Privacy Policy

• Who we are. ProtenConnect is a job platform run by Proten International Limited, a company registered in Nigeria. We are the Data Controller of your Personal Data.
• What we collect. Your account and profile details, your CVs, the applications you send or receive, messages about them, and the security records that protect your account.
• AI is part of how ProtenConnect works. We use Artificial Intelligence to read CVs into profiles and to assess how well an application fits a job. AI never makes hiring decisions.
• Employers see what you send them. When you apply for a job, that Employer receives your application. Your profile visibility setting controls who else can see your profile.
• We do not sell your data. We do not use it for advertising, and we set no advertising cookies. With your permission, we use Google Analytics and Microsoft Clarity to understand how the Platform is used.
• Where your data is stored. On our servers in Paris, France, in the European Union. Some service providers process data in other countries (sections 10 and 11).
• Your rights. You can access, download, correct and delete your Personal Data, among other rights. Most of this can be done in Settings → Privacy & data.
• Contact. [email protected]. You can also complain to the Nigeria Data Protection Commission.

The Data Controller for the Platform is:

Proten International Limited
RC number: 1317879
Registered Address: 13A Bishop Street, Ilupeju, Lagos, Nigeria
Email: [email protected]

Data Protection Officer: [email protected]. Send all questions and requests about your Personal Data here.

Employers are also Data Controllers. When you apply for a job, the Employer receives your application and decides for itself whether to progress it. Each Employer is responsible for its own use of the applications it receives. ProtenConnect does not make employment decisions on behalf of any Employer.

This Policy applies to Candidates, Employer Users, Visitors, and people we email on behalf of an Employer, for example a person invited to join an Employer's team.

It covers the Platform and the emails we send. It does not cover websites or services that the Platform links to, such as an Employer's own website. Those have their own privacy policies.

Read this Policy together with our Terms of Service and our Cookie Policy.

1. At sign-up. You must accept our Terms of Service and this Privacy Policy before you can create an account. We record which version you accepted and when. If you do not accept them, you cannot create an account, and we do not process your Personal Data beyond what is needed to show you the public Platform.
2. What acceptance covers. By accepting, you acknowledge the processing this Policy describes as part of the Services, including the use of AI to read CVs and assess applications (section 7). This processing is necessary to provide the Services you sign up for.
3. What needs your separate consent. Some things are asked for separately, are never pre-ticked, and can be withdrawn at any time without affecting the rest of the Services:
   • analytics cookies, used by Google Analytics and Microsoft Clarity (section 12);
   • marketing emails and newsletters (section 16); and
   • search personalisation, where the Platform remembers your searches to suggest jobs.
4. Withdrawing consent does not affect processing carried out before you withdrew it.

5.1 Everyone with an account

5.2 Candidates

5.3 Employers and Employer Users

5.4 Messages and emails

5.5 Security, audit and usage records

5.6 Personal Data from other sources

• Google or LinkedIn, if you choose to sign in with them.
• Employers, who add to your application record as they review it: stages, notes, scorecards, offers.
• Your colleagues, who may invite you to an Employer's team using your email address.
• Our previous platform, if you had an account there (section 19).

5.7 Data we do not ask for

We do not ask for your date of birth, gender, religion, ethnicity, health or any other Sensitive Personal Data. Leave it out of your CV and profile unless you want Employers to see it.

Under the NDPA (s.25), we need a lawful basis to process Personal Data. We rely on four:

• Contract: the processing is necessary to provide the Services you signed up for.
• Legitimate interest: the processing is necessary for our legitimate interests, or those of Employers or Candidates, and does not override your rights.
• Consent: you have given specific consent, which you can withdraw.
• Legal obligation: the law requires it.

Where we rely on legitimate interest, you have the right to object (section 17).

7.1 How we use AI

We use AI to:

• Read your CV. When you upload a CV, it is sent to an AI model, which suggests profile details such as your work experience, education and skills. For a scanned CV, the image of the document is sent, not only its text. Nothing is added to your profile until you accept each suggestion.
• Assess applications. When you apply for a job, your application (CV, cover letter and answers) and the job description are sent to an AI model. It returns a fit score from 0 to 100 with the reasons. Both you and the Employer can see the score and the reasons.

Job matching, which suggests jobs that fit your profile, does not use AI. It uses rules we wrote, and shows you the reasons for each match.

7.2 Personal Data involved

The content of your CV, cover letter, answers to screening questions, and the job description. We do not send your password, sign-in or security data to any AI model.

7.3 Human oversight and fairness

• AI never makes hiring decisions. An AI score is information for the Employer's reviewer. It never rejects, shortlists or hires anyone by itself.
• Employers' screening questions. An Employer may set screening questions with required answers. If your answer does not meet a requirement the Employer set, your Application may be declined automatically. You can ask the Employer to review it.
• AI output cannot act on its own. It cannot change your profile, move an application or send an email.
• AI can be wrong. Scores and suggestions can be inaccurate. Check suggestions before accepting them. Employers are told that a score supports their judgement and does not replace it.
• Candidate text is treated as data, not instructions, before it reaches a model, so a CV cannot manipulate its own score.

7.4 AI infrastructure

AI processing is carried out by third-party AI model providers acting as our Data Processors, in the United States and other countries (section 11). We ask them not to retain your Personal Data or use it to train their models. We keep the outputs (suggestions and scores) on our own servers. Suggestions are deleted once you accept or reject them, and in any case within 30 days.

7.5 Your choices

AI processing is part of the Services. If you do not want your CV or applications processed by AI, do not create an account. If you already have one, you can close it at any time (section 15). You can always ask us to explain a score, or ask an Employer to review your application in person.

We do not sell your Personal Data, and we do not share it for advertising.

We share Personal Data only with:

1. Employers you apply to. When you apply, we send that Employer your application: the CV attached to it (not your other CV versions), your cover letter and answers, your profile, and the AI score.
2. Employers, for your contact details. An Employer can reveal your email address and phone number at any stage of an application to it. Each reveal is a deliberate action, recorded in our audit log with the name of the person who made it, and you are notified.
3. Employers, through your profile visibility. You choose who can find your profile: everyone, verified Employers only, only Employers you have applied to, or no one. The default is only Employers you have applied to.
4. Employers' talent pools. An Employer that does not progress your application can keep you in its talent pool for future roles. The entry ends 12 months after the application was closed.
5. The Employer's team, being the Employer Users with access to the job.
6. Our staff, to verify Employers, review jobs, answer support and data requests, and investigate abuse. Staff access is logged.
7. Data Processors acting on our instructions under contract (section 10).
8. Regulators, courts and law enforcement, where the law requires it.
9. A successor business, if ProtenConnect is sold, merged or restructured. We will tell you before your Personal Data becomes subject to a different privacy policy.

• Talent pools are described in section 8(4). They end 12 months after the application was closed.
• Job alerts are emails you set up, based on the preferences or searches you choose. You can change or switch off any alert in Settings.
• Saved searches are stored only if you have turned on search personalisation. Turning it off deletes your stored searches.

Most of the Platform runs on our own servers: the database, file storage, job processing, virus scanning and location lookup. These Data Processors work on our behalf:

Each Data Processor may use Personal Data only to provide its service to us, and must protect it.

Our servers are in Paris, France. Your Personal Data is therefore stored outside Nigeria, in the European Union, where the EU General Data Protection Regulation applies. Some Data Processors (section 10) also process data in the United States and other countries.

We transfer Personal Data outside Nigeria only where the NDPA (ss.41–43) and the GAID allow it, namely where:

1. the recipient country, or the recipient, provides an adequate level of protection as assessed under the NDPA, or as recognised by the NDPC;
2. the transfer is governed by binding contractual terms, such as a data processing agreement and standard contractual clauses, that give protection at least equal to the NDPA;
3. the transfer is necessary to perform our contract with you, for example sending your CV to an AI model to provide the Services; or
4. you have consented to the transfer after being told of the possible risks.

By agreeing to this Policy, you consent to the transfer and storage of your Personal Data outside Nigeria as described here. You can ask us which safeguard applies to any transfer.

We use two kinds of cookie:

1. Strictly necessary cookies, which keep you signed in, let you create an account, confirm your email and protect sign-in. Cloudflare, which carries our traffic, may also set a security cookie. These cookies are needed for the Platform to work, so the GAID (Art. 19) does not require your consent for them.
2. Analytics cookies, used by Google Analytics and Microsoft Clarity to show us which pages are used, where people get stuck and how we can improve the Platform. Microsoft Clarity can also record how you move through a page, with typed text and page content masked. We set analytics cookies only if you select Accept in our cookie banner. Reject is offered with equal prominence, and you can change your choice at any time from the link in the footer.

We use no advertising cookies, and analytics data is never used to target you with advertising. Analytics data is processed by Google and Microsoft in the United States (section 11). The full list of cookies, with how long each lasts, is in our Cookie Policy.

We protect Personal Data with technical and organisational measures, including:

• encryption of all traffic to and from the Platform (HTTPS);
• passwords stored only as one-way hashes, and server-side sessions that end when you sign out;
• session cookies that page scripts cannot read and that are sent only over HTTPS;
• mandatory two-step verification and 8-hour sessions for staff, and optional two-step verification for Employer Users;
• private storage for CVs, cover letters, verification documents and message attachments, opened only through short-lived links, with every CV view logged;
• a virus scan and file-type check on every upload before anyone can open it, and removal of hidden image metadata, including GPS location;
• no storage of raw IP addresses, and a tamper-evident audit log; and
• error reports filtered to remove Personal Data before they leave our servers.

No system is completely secure. If a personal data breach is likely to put your rights and freedoms at risk, we will notify the NDPC within 72 hours of becoming aware of it. Where the risk to you is high, we will tell you directly and without undue delay (NDPA s.40).

We keep Personal Data only for as long as we need it for the purposes in this Policy, or as the law requires. Scheduled jobs then delete or anonymise it.

You can ask us to delete your account at any time from Settings → Privacy & data → Delete account. Employer Users can email [email protected].

1. Grace period. Deletion takes effect 30 days after your request. You can cancel by signing in during that time.
2. What we delete. Your CVs, attachments, photo, profile, sign-in details, notifications and team memberships. The text of messages you wrote is removed.
3. What remains. Applications you sent stay with the Employer without your name, contact details, CV or cover letter, because they also form part of the Employer's hiring record. The audit log is never altered. Agreements and consents are kept as set out in section 14.
4. Backups. Copies in backups expire within 30 days.

We may keep data for longer where the law requires it, or to establish, exercise or defend a legal claim.

• Service emails, such as email confirmation, application updates, messages and security alerts, are part of the Services. You can choose which notifications you receive in Settings → Notifications. Security emails cannot be switched off.
• Job alerts are sent only when you set them up, based on the preferences or searches you choose. You can change or stop them at any time.
• Marketing emails and newsletters. We do not send any at present. If we start, we will send them only to people who have given separate consent, and every one will include an unsubscribe link.

Under the NDPA (ss.34–38), you can exercise the following rights with ProtenConnect:

1. Access: request a copy of the Personal Data we hold about you.
2. Rectification: correct inaccurate or incomplete Personal Data.
3. Erasure: ask us to delete your Personal Data (section 15).
4. Portability: receive your Personal Data in a structured, machine-readable format.
5. Restriction: ask us to limit processing while a concern is resolved.
6. Objection: object to processing based on legitimate interest. We will stop unless we have compelling grounds that override your interests.
7. Withdrawal of consent: withdraw any consent you have given, without affecting processing before the withdrawal.
8. Automated decisions: not to be subject to a decision based solely on automated processing that significantly affects you. AI never makes such decisions. Where an Employer's screening question declines an Application automatically, you can ask the Employer to review it (section 7.3).
9. Complaint: complain to the NDPC (section 21).

How to exercise your rights.

• Download your data: Settings → Privacy & data → Download your data. We email you a link that works for 24 hours, only while you are signed in. The file, a single JSON file, is never attached to an email.
• Correct your data: edit your profile and account settings directly.
• Everything else: email [email protected] from the address on your account.

We will acknowledge your request within 5 working days and respond within 30 days. If a request is complex, we may extend this and will tell you why. We may ask you to confirm your identity before acting on a request. Requests are free unless they are clearly unfounded or excessive.

The Platform is for people aged 18 or over. We do not knowingly collect Personal Data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.

ProtenConnect has been rebuilt. If you had an account on the previous platform:

1. Your data has been moved. Your account, profile, CVs, applications and company records were moved to the new Platform and are now governed by this Policy.
2. Your password was not moved. No passwords, sign-in tokens or two-step secrets were copied. You will receive a one-time activation link. Activating your account records your acceptance of the current Terms of Service and this Policy. If you sign in with Google or LinkedIn, you still need to activate once.
3. An archive of the previous platform is held encrypted, separately from the Platform, for 6 months after the move, then destroyed. It is used only to verify that the move was complete. If you ask us to delete your data, we apply that request to any restore from the archive.
4. What has changed since the policy dated 6 June 2026:
   • we no longer use Vercel or Supabase, and the Platform now runs on our own servers in France;
   • Microsoft Clarity, and now Google Analytics, are used only if you accept analytics cookies;
   • the AI providers, cookies and retention periods have changed (sections 7, 12 and 14); and
   • our privacy contact is now [email protected].
5. Notice before the move. We will email you at least 14 days before your account is moved, with a link to this Policy, our Cookie Policy and our Terms of Service.

European Union and United Kingdom

If the EU General Data Protection Regulation or the UK GDPR applies to our processing of your Personal Data:

• Controller: as in section 2.
• Legal bases: as in section 6, corresponding to GDPR Art. 6(1)(b) contract, (f) legitimate interests, (a) consent and (c) legal obligation.
• Your rights: those in section 17, plus the right to complain to your local data protection authority. In the UK, that is the Information Commissioner's Office (ico.org.uk). We respond within one month, extendable by two months for complex requests.
• Transfers: your Personal Data is stored in France. Where it is transferred to a country without an adequacy decision, we rely on standard contractual clauses (with the UK addendum where relevant).
• Automated decisions: we make none that produce legal or similarly significant effects (GDPR Art. 22). See section 7.3.

To ask about this Policy or exercise your rights, contact:

Proten International Limited (RC 1317879)
13A Bishop Street, Ilupeju, Lagos, Nigeria
Email: [email protected]
General support: [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

We may update this Policy, our Cookie Policy and our Terms of Service. Whenever any of them changes, we will email account holders at least 14 days before the change takes effect, and display a notice on the Platform. The version and date at the top of each document show when it last changed, and we record which version each user has accepted.