Privacy notice

JDC is the data controller for personal data processed on Passa. Employers and recruiters who use Passa to hire act as separate controllers for the hiring decisions they make and for any data they export from the platform.

For any privacy question, request or complaint, write to hello@josonseth.com. We aim to reply within 30 days.

Passa is operated by JDC. We are not currently registered with the Nigeria Data Protection Commission (NDPC) as a data controller of major importance. We monitor the thresholds published by the Commission and will register, and publish our registration reference here, if and when Passa meets them.

Account and identity data

Name, preferred full name, email address, phone number, password credentials held by our authentication provider, and the identity document you upload for verification.

Professional profile data

Headline, biography, location, work history, education, certifications, projects, skills, salary expectations, CV files and profile photograph.

Verification and reference data

Verification requests and their status, referee names, referee email addresses, referee responses and ratings, employer confirmations and credential checks, with an audit trail of who confirmed what and when.

Assessment and interview data

Assessment answers and scores, AI interview recordings, transcripts and generated summaries, and liveness or biometric check outcomes where you apply for a physical Passa Card.

Hiring activity data

Applications, application stages, shortlist entries, recruiter notes, messages, offers, contact unlock events and profile view records.

Billing data

Subscription and plan history, invoices, transaction references, and the card brand, last four digits and expiry returned by our payment processor. Passa never stores full card numbers.

Technical and usage data

Sign-in events, audit events, search telemetry, error reports and cookie or local storage identifiers needed to keep you signed in.

Identity documents, interview recordings, assessment answers and biometric check results are treated as sensitive personal data. They are private by default, never shown on public pages, and only accessible to you and to authorised JDC reviewers.

Performance of a contract

Running your account, publishing your profile to the audience you choose, processing applications, subscriptions and payments.

Consent

Optional processing you switch on yourself: making your profile publicly visible, sharing your profile with an external reviewer, biometric checks for a physical Passa Card, unlocking your contact details to a recruiter, and non-essential cookies.

Legitimate interests

Keeping the platform secure, preventing fraud and duplicate identities, moderating the community, and improving verification quality. We weigh these against your interests before relying on them.

Legal obligation

Keeping billing, tax and audit records, and responding to lawful requests from regulators or law enforcement.

Where we rely on your consent, you can withdraw it at any time in the privacy centre inside your account. Withdrawing consent does not affect processing that already happened.

We do not sell personal data and we do not use it for advertising. Your profile is shared according to the visibility you choose (private, recruiters only, or public), plus:

• Recruiters and hiring teams you apply to, or who unlock your contact details on a paid plan.
• Referees, former employers and credential bodies you nominate, so they can confirm your record.
• External reviewers you deliberately share a profile with through a time-limited link.
• Service providers listed below, acting only on our instructions under a data processing agreement.
• Regulators, courts or law enforcement where we are legally required to disclose.

Passa runs on cloud infrastructure located outside Nigeria, so your data is transferred across borders. We rely on the transfer conditions in the Nigeria Data Protection Act 2023 (NDPA), including contractual data protection commitments with each provider, and we limit each provider to the data it needs.

Cloud hosting, database, file storage and authentication

Processed in: European Union and United States

Email delivery for notifications and verification invitations

Processed in: United States

AI models used for CV parsing, assessment generation and interview summaries

Processed in: United States

Paystack for card payments and subscriptions

Processed in: Nigeria

Account, profile and verification records

For as long as your account is open.

Deleted accounts

Erased within 30 days of a verified deletion request, except records we must keep by law.

Billing, invoice and payment records

Six years, to meet Nigerian tax and accounting obligations.

Security, audit and access logs

Up to 24 months, then deleted or aggregated.

Interview recordings and assessment answers

12 months after the related application closes, unless you delete them sooner.

Expired or revoked sharing links

Access records kept for 12 months so you can audit who opened a link.

AI is used to parse CVs, generate assessment questions, transcribe interviews and draft summaries. It is never used to hire or reject you, to infer protected characteristics, to analyse facial expression, or to score accents. Every AI output is labelled and reviewed by a person, and you can ask us for a human explanation of any AI output about you.

Right to be informed

Know what we hold, why, and who we share it with. This notice is that disclosure.

Right of access

Request a copy of your personal data. You can also download it yourself from the privacy centre.

Right to rectification

Correct inaccurate or incomplete data, including a mistyped referee email address.

Right to erasure

Ask us to delete your account and personal data where no legal obligation requires us to keep it.

Right to restrict processing

Set your profile to private, revoke sharing links, or ask us to pause processing while a dispute is resolved.

Right to data portability

Receive your data in a structured, machine-readable format (JSON).

Right to object

Object to processing based on our legitimate interests, and opt out of non-essential messages at any time.

Rights around automated decisions

No hiring decision on Passa is made solely by automated means. AI drafts summaries and questions for a human reviewer, and you can ask for a human explanation of any AI output about you.

Signed-in users can exercise all of these from the privacy centre at /app/privacy, including downloading a machine-readable copy of their data. Anyone else can email hello@josonseth.com. We may ask you to verify your identity before we act, and we will not charge you for a first request.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC). Contact us first at hello@josonseth.com so we can try to resolve it, and we will tell you the outcome in writing.

Access to data is controlled at the database level so each account can only read what it is entitled to. Sensitive files are stored privately and served through short-lived signed links. Administrative actions, profile visibility changes, sharing link access and contact unlocks are written to an audit trail. If a breach occurs that is likely to risk your rights, we will notify the Nigeria Data Protection Commission (NDPC) and affected users in line with the Nigeria Data Protection Act 2023 (NDPA).

Passa is for working professionals and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has registered, contact us and we will delete the account.

We update this notice when our processing changes. Material changes are announced in the product before they take effect, and the date at the top of this page always reflects the current version.