Who We Are
Present is a staff attendance management product operated by Devon Technologies LTD ("Devon Technologies", "we", "us", "our").
Block L, House No 2 Plot 622
Abuja 900108, Federal Capital Territory
Nigeria
Privacy contact: privacy@devontech.io
Present is available at usepresent.devontech.io. We help businesses track staff attendance using QR code check-in and GPS geofencing technology.
Who This Policy Covers
This policy applies to two groups of people:
- Business Owners / Account Administrators — the person or business that signs up for a Present account, enrolls their staff, and pays for the service. We refer to you as the "Account Owner" or "Business."
- Staff Members — employees, contractors, or team members enrolled in Present by their employer. If you are a staff member, your employer (the Account Owner) is responsible for ensuring they have the right to enroll you and that you are informed about how your attendance data is used.
What Data We Collect
3.1 Data you give us directly
Account Owners provide:
- Full name
- Email address
- Phone number
- Business name and address
- Payment information (processed by Paystack — we do not store card numbers; see Section 7)
- Staff details you enter: names, email addresses, phone numbers, roles, and departments
Staff Members provide:
- Full name and contact details (entered by the employer)
- Any profile information added during account setup
3.2 Data we collect automatically when the product is used
Check-in data:
- Timestamp of each QR code scan (check-in and check-out events)
- GPS coordinates captured at the moment of check-in, used to verify the staff member is within the authorised geofence
- Device type used to perform the check-in
Attendance records:
- Daily attendance status (present, late, absent)
- Duration of shifts calculated from check-in and check-out times
- Alert events (late alerts, absent alerts sent to the Account Owner)
Account usage data:
- Login timestamps and IP addresses
- Browser or device type
- Pages visited within the Present dashboard
3.3 Data we do not collect
We do not collect:
- Continuous GPS tracking (location is captured only at the moment of check-in)
- Biometric data (no fingerprints, face scans, or similar)
- The content of any private messages between staff
- Any data from staff who are marked as fully remote — remote staff are not prompted to check in and no attendance events are recorded for them
Why We Collect This Data and the Legal Basis
Under the Nigeria Data Protection Act 2023 (NDPA), we must have a lawful basis for processing personal data. Our bases are:
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the attendance tracking service | Check-in events, GPS coordinates, attendance records | Contract performance (our agreement with the Account Owner) |
| Sending attendance alerts to business owners | Staff name, attendance status | Contract performance |
| Processing subscription payments | Billing data passed to Paystack | Contract performance |
| Preventing fraud (proxy sign-in detection) | IP address, device type, session data | Legitimate interests |
| Improving and securing the product | Aggregated usage data, error logs | Legitimate interests |
| Complying with legal obligations | Any data required by law | Legal obligation |
A note on staff data: Account Owners instruct us to process their staff data on their behalf. Devon Technologies acts as a data processor for staff personal data; the Account Owner is the data controller. Account Owners are responsible for:
- having a lawful basis to enroll staff in Present (typically employment contract terms or consent)
- informing their staff that Present is in use
- complying with applicable data protection law in their own right
How We Use Your Data
We use the data we collect to:
- Create and manage your Present account
- Record and display attendance events to authorised users
- Send real-time or scheduled alerts to Account Owners about late or absent staff
- Calculate and process monthly billing charges based on enrolled staff count
- Detect and prevent fraudulent check-ins (same-browser proxy detection)
- Respond to support requests
- Send billing receipts and account notifications
- Improve product reliability and fix errors
We do not use your data to:
- Sell to third parties
- Serve advertising
- Build profiles for purposes unrelated to the attendance service
- Make automated decisions with legal or significant effects on any individual without human review
Who We Share Your Data With
We share data only where necessary to deliver the service. All third parties listed below are bound by data processing agreements and handle data in accordance with applicable law.
6.1 Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Paystack | Payment processing. Card authorisation and recurring charge. Paystack is PCI DSS compliant. Paystack's privacy policy applies to payment data. | Nigeria / Ireland |
| Railway | Backend hosting and cron job infrastructure. Server infrastructure for the Present application. | United States |
| Vercel | Frontend hosting. Serving the Present web application. | United States |
6.2 Legal disclosures
We may disclose personal data to law enforcement, courts, or regulatory authorities if required to do so by Nigerian law or a valid legal order. We will notify you of such requests where we are legally permitted to do so.
6.3 Business transfers
If Devon Technologies is acquired, merged, or undergoes a restructuring, your data may be transferred as part of that transaction. We will notify Account Owners by email before any such transfer takes effect and give you the option to delete your account.
Payment Data
Billing is processed by Paystack. When you add a payment method:
- Your card details are entered directly into Paystack's secure interface
- Devon Technologies never sees or stores your full card number, CVV, or expiry date
- We store only a Paystack customer token and the last four digits of the card for display purposes
Paystack's Privacy Policy governs how they handle your payment information: paystack.com/privacy
How Long We Keep Your Data
| Data type | Retention period |
|---|---|
| Account and business profile data | Duration of the account + 12 months after deletion (for legal and dispute purposes) |
| Staff profiles and attendance records | Duration of the staff member's enrollment + 12 months |
| GPS check-in coordinates | 12 months from the date of capture |
| Billing and payment records | 7 years (required by Nigerian tax and financial law) |
| Server logs and IP addresses | 90 days |
When a retention period expires, we securely delete or anonymise the data. Account Owners can request earlier deletion (subject to legal obligations — see Section 10).
Data Security
We take reasonable and appropriate technical and organisational measures to protect your data, including:
- Encrypted data transmission (HTTPS / TLS) between your browser and our servers
- Encrypted data storage at rest
- Access controls so that only authorised Devon Technologies staff and systems can access production data
- Same-browser proxy detection to prevent check-in fraud
- Regular security reviews
No system is completely immune to breach. If a breach occurs that is likely to result in risk to your rights and freedoms, we will notify affected Account Owners and the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of it, as required by the NDPA.
Your Rights
Account Owners
Under the Nigeria Data Protection Act 2023, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion of your personal data (subject to retention obligations in Section 8)
- Restriction — ask us to limit how we process your data while a dispute is resolved
- Data portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, email: privacy@devontech.io
We will respond within 30 days. If your request is complex, we may extend this by a further 30 days and will notify you.
Staff Members
If you are a staff member enrolled in Present by your employer:
- Your employer (the Account Owner) is the data controller for your attendance records. Requests to access, correct, or delete your attendance data should be directed to your employer in the first instance.
- Where your employer cannot or will not act on your request, you may contact us at privacy@devontech.io and we will advise on the appropriate steps.
- You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
Cookies and Local Storage
Present uses a small number of cookies and browser storage to:
- Keep you logged in during your session (session token)
- Remember your dashboard preferences
- Detect same-browser proxy check-in attempts (fraud prevention)
We do not use advertising cookies, third-party tracking cookies, or analytics cookies that share data with ad networks.
International Data Transfers
Our hosting infrastructure (Railway and Vercel) is based in the United States. When data is transferred outside Nigeria, we ensure appropriate safeguards are in place in accordance with the NDPA, including standard contractual clauses where required.
For users or businesses that may be subject to the EU General Data Protection Regulation (GDPR) — for example, businesses with staff who are EU residents — we commit to the same standards of data protection described in this policy. If GDPR applies to your use of Present, please contact us at privacy@devontech.io to discuss your specific requirements.
Children
Present is a business-to-business product intended for use by adults in a professional context. We do not knowingly collect data from individuals under the age of 18. If you believe a minor's data has been submitted to Present without appropriate authority, contact us at privacy@devontech.io and we will delete it promptly.
Changes to This Policy
We may update this policy as the product evolves (for example, when new features are added). When we make material changes:
- We will update the "Last updated" date at the top of this page
- We will notify Account Owners by email at least 14 days before the changes take effect
- Continued use of Present after the effective date constitutes acceptance of the updated policy
Previous versions of this policy are available on request.
How to Contact Us
For any privacy-related questions, requests, or complaints:
Karmo District, Mercy Samuelson Estate
Block L, House No 2 Plot 622
Abuja 900108, FCT, Nigeria
If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
Present is a product of Devon Technologies LTD, registered in Nigeria.