Public policy document
Wurklynk Privacy Policy
- Effective date
- 15 October 2026
This Privacy Policy explains how Wurklynk Limited collects, uses and shares personal data when you visit Wurklynk or use its marketplace. It covers the services available to you and the features you choose to use. Features may be introduced in stages. The payment sections apply when marketplace payments are enabled under the approved provider arrangement.
1 Who is responsible for your data
Wurklynk Limited, registered in Nigeria under CAC RC 9875659, is responsible for the marketplace personal data covered by this Policy. Our registered office is 1/022, Sam Ewang Estate, Abiola Way, Abeokuta, Ogun State, Nigeria.
Our finance team handles privacy requests, account-closure requests, complaints and reviews. Email support@wurklynk.com. You may also write to our registered office, marked for the finance team. Legal notices may be sent to info@wurklynk.com.
2 Personal data we collect
- Account and profile information: your email address, sign-in records, account preferences, marketplace roles, legal and display names, phone number, profile image, professional description, skills, availability and location details you provide. An Account can use the Freelancer role, the Employer role, or both. If you choose Google sign-in where available, we receive the account information needed for that sign-in; Google also handles data under its own privacy notice.
- Public content: profile information, Jobs, Services and Work samples that you choose to publish, including their descriptions, media and accessibility text. Private drafts are distinct from content you publish.
- Marketplace activity: Bids, Direct Offers, agreed scope and price, timing, participant details, Conversations and Message attachments where available. We also keep relevant delivery, complaint, review and dispute records when those features are used.
- Payment information: names, email and phone details used to create and link a Payluk customer account; payment status, amounts, currency, disclosed fees, transaction and provider references, receipts, Invoice details and payment-protection status. For a bank withdrawal, the approved flow processes bank details and the resolved account-holder name; Wurklynk keeps a masked destination label and transaction records. Payment credentials required by a provider are submitted through its approved flow, rather than in marketplace Messages.
- Verification information: the NIN and address you enter, your saved legal name used for matching, the Basic NIN response received from QoreID during the check, and limited retained results. Retained records include name and address match results, adult eligibility, status, reason codes, provider and Account references, timestamps and review history. The matching flow does retain a protected NIN fingerprint linked to your Account to prevent the same NIN verifying another profile. It does not store your submitted NIN, submitted address or the raw response in the marketplace database, or return that evidence to the browser. We nevertheless receive and process the evidence temporarily during the check.
- Support and technical information: the information you send us, safety reports, consent preferences and records needed to operate and secure the website, such as request times, browser details, network information and error reports.
If you use Learning, Events or referral features when available, we also process relevant enrolment, progress, Ticket, booking or attribution information. We explain any additional collection or payment terms before you use a feature that requires them.
Do not send NIN values, identity-document copies, passwords, security codes or complete payment credentials in marketplace Messages, public content or ordinary support emails. Identity evidence must use the approved Verification flow.
3 Why we use personal data
We use personal data for the purposes and legal bases below. Agreeing to the Terms or acknowledging this Policy does not provide blanket consent to every use of your data.
| Purpose and relevant data | Legal basis |
|---|---|
| Provide Accounts, requested profile publication, Jobs, Bids, Direct Offers, Conversations and Work records using account, profile and marketplace information. | Contract, where necessary to provide the service you request. |
| Prevent abuse and fraud, protect the service, investigate reports and resolve complaints using relevant activity, support and technical records. | Legitimate interests, subject to necessity and a balance with your rights. |
| Meet applicable reporting, recordkeeping and lawful disclosure duties using the records required for that duty. | Legal obligation, where a specific duty applies. |
| Provide the Basic NIN check using the information described in section 5; retain limited verification and fraud-prevention records. | Specific prior consent for the check. Legitimate interests for a limited verification and fraud-prevention audit record, subject to necessity and a balance with your rights. |
| Set up requested payment services, fund Work, record payments and handle refunds or payment complaints. | Contract, where necessary for the requested payment service; legal obligation where a specific reporting or recordkeeping duty applies. |
| Send optional marketing or enable optional PostHog analytics using your choices and the permitted contact or usage data. | Consent, if enabled and you opt in. |
| Produce website statistics through the enabled Vercel Web Analytics service. | Legitimate interests in understanding website use and improving the service, subject to necessity and a balance with your rights. |
You can refuse or withdraw consent where it is the basis for processing. Withdrawal does not affect earlier lawful processing or a separate applicable legal basis. Optional choices are distinct from the agreement needed to use the marketplace.
4 Public information and private contact details
Published Freelancer profiles, Services, Work samples and Jobs can be viewed by their intended audience. Public content may be copied or shared by other people. Publish only content you are entitled to share and avoid including private contact details or other people's personal data without a lawful reason.
Private Bids, Direct Offers and Conversations are intended for the relevant participants. Wurklynk does not automatically share profile phone numbers with the other participant. Contact details in Job and Direct Offer Conversations stay masked until payment is confirmed. After payment, participants may choose to share their own contact details in the Conversation. We encourage participants to keep communication on Wurklynk.
A Message report allows Staff to review the reported item and limited surrounding context needed to investigate it. A report does not grant routine access to either participant's complete inbox. Any exceptional access for legal or security reasons must be authorised and limited to its purpose.
5 Identity Verification
Wurklynk uses Verify Me Nigeria Limited (VerifyMe, RC 1097831), through QoreID, for Nigerian Freelancer Basic NIN checks. You enter your NIN and NIN-record address; we use your saved legal name. We send your NIN and name components to QoreID and compare your address with the returned address. This flow does not require a utility bill, Face Match or Liveness. A separate collection notice and prior authorisation are required before the check; accepting the Terms is not that authorisation. We do not charge an Account fee for this check. Employer Accounts do not currently require this Wurklynk NIN check. QoreID's privacy notice is available at https://qoreid.com/privacy-policy.
We temporarily receive the Basic NIN response to match the returned NIN, name and address and establish whether you are aged 18 or over. The provider response may also include a photograph and other identity fields that the matching flow does not use for approval or retain. Filtering occurs after receipt. A completed, verified provider response with an exact legal-name match and confirmed adult eligibility can approve automatically. Address matching is informational and an address mismatch does not prevent automatic approval. One NIN can verify only one profile. A protected fingerprint prevents reuse without retaining the NIN itself. Missing, mismatched or ambiguous identity or adult-eligibility evidence may require Staff review. Verification does not certify skills, qualifications, character or Work quality. Contact support@wurklynk.com to correct or challenge a result, explain your position and request human review. Do not email your NIN or identity documents.
6 Service providers and other recipients
We use service providers for hosting, database, authentication, communications, monitoring, identity checks and payments. They receive information needed for their role. The principal providers and the information they handle are set out below; a provider associated with a staged feature receives that feature's data when it is used.
| Provider | Purpose | Information handled |
|---|---|---|
| Vercel | Website hosting, functions and website statistics. | Website requests, server-side check processing, technical information and analytics. |
| Supabase | Database, authentication and storage. | Account and marketplace records, limited check results and media where enabled. |
| PostHog | Optional page-view analytics after opt-in. | Page paths and permitted technical usage information. |
| VerifyMe through QoreID | Nigerian Freelancer Basic NIN identity check. | Submitted NIN and name components, source identity records and provider check records. |
| Payluk | Payments under the supported provider arrangement. | Customer contact details, payment and banking information needed for the service. |
| Communications providers | Service email and notifications, including Resend when enabled. | Recipient addresses and the service-message content needed for delivery. |
Supabase Pte. Ltd. and Vercel Inc. provide hosting services and process hosted customer data on our instructions under their applicable data-processing terms. Verify Me Nigeria Limited provides the QoreID identity check under our service agreement. Payluk receives the customer and transaction information needed for supported payments; its notice is at https://payluk.ng/privacy-policy. Providers may have separate responsibilities for their own legal duties and service-account administration. Contact us for help with a request concerning provider-held data. We may disclose limited information where law requires it, to protect people, or to establish or defend a legal claim.
Your data is processed outside Nigeria. Our production Supabase database is in London, United Kingdom, and the Vercel function handling the Basic NIN check runs in the United States. Optional PostHog analytics uses its EU service, whose primary hosting is in Germany. A primary hosting region does not cover every delivery, support or subprocessor location. International transfers require a permitted basis and appropriate protection under the Nigeria Data Protection Act. Contact support@wurklynk.com for the applicable processing-location and transfer-safeguard information. This Policy does not itself authorise a transfer.
7 Cookies analytics and device storage
Wurklynk may use cookies or browser storage for functions you request, saved preferences and security. Offline website assets and pages may also remain on your device. Clearing browser data may remove local settings or drafts; it does not necessarily delete server records. Use care on shared devices.
PostHog is configured for optional analytics using its EU endpoint. It starts only after you allow it and measures page paths and basic browser information. The configured collection excludes form entries, Message content, automatic click recording and screen replays, and strips URL query strings and fragments. You can change your choice through the analytics preferences control.
Vercel Web Analytics is enabled separately and provides website statistics using information such as visited URLs and page paths, referrers, approximate location, and browser, operating-system and device categories. It operates separately from the PostHog opt-in control. Vercel describes this service as using a short-lived visitor hash rather than third-party analytics cookies; that hash cycle does not mean every statistics record is deleted within 24 hours. Contact support@wurklynk.com with an objection or privacy request concerning this collection. See https://vercel.com/docs/analytics/privacy-policy.
8 Retention Account closure and deletion
We retain data for its stated purpose and any applicable legal, safety or dispute requirement. The retention schedule below sets Wurklynk's periods for the records we control. Until an automatic cleanup job exists, Joseph Idowu owns manual deletion of data that has reached the end of its retention period. Account closure, removing a Message from your view, unpublishing content and deleting server data are different actions. Request Account closure or deletion by contacting support@wurklynk.com. Where an obligation prevents immediate deletion of particular records, we explain the applicable reason and retain only what is needed.
| Record category | Retention period |
|---|---|
| Account profiles and public media | While the Account is active. After confirmed closure and resolution of existing obligations, remove public access promptly and delete primary copies within 30 days, except specific records retained below. |
| Unaccepted offers and inactive drafts | 90 days after offer expiry or recorded abandonment. Active drafts and ongoing Work are excluded. |
| Ordinary Work Messages and attachments | 12 months after Work and its payment are settled. Retain only specifically justified evidence for a longer period; do not retain the entire Conversation as an accounting record. |
| Hidden or unsent Message content | 90 days after qualifying removal, then delete unless subject to a specific hold. One participant hiding a Message must not erase the other participant's visible copy. |
| Accounting and necessary Work records | At least six years from creation for applicable accounting records and six years after the relevant year of assessment for tax records; use the later applicable expiry. Retain the agreed terms and payment outcome needed for those duties. |
| Routine support records | 12 months after the request is closed. |
| Safety reports and dispute evidence | Safety reports: 24 months after case closure. Dispute evidence: 12 months after final review closes. A specific legal claim or requirement may justify a longer, reviewed hold. |
| Security and error logs | 90 days, unless particular entries are needed for an incident or legal hold. |
| Optional analytics and consent records | Raw analytics: 90 days, then delete or effectively anonymise. Consent records: while relied upon and three years after withdrawal or replacement. Provider-held analytics records are addressed separately below. |
| Limited Verification results | While the Account is active and 30 days after closure, except a minimal result needed for a justified Work audit. Submitted NIN, submitted address and the raw identity response are not retained by the marketplace matching flow. A protected NIN fingerprint remains linked to the original Account after successful verification, including after verification removal or Account closure, to prevent reuse on another profile. |
| Backups | Up to 35 days after primary deletion in restricted backups. Reapply deletions if a backup is restored. |
| Provider-held records | Providers apply their own recordkeeping and deletion terms. Closing your Wurklynk Account does not itself end our provider agreement or erase provider-held records. Contact our finance team for help with a request and the applicable provider period. We do not treat VerifyMe's seven-year outer limit for specified materials after agreement termination as a requirement to retain every user record for seven years. |
An active complaint, dispute or legal requirement may justify retaining particular records for longer. Each hold must identify its purpose, records and responsible person and be reviewed at least every 90 days. Delete the held records when the justification ends and their ordinary period has expired. Removing public content from Wurklynk cannot erase copies outside our control.
9 Security and incidents
We apply appropriate organisational and technical safeguards and limit access to authorised purposes. No internet service guarantees absolute security. We investigate incidents and make legally required notifications. Report suspected privacy or security incidents to support@wurklynk.com.
10 Your choices rights and complaints
Subject to applicable conditions, you can request information, access, correction, deletion, restriction or portability, object to processing, withdraw consent, and seek human review of certain solely automated decisions. Contact support@wurklynk.com; privacy requests may also be sent to info@wurklynk.com. We may need proportionate information to confirm your identity and authority. We do not require identity evidence to be sent in ordinary email.
We will respond within the applicable legal period and explain any lawful limitation or refusal. You may complain to the Nigeria Data Protection Commission through ndpc.gov.ng or its reporting portal at services.ndpc.gov.ng/breach/. Contacting us does not require you to waive another remedy.
11 Children and age eligibility
Marketplace Accounts are for adults aged 18 or over, without a parent or guardian exception. Report suspected underage Accounts or data collection to support@wurklynk.com. We will investigate, apply appropriate restrictions and deletion, and retain records only as applicable law permits.
12 Changes and contact
We show the effective date and explain material changes before they apply. Changes requiring fresh consent receive a separate choice. Contact support@wurklynk.com or the registered office listed in section 1.