NEMPIC Privacy Policy & Terms of Service
This document contains the complete Privacy Policy, Terms of Service, and Refund Policy governing the use of the Nigeria Employer Integrity Check (NEMPIC) platform and services. Please read these terms carefully before creating an account or utilizing our verification services.
NEMPIC Privacy Policy
Effective Date: November 7, 2025
1 Introduction
The Nigeria Employer Integrity Check (NEMPIC), accessible via nempic.com, is a web-based platform and system for a centralized database for employee integrity verification in Nigeria. We are committed to protecting the privacy and security of the personal data we process. This Privacy Policy outlines how NEMPIC collects, uses, discloses, and protects the personal data of individuals (Data Subjects) and our organizational users (Employers/Checkers) in compliance with the Nigeria Data Protection Act (NDPA), 2023, and other applicable Nigerian laws.
By accessing or using our Services, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy.
2 Data Controller and Contact Information
Data Controller: NEMPIC Operating Entity
Address: Nigeria
Email: privacy@nempic.com
For any questions regarding this policy or to exercise your data rights, please contact our Data Protection Officer (DPO) at the email address above.
3 Personal Data We Collect
NEMPIC collects two primary categories of personal data: Data Subject Information (the individual being checked) and User Information (the employer/organization conducting the check).
3.1. Data Subject Information (Highly Sensitive)
This data is collected for the purpose of integrity verification and is stored in our centralized database. It includes, but is not limited to:
| Data Category | Specific Data Points | Sensitivity Level |
|---|---|---|
| Identity & Contact | Full Name, Date of Birth, Place of Birth, Nationality, Gender, Residential Address, Phone Number, Email Address. | High |
| Employment & Status | Work Role/Level, Employment History, Integrity Check Number (ICN). | Medium |
| Integrity & Criminal Records | Records of misconduct, Warnings from NEMPIC, Assault Convictions, Cyber-crime or Financial Crime Convictions, Drug-related Offenses. | Very High (Sensitive) |
| Vulnerability Records | Records of abuse of an adult or vulnerable adult, Records of abuse of a child or vulnerable child (collected for Enhanced with Barred List Check). | Extremely High (Sensitive) |
| Certificates & Vetting Documents | Police Character Certificate (PCC), including its certificate reference number, issue date, expiry date, and verification status. | High |
Note on Sensitive Personal Data: The collection and processing of data relating to criminal convictions and offenses, as well as data concerning health (inferred from drug-related offenses) and records of abuse, are considered Sensitive Personal Data under the NDPA, 2023. We process this data only with the explicit consent of the Data Subject or where necessary for the establishment, exercise, or defence of a legal claim, or as otherwise permitted by law.
Police Character Certificate (PCC): Where an individual applies for a NEMPIC Certificate, NEMPIC collects the PCC as part of its vetting and certificate-issuance process. The PCC must be requested before the individual answers any vetting or criminal-history questions on the NEMPIC platform.
3.2. User Information (Employer/Checker)
This data is collected from the organizations and individuals who register to use NEMPIC’s services:
- Organizational Details: Business Name, Business Address, Business Type, and the required legal identifier (CAC Number for large businesses/Enterprises, or National Identification Number (NIN) for small businesses/sole proprietorships).
- Contact Person Details: Name, Phone Number, Email Address.
- Financial Data: Payment information (processed securely by a third-party payment processor; we do not store full payment card details).
- Service Usage Data: Records of integrity check requests, verification logs, and subscription details.
4 Purpose and Legal Basis for Processing
We process personal data for the following purposes and rely on the corresponding legal bases under the NDPA, 2023:
| Purpose of Processing | Legal Basis (NDPA, 2023) |
|---|---|
| Integrity Verification | Explicit Consent of the Data Subject, or Legal Obligation (where required by law for certain roles). |
| Service Delivery | Performance of a Contract with the User (Employer/Checker). |
| Security and Fraud Prevention | Legitimate Interest (protecting our platform and users from fraud and misuse). |
| Issuance of Certificates | Performance of a Contract and Legitimate Interest (providing verifiable proof of integrity status). |
| Compliance | Compliance with a Legal Obligation (e.g., responding to lawful requests from Nigerian authorities). |
5 Consent and Data Subject Rights
5.1. Consent
For certain integrity checks, NEMPIC requires the explicit, informed, and unambiguous consent of the Data Subject before their data is processed and disclosed to a User (Employer live update). The Data Subject has the right to withdraw this consent at any time, which will not affect the lawfulness of processing based on consent before its withdrawal.
5.2. Data Subject Rights
In accordance with the NDPA, 2023, Data Subjects have the following rights:
Right to Access
Request a copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete data.
Right to Erasure (To Be Forgotten)
Request deletion of personal data, subject to legal and contractual obligations.
Right to Object
Object to the processing of personal data, including for direct marketing.
Right to Restriction of Processing
Request limitation on the way we use your personal data.
Right to Data Portability
Receive personal data in a structured, machine-readable format.
To exercise any of these rights, submit a written request to the Data Protection Officer at privacy@nempic.com.
6 Disclosure and Sharing of Personal Data
Personal data is shared only as necessary and under strict conditions:
- To Users (public Checkers): We disclose minimal integrity summary results (record of report toward individual integrity and warnings from NEMPIC on Basic, Standard, Enhanced, or Enhanced with Barred List Certificate) to the User who requested the check.
- To Users (Employers/Checkers): We disclose the results of a full integrity check only after the Data Subject has provided explicit consent for that specific check. This consent is also strictly required for the Live Update Feature.
- To Agents and Super Agents: Agents and Super Agents may view records only after the Data Subject provides a One-Time Password (OTP) sent to their registered contact info. This OTP mechanism serves as explicit, verifiable consent. Viewing records without OTP is strictly prohibited.
- Public Verification: The Business Certificate and Individual Integrity Check Number / QR code are designed for public verification of status (valid, expired, revoked) with minimal necessary information.
- Legal Compliance: We may disclose data if required by law or in response to valid lawful requests by public authorities (court order or regulatory body).
- Service Providers: Third-party service providers (hosting, IT support) bound by strict confidentiality agreements process data solely on our instructions.
7 Data Security and Retention
7.1. Security Measures
NEMPIC implements robust technical and organizational measures to protect personal data from unauthorized access, disclosure, alteration, and destruction:
- Encryption of data both in transit (SSL/TLS) and at rest.
- Strict role-based access controls and authentication protocols for the centralized database.
- Regular security audits and vulnerability assessments.
- Use of managed hosting and cloud infrastructure services with provider security controls.
7.2. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. The retention period is balanced against the Data Subject’s right to erasure and the principles of the NDPA.
8 Age Restriction
NEMPIC services are generally intended for individuals aged 16 years and above. Paid services are restricted to individuals aged 16 and above. If we become aware that we have inadvertently collected personal data from a child without parental/guardian consent, we take immediate steps to delete that information.
8.1. Processing Personal Data of Minors (Under 16)
For minors participating in apprenticeship training programs, processing is subject to strict NDPA requirements:
- Explicit Parental/Guardian Consent: We MUST obtain the explicit, verifiable consent of the minor’s parent or legal guardian before processing data for apprenticeship training checks.
- Verification of Authority: NEMPIC reserves the right to take reasonable steps to verify that the person providing consent is indeed the parent or legal guardian.
- Purpose Limitation: Data collected for a minor under 16 is strictly limited to information necessary for the Basic Check solely for apprenticeship programs.
- Parent/Guardian Responsibility: The parent or legal guardian assumes responsibility for reviewing this policy and the accuracy of information provided.
- Right to Withdrawal: The parent/guardian retains the right to withdraw consent at any time, resulting in immediate cessation of data processing.
9 Changes to this Policy
NEMPIC reserves the right to update this Privacy Policy at any time. We will notify you of any material changes by posting the new policy on our website and updating the “Effective Date” at the top of this policy.
NEMPIC Terms of Service (ToS)
Legally Binding Agreement
1 Acceptance of Terms
These Terms of Service (“Terms”) govern your access to and use of the NEMPIC platform and services (“Services”) provided by NEMPIC Operating Entity (“NEMPIC,” “we,” “us,” or “our”). By registering for or using the Services, you agree to be bound by these Terms.
2 Description of Service and Account Types
NEMPIC provides a centralized, web-based platform for conducting integrity checks and background verifications on individuals and businesses in Nigeria. The Services are offered through a tiered model and primary account types: Employer (for small businesses/sole proprietorships), Enterprise (for large businesses/organizations), and Agent / Super-Agent accounts.
| Service Tier | Target User / Role | Scope of Check (Summary) |
|---|---|---|
| Basic Check | Individuals under 18 (including Apprentices) | Basic integrity record and verification. |
| Standard Check | General Roles and Responsibilities | Same as Basic, for general employment vetting. |
| Enhanced Check | Sensitive and Regulated Areas | Standard Check plus cyber/financial crime and drug-related offenses. |
| Enhanced with Barred List | Roles with Vulnerable Responsibility | Enhanced Check plus records of abuse of vulnerable adults and children. |
| Business Certificate | Organizations / Businesses | Record of business integrity, compliance, and warnings from NEMPIC. |
3 User Obligations and Warranties
3.1. Account Types and Live Update Feature
Employer Account (Small Business / Sole Proprietorship): Requires National Identification Number (NIN). Designed for single or small organizations. Includes the Live Update Feature upon explicit, separate consent of the individual (Data Subject).
Enterprise Account (Large Business / Organization): Requires Corporate Affairs Commission (CAC) Number. Designed for organizations with multiple branches. Centralized visibility over staff records and live updates across branches, subject to individual consent.
3.2. General User Obligations
3.2.1. Obligations of Agents and Super Agents
- OTP Consent Requirement: Agents and Super Agents MUST NOT attempt to access or view an individual’s full record without the Data Subject first providing the OTP sent to their registered contact information. Any attempt to bypass this is a material breach of these Terms.
- Purpose Limitation: Access to records is solely for assisting the Data Subject with registration, viewing their certificate, or providing authorized support services.
- Super-Agent Services: Support services (report writing, appeals) must be provided ethically, truthfully as claimed by their client, and with full knowledge of the Data Subject.
3.3. Obligations and Liabilities for the Live Update Feature
3.3.1. Absolute Consent Requirement
The User acknowledges that the Live Update Feature MUST NOT be activated for any individual without first obtaining their explicit, separate, and unambiguous consent via NEMPIC-provided consent features.
- Withdrawal of Consent: The User must inform the employer upon withdrawal; if the employer fails to remove access within 30 days, the user should immediately notify NEMPIC.
- Data Use & Confidentiality: Users must treat all information received via Live Update with the highest degree of confidentiality and security as Sensitive Personal Data under NDPA 2023.
- Purpose Limitation: Live Update data shall be used exclusively for internal employment integrity verification. Unauthorized sharing is strictly prohibited.
NEMPIC Refund Policy
Subscription, Certificate & Integrity Check Refunds
4.1. Purpose of this Policy
This Refund Policy applies to fees paid directly to NEMPIC for subscriptions, certificates, integrity checks, or add-on services. It explains when refunds are available, what is covered, and the process for review.
4.2. Refund Eligibility
A User is entitled to a refund only where NEMPIC is unable to provide the paid service due to a failure within NEMPIC’s direct control, and after NEMPIC has been given a reasonable opportunity to investigate and rectify the failure.
4.3. What a Refund Covers
Covers the exact amount paid for the service NEMPIC was unable to provide (or a proportionate amount for bundled services). Does not cover indirect losses, lost opportunities, or decisions made by third parties.
4.4. Where Refunds Are NOT Available
No refund for change of mind, non-use, incomplete/false information, failure to complete KYC or submit required Police Character Certificate, failure to respond to requests, or disagreement with an integrity-check result.
4.5. How to Request a Refund
Contact NEMPIC support with your account details, payment reference, purchased service, date of payment, and description of the issue. Additional verification details may be requested.
4.6. Review and Decision
NEMPIC reviews requests and notifies the User via email or account dashboard. If approved, the refund amount and method will be confirmed. If declined, a reason will be provided.
4.7. Processing & Gateway Charges
Approved refunds are returned to the original payment method within twenty-eight (28) days. Non-refundable third-party gateway, bank, or transaction charges may be deducted where permitted by law.
4.8. Your Legal Rights
Nothing in this policy limits statutory rights under Nigerian law. This policy forms part of the NEMPIC Terms of Service and must be read together with the Privacy Policy.
Ready to complete your account?
Return to sign up and accept the terms to get started with NEMPIC verification.