1. Who we are
“ConfamHire”, “we” and “us” mean ConfamHire, Lagos, Nigeria. We provide pre-employment background verification: identity, address, guarantor, education, employment history, character, social media and (optionally) drug-test checks.
Questions about this policy or your data go to our Data Protection Officer at privacy@confamhire.com.
2. Our role: controller or processor
When an employer or staffing agency (our client) asks us to verify a candidate, the client decides who is checked and which checks are run. For that work we generally act on the client's behalf as a data processor, and the client is the data controller. We process candidate data only on the client's documented instructions and under a written agreement.
We act as a controller for our own records: consent records, audit logs, dispute handling, our client relationships and this website.
3. Candidates: what we collect and why
Depending on the checks the client orders, we may collect:
- Identity: full name, date of birth, phone number, NIN or BVN, photo ID, and a selfie for liveness and face-match checks.
- Address: residential address, and photos and notes from a field agent's visit (geotagged and timestamped).
- Guarantor: the guarantor's name, NIN, workplace, address and phone number, a recording of our verification call, and their signed undertaking.
- Education: certificates, exam numbers (WAEC/NECO), institution and NYSC details, and confirmation from the issuing body.
- Employment history: past employers, job titles, dates, and confirmation from those employers.
- Character: police character certificate details, results of court-record searches and adverse-media searches.
- Social media: links to public profiles we have matched to the candidate (and how we matched them), and screenshots of public posts that fall into our flag categories, with dates.
- Drug test (optional): the result reported by a partner laboratory.
We use this data only to carry out the checks the client ordered, prepare the verification report, handle disputes, and keep the records we are legally required to keep. We do not sell candidate data or use it for marketing.
Some of this is sensitive personal data under the NDPA, in particular the biometric data from face matching and any health data from drug tests. Criminal-record information gets the same extra care. We process it only with your explicit consent, and only when the check needs it.
Social media screening looks only at content the candidate has made public. We never ask for passwords, log in as the candidate, send friend or follow requests, or join private groups. We count a profile as the candidate's only when at least two identifiers match (a name alone is never enough). We report only content the candidate posted that falls into defined, job-relevant categories (violence and threats, harassment, hate speech, fraud and other illegal activity, drug use, sexually explicit content, leaks of employer or customer information, and contradictions with their application), and a second analyst reviews every flag. We never report religion, ethnicity, political views, health, sex life, family life or other private matters.
Raw NIN and BVN numbers: we use them to run the lookup through a licensed provider and then keep only a masked version (for example, the last four digits) and the result.
4. Consent
Before any check starts, we send the candidate a link that explains which checks the client has requested, who the client is, and what will happen to the data. We record the candidate's explicit consent (when, how, and to which checks) before going further. If a candidate does not consent, we run no checks and tell the client the candidate declined.
You can withdraw consent at any time by contacting privacy@confamhire.com or replying to our WhatsApp message. We stop any checks still in progress. Withdrawal doesn't affect checks already completed, and we tell the client that consent was withdrawn.
Guarantors and referees are asked for their own consent before we verify their details or record a call with them.
5. Where we get information
Our core rule is to verify against the issuing source, never against contacts the candidate supplies. So, besides the candidate, we collect information from:
- government identity databases, accessed through licensed identity-verification providers;
- schools, universities, exam bodies (such as WAEC and NECO) and NYSC;
- past employers, contacted through official channels we find ourselves, after confirming them on the Corporate Affairs Commission register;
- the police, courts and public records, and publicly available news sources;
- neighbours, landlords and guarantors during address and guarantor checks;
- publicly available social media profiles and posts, for social media screening;
- partner laboratories, for drug tests.
6. Clients and website visitors
For clients and prospective clients we collect business contact details (name, job title, company, work email, phone), what you tell us about your hiring needs, contracts, invoices and payment records, and our correspondence with you.
For website visitors, this site collects no personal data unless you choose to contact us. If you sign up for a free check or message us on WhatsApp or by email, we receive what you send. Our hosting provider keeps basic technical logs (such as IP address and browser type) for security.
If we contact you about our services, we do so at your business address, individually, and every message tells you how to opt out.
7. Lawful bases for processing
Under section 25 of the NDPA, we rely on:
- Consent: for candidate verification checks, and explicit consent for sensitive data;
- Contract: to deliver services to our clients and manage our agreements with them;
- Legal obligation: to keep records the law requires and respond to lawful requests from authorities;
- Legitimate interests: to secure our systems, prevent fraud, handle disputes and contact businesses about our services, where those interests are not overridden by your rights.
9. Transfers outside Nigeria
Some of our service providers (for example email, forms, messaging and hosting) may store data outside Nigeria. Where that happens, we transfer data only as Part VIII of the NDPA allows: to countries or organisations with adequate protection, or under appropriate safeguards such as contractual clauses, or with your consent after explaining the risks.
10. How long we keep data
We keep data no longer than we need it:
- ID images, selfies and other source documents: deleted within 30 days of the final report, unless a dispute is open.
- Verification reports, consent records and audit logs: kept for 24 months after the report so we can answer client audits and disputes, or longer if a client contract or the law requires it.
- Call recordings with guarantors: kept for 12 months.
- Client and billing records: kept for 6 years, as tax and accounting law requires.
- Enquiries that didn't lead to work: deleted after 24 months.
After these periods we delete data or anonymise it so it no longer identifies anyone.
11. How we protect data
We protect data with access limited to staff and agents who need it, encryption in transit, accounts secured with strong passwords and two-factor authentication, and confidentiality agreements. If a personal data breach is likely to put your rights at risk, we notify the Nigeria Data Protection Commission within 72 hours, as the NDPA requires. Where the risk to you is high, we tell you directly. If the data belongs to a client, we tell the client without delay.
12. Your rights
Under the NDPA you have the right to:
- be told how your data is used (this policy);
- get a copy of the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have your data deleted when we no longer have a lawful reason to keep it;
- restrict or object to processing in certain cases;
- receive your data in a portable format, where applicable;
- withdraw consent at any time;
- not be subject to a decision based solely on automated processing that significantly affects you. Every report we issue is reviewed by a person, and hiring decisions are made by the client, not by us.
To use any of these rights, email privacy@confamhire.com. We may ask you to confirm your identity first, and we will respond within 30 days. If we processed your data for a client, we may pass your request to that client and help them respond.
13. Disputing a result
If you are a candidate and believe a result in your report is wrong, tell us at privacy@confamhire.com with your name, the client's name and what you believe is incorrect. Send any supporting documents you have. We will:
- acknowledge your dispute within 3 working days;
- re-check the disputed item with the original source;
- tell you the outcome within 15 working days where possible;
- issue a corrected report to the client if the result changes, and otherwise add a note to the report that it was disputed.
There is no charge for disputing a result.
15. Children
Our services are for checking adults for employment. We do not knowingly process data about anyone under 18. If we learn that we have, we delete it.
16. Changes to this policy
We will update this policy when our practices change and show the new date at the top. If a change is significant, we will tell our clients directly.
17. Contact and complaints
Data Protection Officer: privacy@confamhire.com
General enquiries: hello@confamhire.com
Address: Lagos, Nigeria
If you are not satisfied with how we handle your data or your complaint, you can complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
See also our terms.