Privacy Policy

GradJobber ("we", "us", or "our") is Nigeria's graduate career platform, connecting students, fresh graduates, employers, and universities. We are committed to protecting your personal data and respecting your privacy in accordance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR) 2019, and all guidelines issued by the Nigeria Data Protection Commission (NDPC). This Privacy Policy ("Policy") describes: • What personal data we collect from you • How and why we use it • Who we share it with • How long we keep it • Your rights as a data subject • How to contact us This Policy applies to all users of the GradJobber platform, including our website at gradjobber.com, mobile applications, and all related services (collectively the "Services"). By using our Services, you agree to the collection and use of information as described in this Policy. If you are under 18 years of age, please ensure a parent or legal guardian has reviewed this Policy before you use the Services.

GradJobber is the data controller responsible for your personal data collected through our Services. For privacy-related enquiries, please contact our Data Protection Officer (DPO): Email: privacy@gradjobber.com Address: GradJobber, Lagos, Nigeria We are registered with the Nigeria Data Protection Commission (NDPC) as required under the Nigeria Data Protection Act 2023. Depending on how you use our Services, "you" may be: • A Student or Graduate — using GradJobber to find jobs, internships, or NYSC postings. • An Employer or Recruiter — using GradJobber to post jobs and find talent. • A School Coordinator — using GradJobber to manage student career services. • A Visitor — browsing our website without a registered account.

We collect personal data in the following categories depending on the type of account you hold: A. Students & Graduates Information you provide directly: • Full name, email address, phone number • University or institution name, degree, graduation year • Location (city/state) • Profile photo (optional) • Resume / CV (uploaded document) • Portfolio items (links, project descriptions) • Cover letters and job application content • Skills, bio, and professional interests • Job alert preferences B. Employers & Recruiters • Full name, work email address, phone number • Company name, industry, size, location • Company logo and description • Job posting content (titles, descriptions, requirements, salaries) • Billing and payment information (processed via secure third-party providers) C. School Coordinators • Full name, work email address, phone number • Institution name, type, state, website • Career centre contact information • Student placement and event data entered on the platform D. All Users (automatically collected) • IP address and approximate geolocation (derived from IP) • Device type, browser type, and operating system • Pages visited, links clicked, and time spent on pages • Referring URLs • Session identifiers and authentication tokens We collect this technical data to operate and improve our Services, detect fraud, and ensure security. E. Communications When you contact us for support, submit feedback, or respond to surveys, we collect the content of those communications.

We process your personal data only for lawful purposes. Our legal bases for processing under the NDPA 2023 include consent, contract performance, legitimate interests, and compliance with legal obligations. Specifically, we use your data to: • Provide and operate the Services: creating and managing your account, matching you with job opportunities, processing applications, and facilitating employer-candidate communications. • Personalise your experience: recommending relevant jobs, employers, or schools based on your profile, skills, and preferences. • Send job alerts: if you have opted in, delivering daily or weekly email digests of jobs matching your criteria. • Communicate with you: sending account notifications, platform updates, responses to your enquiries, and (where you have consented) marketing communications. • Process payments: handling transactions for promoted job listings and other paid features. • Improve the platform: analysing usage patterns, diagnosing technical issues, and developing new features. • Ensure safety and security: detecting and preventing fraud, abuse, and unauthorised access. • Comply with legal obligations: responding to lawful requests from Nigerian authorities and meeting our obligations under the NDPA 2023, Cybercrimes Act 2015, and other applicable laws. • Support school partnerships: enabling institutions to manage student career activities and track placement outcomes. We will not use your personal data for purposes that are incompatible with the purposes described above without your consent.

We do not sell your personal data to third parties. We share your data only in the following circumstances: With Employers (for student/graduate users): When you apply for a job, your application data (name, email, resume, cover letter) is shared with the relevant employer. If your profile is set to "public," employers may also view your profile information. With Schools / Institutions: If your profile is affiliated with a partner school, that school's career centre may access certain profile details (name, email, degree, application activity) for placement and career management purposes. With Service Providers: We use trusted third-party providers to help operate the Services, including cloud hosting, payment processing, email delivery, analytics, and customer support. These providers are bound by contractual data processing agreements and may only process your data on our instructions. For Legal Compliance: We may disclose your data to law enforcement, government authorities, or courts when required by Nigerian law, a valid court order, or to protect the rights, safety, or property of GradJobber or its users. Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you before your data is transferred and becomes subject to a different privacy policy. With Your Consent: We may share your data with third parties for other purposes if you have given us your explicit consent to do so.

We use cookies and similar tracking technologies (such as web beacons and local storage) to operate and improve the Services. Types of cookies we use: • Essential cookies: Required for the platform to function (e.g., keeping you logged in, maintaining your session). These cannot be disabled. • Analytics cookies: Help us understand how users interact with our platform so we can improve it. • Preference cookies: Remember your settings and preferences (e.g., job alert preferences). • Marketing cookies: Used to measure the effectiveness of our marketing campaigns. These are only set with your consent. You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Services. You may withdraw cookie consent at any time by adjusting your browser settings or contacting us. We do not use cookies to build personal profiles for third-party advertising.

We retain your personal data for as long as your account is active, or as necessary to provide our Services, resolve disputes, enforce our agreements, and comply with legal obligations. Specific retention periods: • Active account data: Retained for the duration of your account. • Inactive accounts: Accounts with no activity for 24 months may be flagged for deletion. We will send you a notice at least 30 days before deletion. • Job application data: Retained for up to 3 years from the date of application to support legitimate employer record-keeping needs. • Payment records: Retained for 7 years as required by Nigerian financial regulations (FIRS guidelines). • Communication logs: Retained for up to 2 years for customer support and dispute resolution purposes. When data is no longer required, we securely delete or anonymise it.

Under the Nigeria Data Protection Act 2023 (NDPA), you have the following rights in relation to your personal data: Right of Access: You can request a copy of the personal data we hold about you and information about how it is processed. Right to Rectification: You can request that we correct any inaccurate or incomplete personal data. Right to Erasure ("Right to be Forgotten"): You can request deletion of your personal data where it is no longer necessary for the purposes collected, you have withdrawn consent, or processing is unlawful. Note that we may be required to retain certain data by law. Right to Restriction of Processing: You can ask us to restrict processing of your data in certain circumstances (e.g., while we verify accuracy of disputed data). Right to Data Portability: You can request that we provide your personal data in a structured, commonly used, machine-readable format so you can transfer it to another service. Right to Object: You can object to processing of your personal data based on our legitimate interests (including profiling), and to the use of your data for direct marketing. Right to Withdraw Consent: Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. Right to Lodge a Complaint: If you believe we have not handled your personal data in accordance with the NDPA 2023, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. To exercise any of these rights, please contact our DPO at privacy@gradjobber.com. We will respond within 30 days of receiving your request. We may need to verify your identity before processing your request.

Our Services are not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16 years old without verifiable parental or guardian consent. If you are a parent or guardian and believe your child has provided us with personal data without consent, please contact us immediately at privacy@gradjobber.com and we will take steps to delete that information. Users aged 16–17 may use the platform with parental consent. We encourage parents to supervise their minor children's use of the Services.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. Our security measures include: • Encryption of data in transit (TLS/HTTPS) and at rest. • Strict access controls — only authorised personnel can access personal data, on a need-to-know basis. • Regular security assessments and monitoring. • Secure third-party payment processing — we do not store your full payment card details. • Incident response procedures to detect, report, and investigate data breaches. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the NDPC and affected users as required by the NDPA 2023, within 72 hours of becoming aware of the breach where feasible. No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

GradJobber operates primarily within Nigeria. However, some of our service providers (such as cloud hosting and analytics platforms) may process your data outside Nigeria. Where we transfer personal data outside Nigeria, we ensure adequate safeguards are in place as required by the NDPA 2023 and NDPC guidelines, including: • Transfers to countries with adequate data protection laws as recognised by the NDPC. • Contractual clauses that impose equivalent data protection obligations on the recipient. • Your explicit consent where required. You may request information about the safeguards we use for international transfers by contacting our DPO at privacy@gradjobber.com.

Our platform may contain links to third-party websites, employer websites, or external resources. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party sites you visit. We are not responsible for the privacy practices or content of third-party websites. Third-party integrations (such as payment processors) operate under their own privacy policies and terms of service. We only use third parties that offer appropriate data protection guarantees.

We will only send you marketing communications (such as newsletters, promotional offers, or product updates) if you have opted in to receive them. You can opt out of marketing emails at any time by: • Clicking the "Unsubscribe" link in any marketing email. • Updating your notification preferences in your account settings. • Contacting us at hello@gradjobber.com. Please note that even if you opt out of marketing communications, we will still send you essential service-related messages (such as account confirmations, password resets, and important platform updates).

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other legitimate reasons. When we make material changes, we will: • Post the updated Policy on this page with a revised "Last Updated" date. • Notify you by email or via a prominent notice on the platform at least 14 days before changes take effect. Your continued use of the Services after the effective date of the updated Policy constitutes your acceptance. If you do not agree with the updated Policy, please stop using the Services and contact us to close your account.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: GradJobber Data Protection Officer Email: privacy@gradjobber.com General enquiries: hello@gradjobber.com Phone: +234 800 000 0000 Address: Lagos, Nigeria To lodge a complaint with the Nigerian data protection regulator: Nigeria Data Protection Commission (NDPC) Website: ndpc.gov.ng We are committed to resolving privacy concerns and will respond to your enquiry within 30 days.