Talent Nation Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Talent Nation (“Talent Nation,” “we,” “us,” or “the Company”), a company incorporated under the laws of the Federal Republic of Nigeria with registration number [CAC REGISTRATION NUMBER] and registered address at [REGISTERED ADDRESS], collects, uses, discloses, and protects personal data in connection with the Talent Nation platform (the “Platform”).

Talent Nation's Clients and Talent are based both in Nigeria and internationally, including in the European Union, the United Kingdom, and elsewhere. This Policy applies to every category of individual whose personal data Talent Nation processes in connection with the Platform, wherever they are located, specifically:

• prospective Clients who book a discovery call before any account exists (“Leads”);
• Client organisations and their representatives who use the Platform to source and manage Talent (“Clients”);
• individuals who apply to become Talent and progress through the vetting pipeline, whether or not they are ultimately onboarded (“Applicants”);
• individuals who are onboarded as active members of the Talent network (“Talent”); and
• administrative and operations personnel who use the Platform's internal tools (“Admin Users”).

This Policy is issued in accordance with the Nigeria Data Protection Act 2023 (“NDPA”) and the General Application and Implementation Directive 2025 (“GAID”) issued by the Nigeria Data Protection Commission (“NDPC”), and, for individuals in the European Union, the European Economic Area, or the United Kingdom, the EU General Data Protection Regulation and the UK GDPR (together, “GDPR”), as described in Section 8.

Where Talent Nation determines the purposes and means of processing personal data collected through the Platform, it acts as a data controller. Where Talent Nation processes personal data on behalf of a Client (for example, personal data a Client uploads as part of a Mission's scope), Talent Nation acts as a data processor for that data, and the Client remains the data controller for it.

2. Personal Data We Collect

2.1 Leads (Discovery-Call Stage)

Before any account is created, a prospective Client booking a discovery call provides:

• full name, email address, and company name;
• project interest category and a free-text description of what they are looking to build; and
• scheduling data, including the selected date, time, and time zone.

2.2 Clients

Once onboarded, a Client organisation and its representatives provide or generate:

• account credentials (email and password);
• organisation details: company logo, industry, website, country, and business address;
• primary contact name and email;
• Mission-related content: Mission names and descriptions, and any files or links uploaded and categorised as Technical, Product, Research, Design, or Legal;
• invoice and billing information; and
• communications sent through the Platform's chat, Mission, and support channels, and records of meetings scheduled through the Platform.

2.3 Talent Applicants

An individual applying to join the Talent network provides, across the stages of the application pipeline:

• identity and contact data: first and last name, email address, WhatsApp or phone number, and LinkedIn profile URL;
• a curriculum vitae (CV) and, depending on track, a connected GitHub account (which discloses repository and contribution activity, not merely a link) or a portfolio link (for example, Behance, Dribbble, Framer, or a personal site);
• career track, years of experience, and salary expectation;
• self-assessed technical or design skill ratings;
• quiz responses, scores, and attempt history;
• practical project submissions, including links to repositories, designs, or deployed work, and any uploaded files;
• interview scheduling data and, after the interview, scorecard ratings and interviewer notes; and
• a signature (an uploaded image or a typed full legal name) and the associated date, on the standing Non-Disclosure Agreement and, if onboarded, the Offer Letter.

2.4 Onboarded Talent

Once active, a Talent member's profile continues to generate:

• updates to the skill self-assessment, CV, and portfolio or GitHub connection;
• Mission assignment, offer, and engagement records, including signed Offer Letters and compensation terms;
• daily standup entries, task activity, and time-tracking entries;
• deliverable and Mission communications;
• Client and delivery ratings, and resulting badge-tier history;
• bank account details used for payment, and payslip history;
• where applicable, mentorship records; and
• community activity, such as discussion posts, kudos, and, if opted in, leaderboard participation.

2.5 Admin Users

Talent Nation's Admin Users have their own account, role, and permission records, and their actions on the Platform are captured in activity logs for traceability and accountability.

3. How We Collect Personal Data

• Directly from you, when you complete a form, upload a document, or otherwise submit information through the Platform.
• From a connected third-party account, where you choose to connect one (for example, GitHub via OAuth).
• Automatically, through your use of the Platform (for example, activity logs, standup submissions, and time-tracking entries).
• From other Platform users, where the Platform's design requires it (for example, a Client's rating of a Talent member's delivery).

4. Purposes and Lawful Basis for Processing

We process personal data only where we have a lawful basis under section 25 of the NDPA: consent, performance of a contract (or taking steps at your request before entering into one), compliance with a legal obligation, protection of vital interests, performance of a task in the public interest, or legitimate interests. Article 6 of the GDPR sets out equivalent bases. The table below maps our principal processing activities to the basis we rely on.

Where we rely on legitimate interest, we have weighed that interest against your rights and reasonable expectations, and we do not rely on it where the effect on you would outweigh it. You may object to processing based on legitimate interest, as described in Section 10.

5. Automated Decision-Making

As of the effective date of this Policy, Talent Nation uses one automated tool that materially affects Platform content: AI Mission Scoping, which generates an initial draft Mission scope (overview, features, milestones, tech stack, and related sections) from the information a Client provides when creating a Mission. The Client, together with the assigned Lead Product Manager and Lead Engineer where applicable, has full discretion to edit, rewrite, or discard this draft in its entirety, and no Mission scope takes effect without that human review and approval.

Talent Nation does not use any automated or AI-assisted tool to decide, rank, or influence which Talent member is offered a Mission, a Talent member's compensation, badge tier, or rating, or the outcome of any stage of the vetting pipeline (profile review, skill assessment, quiz, practical project, or interview). Every such decision is made by a person: an Admin User, Product Manager, QA Lead, or Client, as applicable. Because Mission Scoping structures project information rather than evaluating or ranking an individual, Talent Nation does not consider it to be a decision based solely on automated processing that produces legal or similarly significant effects on any individual.

Before Talent Nation introduces any automated or AI-assisted tool that evaluates or makes decisions about individuals, it will assess the tool's risks, carry out a data protection impact assessment where required, and update this Policy first.

6. Sharing and Disclosure of Personal Data

Talent Nation does not sell personal data. We disclose personal data only:

• to Client organisations, where the disclosure is part of how the Platform works, for example, a Client sees the profile, ratings, and Mission-relevant activity of Talent assigned to its Mission;
• to Google, as our cloud hosting and infrastructure provider, and, where used for a particular Mission or account, to e-signature or video-conferencing providers;
• to the banks and financial institutions involved in processing a payment, since Talent Nation pays Talent and invoices Clients by direct bank transfer rather than through a third-party payment processor;
• to professional advisers (legal, tax, audit) where necessary for their engagement;
• where required by law, regulation, court order, or a lawful request from the NDPC or another competent authority; and
• in connection with a corporate transaction, such as a merger, financing, or sale of assets, subject to appropriate confidentiality protections.

7. Cross-Border Transfers

The Platform is hosted on Google Cloud, in data centres located outside Nigeria. Personal data processed through the Platform is therefore transferred outside Nigeria, wherever a given Client or Talent member is located.

For transfers from Nigeria, we rely on the bases the NDPA permits for cross-border transfers: the contractual data protection safeguards in Google Cloud's Data Processing Addendum, which binds Google to protect the data to a standard consistent with the NDPA, and, where applicable, the fact that the transfer is necessary to perform our contract with you or to take steps at your request before entering into one.

For transfers subject to the GDPR, Google Cloud's Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses and the equivalent United Kingdom transfer mechanisms.

8. Additional Provisions for Individuals in the European Union, European Economic Area, and United Kingdom

This Section applies in addition to the rest of this Policy where you are in the European Union, the European Economic Area, or the United Kingdom, and the GDPR applies to our processing of your personal data.

8.1 Legal Basis

The lawful bases in Section 4 correspond to, and are intended to satisfy, the equivalent bases under Article 6 of the GDPR.

8.2 International Transfers

Talent Nation is based in Nigeria and collects your personal data directly from you through the Platform. Onward transfers to our hosting provider are protected by the safeguards described in Section 7.

8.3 Automated Decision-Making and Profiling

As described in Section 5, Talent Nation does not make any decision about you based solely on automated processing within the meaning of Article 22 of the GDPR. We have not carried out a data protection impact assessment for Mission Scoping, because it does not systematically evaluate personal aspects of individuals. We will reassess this, and carry out an assessment where required, before introducing any tool that evaluates or makes decisions about individuals.

8.4 Supervisory Authority

In addition to your right to complain to the NDPC, you may lodge a complaint with the data protection supervisory authority in the EU or EEA member state where you live or work, or with the UK Information Commissioner's Office, as applicable.

9. Data Retention

Talent Nation keeps personal data only for as long as necessary to fulfil the purpose for which it was collected, to perform a contract, or to comply with a legal obligation. In particular:

• data relating to a rejected or unsuccessful Talent application is kept for 12 months from the date of the decision, then deleted or irreversibly anonymised;
• a dormant Client or Talent account (no login or Platform activity) is flagged for deletion or anonymisation 24 months after the last activity, after prior notice to the account holder;
• signed agreements (Offer Letters, the standing Non-Disclosure Agreement, Mission Contracts) and financial and tax records are kept for 6 years from the date of signature or the relevant transaction, in line with Nigerian contract-claim limitation periods and tax record-keeping requirements; and
• standup, activity-log, and time-tracking data is kept on a rolling 24-month basis.

Data no longer needed for these purposes is deleted or irreversibly anonymised.

10. Your Rights

Subject to the conditions and exceptions in the NDPA and, where applicable, the GDPR, you have the right to:

• be informed about the personal data we hold about you and how we process it;
• access a copy of your personal data;
• have inaccurate or incomplete personal data corrected;
• have your personal data erased, where we have no legal basis to keep it;
• restrict, or object to, certain processing, including processing based on legitimate interest;
• receive personal data you provided to us in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
• lodge a complaint with the NDPC or, where applicable, the supervisory authority described in Section 8.4.

To exercise any of these rights, contact us using the details in Section 15. We will respond within the time required by law.

11. Children's Data

The Platform is intended only for individuals aged 18 or over (see the Terms of Use). Talent Nation does not knowingly collect personal data from children. If we become aware that we hold a child's personal data, we will delete it.

12. Security Measures

Talent Nation uses technical and organisational measures appropriate to the nature, scope, and risk of its processing, including role-based access control, encryption in transit, activity logging, restricted access to signed legal documents and financial records, and Google Cloud's own security and compliance controls for hosted infrastructure. No system is completely secure, and we cannot guarantee absolute security.

13. Personal Data Breaches

If a personal data breach is likely to result in a risk to the rights and freedoms of individuals, Talent Nation will notify the NDPC within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to the rights and freedoms of the individuals affected, we will also tell them without delay, in plain language, describing what happened and the steps they can take to protect themselves.

Where a breach affects individuals in the European Union, European Economic Area, or United Kingdom, we will notify the relevant supervisory authority within 72 hours where the GDPR requires it. Where a breach affects personal data we process on a Client's behalf, we will notify that Client without undue delay so that it can meet its own obligations.

14. Changes to This Policy

Talent Nation may update this Policy from time to time, including to reflect changes to the Platform, such as the introduction of new automated or AI-assisted tools, or changes in law or regulatory guidance. We will show the date of the latest revision at the top of this Policy and, where a change is material, notify you through the Platform or by email before it takes effect.

15. Contact Us

Questions, requests, or complaints about this Policy or Talent Nation's handling of personal data should be sent to our Data Protection Officer at [PRIVACY / DPO CONTACT EMAIL], or by post to [REGISTERED ADDRESS].

You may also contact the Nigeria Data Protection Commission directly. Its contact details are published at ndpc.gov.ng.