1. Introduction
Halgian Limited ("Halgian", "we", "us", "our") is the data controller responsible for your personal data. We are a technology company operating a hyperlocal job matching platform.
We take your privacy seriously. This notice describes what personal data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR).
Data Controller: Halgian Limited
Data Protection Officer (DPO): team@halgian.com
Effective Date: April 2026
Version: 1.0
2. Who We Are
Halgian is a hyperlocal job matching platform that connects small and medium enterprises (SMEs) with local job seekers (candidates). Our platform enables businesses to post job opportunities and find verified local talent, while candidates can discover work opportunities within their own neighbourhood.
Our matching algorithm is built around neighbourhood-level location data to surface the most relevant opportunities for both parties.
3. Data We Collect
We collect the following categories of personal data:
3.1 Account Data
Email address, phone number, and password hash. Required to create and secure your account.
3.2 Profile Data
Full name, neighbourhood, work types, skills, and work history. Used to build your public-facing profile and enable job matching.
3.3 Business Data (SMEs only)
Business name, business address, and Corporate Affairs Commission (CAC) registration documents. Required for SME verification and job posting.
3.4 Location Data
Neighbourhood name only. We do not store GPS coordinates permanently. Any coordinates used during registration or job search are processed transiently and immediately discarded.
3.5 Communication Data
Chat messages between users on the Halgian platform. These are stored only for the duration of your account and anonymised on account deletion.
3.6 Payment Data
Subscription billing information processed via Paystack or Flutterwave. We do not store full card details — payment processors handle sensitive card data on our behalf under PCI DSS.
3.7 Referee Data
Referee contact information provided by candidates is stored in encrypted form. Referee details are only revealed to an SME upon extension of a formal interview offer, and are permanently deleted when an account is deleted.
3.8 Voice Input Data
When you use our voice application feature, we capture transcripts only. No audio recordings are retained. Audio is processed in real time by Deepgram and immediately discarded after transcription.
3.9 Technical Data
IP address and browser type, collected for platform security and fraud prevention purposes only. This data is not used for advertising or profiling.
4. Lawful Basis for Processing
We only process your personal data where we have a valid lawful basis under GDPR Article 6.
| Activity | Lawful Basis | Purpose |
|---|---|---|
| Account creation | Contract (Art. 6(1)(b)) | To create and maintain your Halgian account |
| Job matching | Contract (Art. 6(1)(b)) | To match candidates with relevant job opportunities |
| Marketing communications | Consent (Art. 6(1)(a)) | To send promotional emails and notifications where you have opted in |
| Fraud prevention & platform security | Legitimate interests (Art. 6(1)(f)) | To protect users and the platform from abuse, fake accounts, and fraud |
| Payment records | Legal obligation (Art. 6(1)(c)) | Financial records must be retained for 7 years under applicable financial regulations |
| Referee data processing | Consent (Art. 6(1)(a)) | Referee information is shared only with explicit candidate consent upon interview offer |
| Voice transcription | Contract (Art. 6(1)(b)) | To process job applications submitted via voice input |
5. How We Use Your Data
- Job matching: We use your neighbourhood, skills, and work preferences to surface relevant job opportunities from nearby SMEs.
- Notifications: We send you alerts about new job matches, application updates, and interview invitations via email, SMS, and WhatsApp (where you have consented).
- Verification: We verify SMEs using CAC documentation and verify candidate age at registration to ensure platform integrity.
- Platform security: Technical data (IP, browser) is used to detect and prevent fraudulent activity, account takeovers, and abuse.
- Billing: We process subscription payments for SMEs via our payment processor partners.
- AI-assisted features: Profile data and voice transcripts may be processed by AI services to improve matching quality and clean up application text. We do not use AI to make automated decisions that produce legal effects on users.
6. Data Sharing
We never sell your personal data. We share data only in the limited circumstances described below.
Sharing with Other Users
When an SME shortlists a candidate, a limited subset of the candidate's profile (name, neighbourhood, skills, work types) is shared with that SME. Full contact and referee details are not shared until an interview offer is extended and accepted.
Third-Party Service Providers
| Provider | Service | Country | Transfer Mechanism |
|---|---|---|---|
| Stripe | Payment processing | USA | Standard Contractual Clauses |
| Paystack | Payment processing | Nigeria | Standard Contractual Clauses |
| Flutterwave | Payment processing | Nigeria / USA | Standard Contractual Clauses |
| AWS | Cloud hosting & storage | Ireland (EU) | EU adequacy decision |
| SendGrid | Transactional email | USA | Standard Contractual Clauses |
| Twilio | SMS & WhatsApp messaging | USA | Standard Contractual Clauses |
| Deepgram | Voice transcription | USA | Standard Contractual Clauses |
| Anthropic | AI text processing | USA | Standard Contractual Clauses |
| Google Maps | Location search | USA | Standard Contractual Clauses |
| Mapbox | Map rendering | USA | Standard Contractual Clauses |
7. International Data Transfers
Some of our service providers are located outside the European Economic Area (EEA). Where we transfer data internationally, we ensure appropriate safeguards are in place as required by GDPR Chapter V.
| Processor | Service | Country | Legal Basis for Transfer |
|---|---|---|---|
| AWS | Hosting & storage | Ireland, EU | EU adequacy decision (GDPR Art. 45) |
| SendGrid | Email delivery | USA | Standard Contractual Clauses (SCCs) |
| Twilio | SMS / WhatsApp | USA | Standard Contractual Clauses (SCCs) |
| Deepgram | Voice transcription | USA | Standard Contractual Clauses (SCCs) |
| Anthropic | AI text processing | USA | Standard Contractual Clauses (SCCs) |
| Stripe | Payments | USA | Standard Contractual Clauses (SCCs) |
| Paystack | Payments | Nigeria | Standard Contractual Clauses |
| Flutterwave | Payments | Nigeria / USA | Standard Contractual Clauses |
| Google Maps | Location search | USA | Standard Contractual Clauses (SCCs) |
| Mapbox | Map rendering | USA | Standard Contractual Clauses (SCCs) |
Copies of our Standard Contractual Clauses with relevant processors are available upon request by contacting team@halgian.com.
8. Your Rights (GDPR Articles 12–22)
Under the GDPR, you have the following rights in relation to your personal data. You can exercise most of these rights directly from your profile page without needing to contact us.
Right to be Informed
Art. 13–14You have the right to be told how your data is used. This Privacy Notice fulfils that obligation.
How to exercise: This notice.
Right of Access
Art. 15You have the right to obtain a copy of all personal data we hold about you.
How to exercise: Use "Download My Data" on your profile page, or submit a Subject Access Request via our DPO form.
Right to Rectification
Art. 16You have the right to correct inaccurate or incomplete personal data.
How to exercise: Edit your profile directly from your profile page.
Right to Erasure
Art. 17You have the right to request deletion of your personal data ("right to be forgotten") where there is no longer a lawful basis for processing.
How to exercise: Use "Delete Account" on your profile page. Some data may be retained where legally required (e.g. financial records).
Right to Restrict Processing
Art. 18You have the right to request that we restrict processing of your data in certain circumstances.
How to exercise: Use "Pause Profile" on your profile page. Your data will not be shown in matching results while paused.
Right to Data Portability
Art. 20You have the right to receive your data in a structured, machine-readable format.
How to exercise: Use "Export My Data (JSON)" on your profile page.
Right to Object
Art. 21You have the right to object to processing based on legitimate interests or for direct marketing purposes.
How to exercise: Withdraw marketing consent from your profile page. For other objections, contact our DPO.
Rights Re: Automated Decision-Making
Art. 22You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
How to exercise: Halgian does not make automated decisions producing legal effects. Our matching algorithm surfaces relevant job opportunities, but all hiring decisions are made by humans (the SME). No candidate is rejected or hired automatically.
To exercise any of these rights formally, use our DPO Contact Form. We will respond within 30 days as required by GDPR Article 12. You also have the right to lodge a complaint with your local supervisory authority.
9. Data Retention
We retain your data only as long as necessary for the purpose it was collected, or as required by law.
| Data Type | Retention Period |
|---|---|
| Active account data | Duration of account, plus 30 days after account deletion (recovery window) |
| Anonymised transaction records | 7 years (standard financial record-keeping requirement) |
| Chat messages | Anonymised on account deletion; content is retained in anonymised form for dispute resolution |
| Job application records | 24 months after last activity on the application |
| Referee data | Permanently deleted on account deletion |
| Inactive accounts | Users are warned at 18 months of inactivity; accounts are automatically deleted at 24 months of inactivity |
| Technical data (IP, browser) | 90 days for security log purposes |
| Voice transcripts | Retained only for the duration needed to process the application, then deleted |
11. Children
Halgian is a professional job platform intended for adults only. We do not knowingly collect personal data from anyone under 18 years of age. We verify age at registration and will reject and delete any application found to be from a minor. If you believe a minor has registered on our platform, please contact us immediately at team@halgian.com.
12. Changes to This Notice
We may update this Privacy Notice from time to time. Where changes are material (i.e. they significantly affect how we use your data or your rights), we will notify you by email and, where required by law, obtain your re-consent before the changes take effect.
Non-material changes (corrections, clarifications) will be reflected by updating the version number and date at the top of this notice. A version history is available on request — contact team@halgian.com.
Continued use of the Halgian platform after material changes take effect constitutes acceptance of the updated notice (subject to any required re-consent).
13. Contact & Data Protection Officer
If you have any questions about this Privacy Notice, or wish to exercise your GDPR rights, please contact our Data Protection Officer:
Halgian Limited — Data Protection Officer
Email: team@halgian.com
For formal requests, use our dedicated DPO contact form.
You also have the right to lodge a complaint with your local EU/UK supervisory authority.