This policy explains how Punctual handles personal information. Punctual is operated by Daarun Najaah Global Services ("DNGS", "we"), Nigeria. We aim to follow the Nigeria Data Protection Act 2023 (NDPA) and, where relevant, comparable laws.
1. Our role
- Organisation data — staff profiles, attendance and location records an organisation puts into Punctual. The organisation decides what is collected and why (the "controller"); we process it on the organisation's behalf to run the service (the "processor").
- Account, billing and website data — information about Admins, subscriptions and visitors to our site. For this we are the controller.
2. What we collect
| Data | Why |
|---|---|
| Name, email, phone (optional), employee ID, department, role | Create and manage accounts and staff lists |
| Clock-in/out times, sessions, breaks, permissions, shifts, leave and requests | Attendance records, reports and alerts |
| GPS coordinates at clock-in/out (and during a Permission session only if the Admin turned on Live Location Tracking, with an on-screen notice to the staff member) | Verify presence within the workplace radius; show the live movement map where enabled |
| Profile photo and a numeric face descriptor derived from it; selfies for remote clock-in requests | Face-match checks and remote-approval review. Where enabled, biometric login uses your device's own fingerprint/face unlock; we do not receive that biometric data |
| Device type/browser and a device registration identifier; IP address when an IP-address lock is enabled | Stop credential sharing and enforce network rules |
| Subscription and payment status (payments are handled by our payment partner) | Activate plans and prevent fraud |
| Messages and announcements sent inside the app | Provide in-app messaging and the inbox |
We do not sell personal data and we do not use it for advertising.
3. Face data and location — special care
Photos and face descriptors are used only for attendance verification inside the organisation's workspace. Admins can delete a staff photo, after which the staff member is prompted to retake it. Location is collected at clock-in and clock-out; continuous tracking is off unless an Admin enables Live Location Tracking, and then only during Permission sessions with a visible notice. Organisations must tell their staff about this and have a lawful basis for it.
4. Who we share data with
Only with service providers needed to run Punctual, under confidentiality and security obligations: Google Cloud / Firebase (hosting, database, authentication, functions); our payment partner (Fincra); and, only if an Admin configures them, messaging or email channels such as WhatsApp alert gateways or a Google Apps Script email webhook. The app also uses third-party lookups for currency and network checks (for example IP-location and exchange-rate services and an IP-address lookup service) and Google reCAPTCHA for abuse protection. We may disclose data where the law requires it.
5. International transfers
Our infrastructure providers may process data outside Nigeria. We rely on providers that apply recognised security standards and contractual safeguards.
6. How long we keep data
Organisation data is kept while the organisation's account is active so records and reports stay available. When an organisation ends its subscription it may ask us to export or delete its data; unless the law requires otherwise we delete or anonymise it within 90 days of a verified deletion request. Individual attendance records may be kept by the organisation for its own legal record-keeping needs.
7. Your rights
Under the NDPA you may ask to access, correct, delete or receive a copy of your personal data, object to or restrict certain processing, and withdraw consent where processing relies on it. Staff should first contact their organisation's Admin, who controls their records; you can also write to us at support@afrisalespro.com and we will help or direct your request. You may also complain to the Nigeria Data Protection Commission.
8. Security
We protect data with encryption in transit, per-organisation data isolation, role-based access and the other measures described in our Security Policy. If a breach affecting personal data occurs we will notify affected organisations without undue delay and, where the law requires, the regulator within 72 hours.
9. Children
Punctual is for staff and administrators, not for children, and we do not knowingly collect data from anyone under 18.
10. Changes and contact
We will post updates here and tell Admins about material changes. Questions: support@afrisalespro.com.