

We keep documents from declined applications for [[Add: confirm retention for declined applications, set to 90 days in the system]] and then delete them. [[Add: legal review of this section, the lawful basis for processing ID documents and the AI tool provider's data location]]

If you sign the technician agreement

When you sign electronically we record the typed name you gave, the email address you signed in with, the phone number the one-time code was sent to, your IP address, your device details, the time, and your consent to sign electronically. We make a signed copy of the agreement and this record, keep it, and send it to you and to KitBroker. The record cannot be edited afterwards. [[Add: confirm how long signed agreements are kept, reviewed by your lawyer]]

Transfers outside Nigeria

Some of these providers process data outside Nigeria, including for the AI chat. Where that happens we rely on the safeguards the Nigeria Data Protection Act 2023 allows. [[Add: legal review of the transfer mechanism]]

How long we keep it

• Account details: until you delete your account.
• Inspection requests and their pictures: [[Add: see the retention period in the inspection request section above]].
• Orders and payment records: [[Add: retention period for orders, for example the period required for tax records]].
• Chat messages: [[Add: retention period for chat messages]].
• Server logs: [[Add: retention period for logs]].

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, and move it to another provider. Where we rely on your consent, you can withdraw it at any time. Sign in and open the Privacy tab of your account to start a request, or email [[Add: business.privacyEmail]]. We confirm your identity first and reply within [[Add: response period]].

You can also complain to the Nigeria Data Protection Commission.

Security

The site is served over HTTPS. Passwords are hashed by our sign-in provider, and each signed-in customer can read only their own orders. Payments are made on the providers' hosted pages. No system is perfectly secure. If a breach affects you, we will tell you and the regulator as the law requires.

Children

The site is for adults. We do not knowingly collect data from anyone under 18.

Cookies and local storage

See the cookie policy.

Changes

If we change this policy in a way that matters, we will change the date at the top and tell account holders by email.