Privacy Policy
Version 2026-10-28.1 · Revised: 28 October 2026
This notice explains how Aerotech handles personal information when people use its recruitment and workforce services. It distinguishes Aerotech account administration from employment records managed on an employer’s instructions.
Controller and contact
Aerotech administers platform accounts and service security. The registered contracting entity and postal details require confirmation in your company agreement. Aerotech is the controller for its own account, security and service-administration processing. For employment and recruitment records uploaded by a company, that company ordinarily determines purposes and acts as controller; Aerotech processes those records under its instructions and applicable contract. . Privacy enquiries: aerotechhrsolutions@gmail.com. No individual DPO appointment is asserted as verified. Signed-in users can submit a tracked request through Privacy settings.
Information processed
Categories include names, contact details, account identifiers, credentials stored as password hashes, company and job details, CVs, education, qualifications, assessment answers and scores, interview records, employment history, attendance/location evidence, leave, performance, payroll/tax/pension, bank details, documents, support messages, security events and cookie preferences. Identity numbers and any health, disability or biometric information require additional safeguards and a specific justified purpose. Face data is processed only where enabled and with the necessary explicit consent or other applicable legal condition. . We do not request bank PINs or card security codes.
Purposes and lawful bases
Contract supports account access and requested services; legal obligation supports applicable employment, payroll and recordkeeping duties; legitimate interests may support proportionate fraud prevention, security and service reliability after balancing individuals’ rights; consent supports optional cookies, optional communications and any activity requiring consent. Sensitive data requires an additional applicable legal condition. Employers must identify their own lawful bases for workforce processing. Consent is not bundled with unrelated services and can be withdrawn prospectively. .
Recipients and processors
Records are accessible only to authorised users with a work-related need. Applications are shared with the hiring employer selected by the applicant. Service providers may supply hosting, database storage, transactional email, payment processing, identity checks and video meetings under appropriate contracts. Authorities or advisers may receive information where lawful and necessary. . We do not sell personal information.
International transfers
Some providers may process records outside Nigeria. Transfers must be assessed and supported by an applicable adequacy decision, enforceable contractual or organisational safeguards, or another lawful transfer basis. Where GDPR applies, its transfer requirements also apply. Assess destination-country risks, access controls and supplementary safeguards before transfer. .
Retention
Retention depends on the record, company instructions and applicable obligations. The platform does not apply a single automatic deletion period to all records. A document may have a configured retention date; expired library content is restricted and queued for cleanup. Viewed notices remain in history, while birthday notices leave the active inbox after their relevant day. Account erasure requires identity and retention review. Contact Aerotech or your employer for the applicable retention period and backup treatment.
Your rights
Subject to applicable conditions and exceptions, you may request information and access; correction; erasure; restriction; portability; objection, including to direct marketing; withdrawal of consent; and information about qualifying automated decisions with human intervention, an explanation and a way to contest outcomes. Withdrawal does not invalidate earlier lawful processing. Use Privacy settings or the published support contact. We verify identity proportionately and do not request excessive identity evidence. The service records an initial 30-day response target; any applicable shorter legal period or justified extension must be communicated. . No fee is normally charged unless law permits one.
Scoring and human decisions
Role assessments can be scored automatically from submitted answers. Employers review job-related evidence and make hiring and employment decisions. An assessment score alone is not a final rejection or hiring decision. You can request human review through Privacy settings. .
Security and incidents
Controls include encrypted transport, role/tenant checks, session controls and restricted administrative access. . Where a breach is likely to risk individuals’ rights and freedoms, notify the Nigeria Data Protection Commission within 72 hours of awareness as required by the NDP Act; document delay reasons and provide further information in phases where appropriate. Inform affected individuals without undue delay when the applicable high-risk threshold is met. Processors notify the controller promptly under the applicable law and contract.
Children
Aerotech is intended for adults aged 18 and over. Do not submit a child’s information unless a specifically supported service, lawful basis, appropriate age/guardian verification and safeguards are in place. . Contact us to flag suspected inappropriate collection.
Cookies and preferences
Essential cookies support authentication, security and the record of your choices. Optional preferences, analytics and marketing categories are separate and off by default until chosen. No analytics or advertising integration is activated merely by selecting a category. Read the Cookie Policy at registration or in the public footer; inside a workspace use Privacy settings.
Complaints and changes
Contact the published support contact to raise concerns. You may complain to the Nigeria Data Protection Commission at its official website, ndpc.gov.ng, without losing other rights. Where GDPR applies, you may also contact a competent supervisory authority. . Material policy changes should be communicated before new processing where required; fresh consent is obtained when required. Version 2026-10-28.1; revised 28 October 2026 . The NDPA 2023 and applicable NDPC guidance, with enduring NDPR 2019 principles and GDPR requirements where applicable, inform this notice.