Privacy Policy

Africa Work Lens is the data controller for the personal data described in this notice. You can contact us about privacy matters, or to exercise any of your rights, at privacy@africaworklens.com. If we appoint a Data Protection Officer or a UK representative, their details will be published here.

• Account data: email address, display name, password (stored only as a salted hash by our authentication provider), and sign-in metadata such as timestamps and the provider used (email or Google).
• Optional profile data: current or former employer, job title, and salary figures you choose to share (amount, currency, gross or net, monthly or annual).
• Content you submit: reviews, ratings, pros and cons, advice to management, salary reports, company requests and reports of other content.
• Technical data: IP address, device and browser information, and security/audit logs generated when you use the service.

We do not deliberately collect special category data (such as health, religion, trade union membership or ethnicity). Please do not include such information, or information that identifies other individuals, in your reviews.

When you choose to post a review, salary report, or company request anonymously, your name is not displayed and your author identifier is hidden from every other user of the platform — including our moderators and administrators. Their moderation tools deliberately cannot read or reveal who wrote an anonymous post. Only you can see which anonymous submissions are yours, through your own contributions page.

We still store a link between you and your submission at database level so that we can prevent duplicate or abusive submissions, comply with legal obligations and let you manage or delete your own contributions. Anonymity is therefore anonymity to everyone but you, not deletion of the underlying record.

• Providing your account and publishing your content — performance of a contract (Art. 6(1)(b)).
• Publishing aggregated salary and rating data — legitimate interests (Art. 6(1)(f)) in pay transparency, balanced against your privacy through aggregation and anonymity controls.
• Moderation, fraud and abuse prevention, service security — legitimate interests (Art. 6(1)(f)).
• Optional profile and salary details you volunteer — consent (Art. 6(1)(a)), which you may withdraw at any time by removing them.
• Responding to legal requests and keeping records — legal obligation (Art. 6(1)(c)).

We use strictly necessary cookies and browser storage to keep you signed in and to keep the service secure. These do not require consent under PECR. We do not use advertising or cross-site tracking cookies. If we ever introduce analytics or marketing cookies, we will ask for your consent first and provide a way to change it.

We do not sell personal data. We share it only with processors acting on our instructions and with third parties where the law requires it:

• Our cloud hosting, database, authentication and storage provider (infrastructure processor).
• Email delivery providers for account and service messages.
• Law enforcement, regulators or courts where we are legally required to disclose information.

All processors are bound by written contracts meeting Article 28 UK GDPR.

Our infrastructure providers may process data outside the UK. Where personal data leaves the UK, we rely on UK adequacy regulations or, where none apply, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and appropriate technical safeguards such as encryption in transit and at rest.

• Account data: for as long as your account exists, then deleted or anonymised within 30 days.
• Published reviews and salary reports: retained while published; on account deletion they are either removed or irreversibly de-identified so they can no longer be linked to you.
• Rejected or moderated content: up to 12 months to prevent repeat abuse.
• Security and audit logs: up to 12 months.

Under the UK GDPR you have the right to:

• be informed about how your data is used (this notice);
• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to processing, including processing based on legitimate interests;
• data portability for data you provided under contract or consent;
• withdraw consent at any time, without affecting processing carried out before withdrawal;
• not be subject to solely automated decisions with legal or similarly significant effects — we do not carry out such decision-making.

To exercise a right, email privacy@africaworklens.com. We respond within one month and will not charge a fee unless a request is manifestly unfounded or excessive. We may ask you to verify your identity before acting.

Data is encrypted in transit (TLS) and at rest by our infrastructure provider. Access to production data is restricted, passwords are stored only as hashes, and database row-level security policies limit what each user can read or write. No system is perfectly secure, but we will notify the ICO within 72 hours, and affected users where required, if a reportable personal data breach occurs.

The service is intended for people in employment and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk/make-a-complaint — or, if you are in Zambia, to the Data Protection Commissioner under the Data Protection Act No. 3 of 2021.

We may update this notice as the service evolves. Material changes will be highlighted on the site and, if appropriate, notified by email. The date at the top shows when it was last revised.