Application Privacy Notice

Candidate version kovo-application-privacy-2026-10-07-v1

1 Who is responsible

Emmyx Global Concepts, BN2276868, operates Kovo. Our business address is Kovo, Lekki Phase 1, Lekki, Lagos, Nigeria. Contact support@kovo.com.ng about privacy or your application.

This notice covers initial applications and account-linked drafts, including information saved and files uploaded before submission. Later identity, guarantor and payout collection require further information before those stages open. Application information is reviewed privately; submitting or receiving an application decision does not publish your profile or activate bookings or payments.

2 Proposed information collection

Account creation collects first and last name, email and the authentication information handled by Clerk. You may use email/password or choose Google sign-in. Phone OTP is not enabled. Clerk manages verification and sessions; Kovo does not ask you to give its team your password.

The application asks for your first, last and display name, WhatsApp number, Chef/Cleaner/Both role, years of experience, work areas, specialties, separate proposed base fees, fee acknowledgement and willingness to provide a guarantor. A full street address and profile portrait are required for submission. Biography, residence neighbourhood/state, up to four additional personal photographs and permitted qualification certificates are optional. You can crop your profile portrait in your browser before uploading it. Images have a 2 MB limit; certificates have a 5 MB limit and may be PDF/JPEG/PNG/WebP. Historical draft fields and full addresses already provided may remain privately saved.

Files upload when you confirm them, and draft text saves when you use the form's save/next/status controls. Account creation may create a draft record. We also record application status, review history, relevant notice versions/acknowledgement and application-message status. Identity numbers/documents, actual guarantor contact details and bank details are not requested in the initial form. Do not include those or unrelated people's information in an optional upload.

Authentication and infrastructure services process connection, device/session and security information needed to operate the service. Clerk's signup protection uses Cloudflare Turnstile. Cloudflare's notice describes IP address, TLS fingerprint, user-agent and site/origin signals for bot protection and improving detection. See https://www.cloudflare.com/turnstile-privacy-policy/ . Account authentication uses session/security cookies; this notice is not a claim that the entire service is cookie-free.

3 Why we use the information and our legal bases

We use your account name, verified email and authentication details to give you a private account, save your requested draft and let you return to it. We use your name, private contact number, selected service roles/work areas, experience, specialties and proposed prices to understand the service work you offer and manually assess the application you ask us to review. Your guarantor-willingness answer helps us understand whether you are willing to take that later onboarding step; it does not collect a guarantor's details or bind anyone.

We use your required profile portrait and street address in the same private application assessment. If you choose to add a biography, other permitted photographs, residence area/state or relevant certificates, we use them as supporting material. They help describe your proposed service/profile information and relevant experience. They are not published, used for facial recognition or treated as verified qualifications merely because you provide them. You can leave optional material out. Your street address remains private while we handle the application or your correction/erasure request.

For the requested account, draft and application assessment, our basis is processing necessary to take steps at your request before entering a provider agreement under the Nigeria Data Protection Act 2023. We use the contact details to communicate about that requested application; this does not enroll you in unrelated advertising. A proposed customer-facing name or image is reviewed as private application material. Actual publication requires a separate explained release step.

We use proportionate account/session, connection and anti-bot information for our legitimate interest in preventing unauthorized access, fraud and abuse and protecting applicants' private records. Access checks and signup challenges serve that security purpose; they do not score your suitability for service work. We limit access and avoid putting private application content in transactional email. This interest does not authorize unrelated tracking or advertising. You can exercise the rights described below, including applicable objection rights.

We use a legal-obligation basis only for a specific duty that actually applies. Reading or acknowledging this notice is not blanket consent to every use, publicity, later identity checks or marketing. Before a new purpose or later sensitive stage opens, we explain it and request any separate permission that applies.

4 Access and service providers

At the application layer, you can access your own application and the specifically configured Kovo owner can review it. Necessary service-level access may also exist for authorized infrastructure/database administrators and service providers. Private residence details, photos and certificates are not automatically customer listings. Review is human; ordinary form/file validation does not approve an applicant. We do not score initial applications automatically or use facial recognition in this application flow.

Clerk provides account authentication, email verification and sessions. Vercel hosts the application and executes server requests. Supabase stores existing application/waitlist records and private uploads. Google receives authentication information only if you choose Google sign-in. Cloudflare Turnstile processes security signals as described in its notice. Resend supports transactional application messages using the verified email address, generic status and a protected link; home addresses/private files/identity and bank details are not included in those messages. An email status marked sent means the sending service accepted the message; it does not guarantee that it reached your inbox.

The main application flow does not sync application records to HubSpot. Separate existing kovo.com.ng recruitment may use HubSpot and Resend for consenting waitlist leads and has Meta PageView tracking. This application notice is not a complete replacement for the recruitment site's tracking/marketing notice. An existing waitlist record may link to a matching verified account without duplicating or bulk importing the waitlist.

We do not authorize a sale of application data through this notice. Any disclosure for a specific legal duty or genuine claim must be lawful and limited to what is necessary.

5 International processing and safeguards

The application uses service providers outside Nigeria. Our existing Supabase project is hosted in London, United Kingdom; the main Vercel server deployment and Resend sending region are in the United States. Clerk and other infrastructure providers can process account, security and service information internationally, including in the United States. A primary region does not mean every operational copy is confined to that location.

Our providers publish data-processing terms incorporated into their service relationships. These include restrictions on processing, confidentiality, security, subcontractors and international transfers where applicable. Supabase includes conditional transfer safeguards for other jurisdictions; Vercel, Clerk and Resend describe contractual transfer mechanisms for the jurisdictions covered by their terms. EU/UK/Swiss safeguards are not represented as an automatic Nigerian adequacy decision.

We protect application transfers with HTTPS, private storage, server-enforced access restricted to your own application and the configured owner, and limited email payloads. These technical measures accompany the contractual protection required under applicable law; this notice does not authorize unlimited sharing. Contact support@kovo.com.ng for information about the safeguards applicable to your information and how to obtain relevant details.

6 Proposed retention policy

We keep an active application while you are pursuing it and it is being reviewed. We review inactive drafts after 90 days and close those no longer being pursued. Rejected or withdrawn application content is removed or irreversibly anonymised within 90 days of rejection or withdrawal unless a specific necessary lawful hold applies. This covers application answers, private files including older/unlinked copies, review/history copies and editable local application backups. This policy is handled manually; it is not a claim that an automatic purge runs. A rights request is assessed when received, not automatically delayed until day 90.

If a specific legal duty or genuine dispute requires limited information to remain, we retain only what is necessary, restrict access and record a review/end date. We do not keep rejected applications indefinitely for future recruitment or advertising. If you progress to a later stage, we provide the relevant information and retention rules before additional collection or use.

A restricted backup that cannot be selectively changed is used only for recovery until its normal expiry. We apply erasure exclusions before bringing an older backup back into active use. A minimal request/exclusion record may remain while an older recoverable copy or an unresolved rights case exists; it does not retain the removed application content. Editable local snapshots are sanitized or retired through the controlled procedure rather than silently restoring removed information.

Authentication/session data may remain while you keep an account; withdrawing an application is different from closing the account. Security and infrastructure records are retained under the relevant service's operational/security criteria and any specific necessary legal duty; they are not a second active recruitment file. Providers may keep limited operational records after Kovo removes active application content. We use the available deletion/rights processes and explain any relevant remaining copy or limit when responding to a request. We do not promise that deleting an application instantly erases every vendor log or a message already delivered to your mailbox. Relevant application correspondence is removed with the closed application, subject to a specific necessary hold or unresolved request.

You can ask support@kovo.com.ng about withdrawal, account closure, correction or erasure, including the scope of linked waitlist records and backups. The separately consented recruitment record is not automatically erased by an application-only withdrawal; we address it when your request includes it.

7 Rights and contact

Contact support@kovo.com.ng to ask about access, correction, withdrawal of your application or applicable erasure, restriction, objection, portability and consent-withdrawal rights. Withdrawal of consent does not undo lawful earlier processing. We may need proportionate verification of the request, but will not ask for unnecessary identification or your password. Any lawful limit or specific necessary retention should be explained.

You can complain to the Nigeria Data Protection Commission at https://ndpc.gov.ng/ and use other available legal remedies. Applying does not waive these rights.

8 Security and updates

The application uses server-enforced own-record access and the existing exact owner identity, private storage, file/field validation, HTTPS and authenticated private/no-store downloads. No system can be promised completely secure. Report a suspected exposure to support@kovo.com.ng. A changed notice must identify its version/date and explain material changes before a new purpose or permission is introduced. You may ask for the version relevant to your application.

Kovo Application Notices | Version V.01 | 1