Overview
This Privacy Policy explains how HexPay Africa ("HexPay", "we", "us") collects, uses, discloses and protects personal data when a business (a "Customer") and its employees use the HexPay platform, mobile app, or website at hexpayr.com.
We built HexPay to run payroll correctly for African businesses, and payroll touches some of the most sensitive data a person has: bank details, salary, tax and pension information, and identity documents. We treat that responsibility as non-negotiable.
Data we collect
Depending on how HexPay is used, we collect:
- Account data: name, work email, phone number, password (hashed), and company details, when a business owner or administrator signs up.
- Employee data: name, date of birth, bank account details, tax identification number, pension fund administrator (PFA) details, salary and compensation data, leave and attendance records, and employment documents, entered by a Customer or its employees for payroll, HR and compliance purposes.
- Payment data: transaction records for payroll disbursements and platform billing, processed through licensed payment partners (see "Who we share it with" below). We do not store full card numbers.
- Usage data: log data, device and browser information, IP address, and how the platform and website are used, collected automatically to keep the service secure and reliable.
- Communications: messages sent to our support team, and records of emails HexPay sends (for example payslip notifications, payroll approvals, and account alerts).
How we use it
We use personal data to:
- Run and administer the HexPay platform, including payroll calculation, bank reconciliation, time tracking, hiring workflows and the employee self-service app.
- Calculate and schedule statutory deductions (PAYE, pension and NHF) and prepare documentation for filing. HexPay currently prepares this documentation for the Customer to file; it does not file automatically on the Customer's behalf.
- Process payroll disbursements and platform billing through our banking and payment partners.
- Provide customer support, and send service, security and transactional communications.
- Detect, investigate and prevent fraud, abuse and security incidents.
- Improve the platform, and understand how it is used, in aggregate or de-identified form wherever possible.
- Comply with applicable law, including Nigerian tax, labor and data protection law.
We do not sell personal data, and we do not use employee payroll data for advertising.
Who we share it with
We share personal data only where necessary to provide the service:
- Payment and banking partners (including Paystack and the banks a Customer connects to HexPay), to process payroll disbursements, verify bank accounts, and reconcile transactions.
- Infrastructure providers we use to host, store and secure data, and to send transactional email.
- Regulators and authorities, where required by law, such as tax authorities, pension regulators, or a court order.
- Professional advisors such as auditors and legal counsel, under confidentiality obligations.
- A successor entity, in the event of a merger, acquisition or asset sale, subject to the same privacy commitments described here.
We do not share employee data with third parties for their own marketing purposes.
Storage & security
Personal data is stored on infrastructure with access controls, encryption in transit, and role-based access limiting who inside HexPay can view Customer and employee data. Access to production data is restricted to personnel who need it to operate or support the platform.
No system is completely immune to risk. If we become aware of a security incident affecting personal data, we will notify affected Customers and, where required by law, the relevant regulator, without undue delay.
Retention
We retain personal data for as long as a Customer's account is active, and for a reasonable period afterward to meet legal, tax, and accounting retention requirements (payroll and tax records in Nigeria are commonly required to be kept for several years). A Customer may request deletion of their account data, subject to these legal retention obligations.
Your rights
Depending on your location and applicable law, including the Nigeria Data Protection Act and NDPR, you may have the right to: access the personal data we (or your employer, as controller) hold about you; request correction of inaccurate data; request deletion, subject to legal retention requirements; object to or restrict certain processing; and request a copy of your data in a portable format.
If you are an employee, the fastest way to exercise these rights is usually through your employer, since they control your HR record. You can also contact us directly at dev@hexng.com and we will route your request appropriately.
Cookies
The HexPay website and app use cookies and similar technologies to keep you signed in, remember preferences, and understand aggregate usage of the site. You can control cookies through your browser settings; disabling essential cookies may affect your ability to log in or use the platform.
Children's privacy
HexPay is a business tool intended for use by working adults. We do not knowingly collect personal data from children, and payroll accounts require the individual to be of legal working age under applicable Nigerian law.
Changes to this policy
We may update this Privacy Policy as HexPay's product and legal obligations evolve. We will update the "Last updated" date above, and where a change is material, we will make reasonable efforts to notify Customers directly.
Contact us
Questions about this policy or how your data is handled can be sent to dev@hexng.com, or through our Support page. Our registered office is 2 Elewa Street, Rumuibekwe Estate, Obio/Akpor Local Government Area, Rivers State, Nigeria.