Privacy Notice

1.1 Data controller

For direct consumer use of the Services, the controller is:

1.2 Services covered

This notice applies to the following Woyono services, together called the “Services”:

• the public website, marketing pages, help centre, browser-based account portal, web forms and browser demonstrations;
• the Woyono mobile and desktop application, including device permissions, offline storage, synchronisation, push notifications and app-store purchases;
• the Woyono PC, console, cloud-streamed or browser-delivered video game, including save data, progression, online services, in-game interviews, leaderboards and moderation features; and
• organisation or partner programmes that use Woyono interviews, simulations, dashboards or related services.

1.3 Nigerian operations and Modolos Studios Nigeria Limited

Woyono Limited is developing its Nigerian operations. Modolos Studios Nigeria Limited provides product-development, support, operational and local privacy-administration services under written agreements with Woyono Limited.

For direct consumer services, Modolos processes Woyono user information on Woyono’s documented instructions for assigned operational activities, except where Modolos must process information as an independent controller for its own legal obligations. Where Woyono acts as a processor for an organisation, Modolos may act as Woyono’s subprocessor. The relevant contracts must reflect the role that applies to each activity.

1.4 Organisation programmes

If a school, college, employer, training provider, government body, charity or other organisation enrols you in a programme, the organisation-specific notice or agreement explains the applicable roles. The organisation may be the controller and Woyono its processor, Woyono may be a separate controller, or the parties may have another lawful arrangement. The programme notice identifies who decides how results may be used and who handles rights requests.

1.5 Applicable law and EEA representative

This notice is designed to address the UK General Data Protection Regulation, the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, the Nigeria Data Protection Act 2023 and related NDPC guidance. The EU GDPR applies where its territorial rules are met.

Where Woyono is required to appoint a representative in the European Economic Area under EU GDPR Article 27, the representative’s identity and contact details will be published in the relevant regional notice before the applicable EEA-targeted processing begins.

1.6 Related documents

This notice should be read with the Cookie and Technologies Policy, Data Use and Responsible AI Policy, Terms and Conditions, and any programme, recording, research or feature-specific notice shown to you.

2.1 Legal names and identity information

Woyono does not request or require a legal name for a standard consumer account. Woyono integrations are configured to request only the scopes needed for authentication or service delivery and should not import a legal-name field into the standard Woyono profile. Independent platforms, payment providers or programme organisations may hold legal-name information under their own notices, but Woyono does not instruct processors to enrich standard account records with it.

2.2 Sensitive or special-category information

Woyono does not ask users to include health, disability, race or ethnicity, religion, political opinions, trade-union membership, sexual-orientation information or other sensitive information in interview answers unless a specific programme lawfully requires and clearly explains it. Users may nevertheless reveal sensitive information in free-text, audio, video or support messages. Woyono minimises access to incidental sensitive information, does not use it to infer protected characteristics, and processes it only where an applicable legal condition and safeguards exist.

6.1 How Woyono uses AI

Woyono uses AI and rules-based systems to generate or adapt interview questions, transcribe speech, compare responses with role-relevant rubrics, identify evidence of skills, produce developmental feedback and personalise progression or recommendations. The systems may profile performance, skill evidence and progress for these purposes.

6.2 Main factors and limitations

Depending on the feature, an assessment may consider the role requirements, the rubric, evidence contained in the response, relevance, completeness, clarity, timing where relevant and consistency across responses. AI output is probabilistic and may be incomplete or incorrect. Users can report an AI result, request correction and ask for human review where applicable.

6.3 Significant decisions and safeguards

Woyono does not itself make a decision based solely on automated processing that produces legal or similarly significant effects unless the processing is legally permitted and appropriate safeguards apply. These may include clear information, an opportunity to make representations, meaningful human intervention and a right to contest the decision, in accordance with UK GDPR Articles 22A to 22C, EU GDPR Article 22 where applicable, and NDPA section 37.

If a partner organisation may use a result for recruitment, education, funding, disciplinary action or another significant decision, the organisation-specific notice must explain that use, identify the decision-maker, provide meaningful human review and explain how to challenge the outcome.

6.4 Prohibited inferences and model training

Woyono does not infer protected characteristics, emotion, honesty, personality or mental state from a person’s voice, face or behaviour. Woyono does not authorise identifiable interview content to be used to train a provider’s general-purpose models unless a separate notice identifies the purpose and a valid lawful basis. De-identified or aggregate information may be used to test and improve Woyono features where permitted.

7.1 Transcript-first design

The standard speech workflow is transcript-first. Temporary audio buffers are used to create a transcript and for limited quality or security checks. They are ordinarily deleted within minutes or hours and no later than 24 hours unless you separately enable recording or a shorter notice applies.

7.2 Optional recording

If audio or video recording is enabled, Woyono provides an on-screen notice explaining the purpose, recipients and retention period before recording begins. Optional recordings are normally kept for 30 to 90 days unless a longer period is specifically justified and disclosed.

7.3 Microphone and camera connections

Woyono opens the microphone or camera only for the feature you activate and closes the application connection when the interview, call, recording or related feature ends. Your operating system may continue to remember the permission until you revoke it in device settings; a retained operating-system permission does not mean Woyono continues capturing audio or video.

7.4 Optional acoustic profile

Where you choose to enable this feature, Woyono may create an encrypted acoustic profile to improve how accurately the service recognises your speech, including in noisy environments or where your accent, pronunciation or speaking pattern affects transcription quality.

The profile is used only to improve speech recognition. It is not used to identify or authenticate you, compare your voice with another person’s voice, infer emotion, honesty, personality, health or protected characteristics, or provide advertising.

You can disable the feature and delete the acoustic profile separately from your account through the relevant privacy settings. Deleting the profile does not require you to delete your Woyono account.

Woyono will not use the profile for unique identification or authentication unless it first updates this notice, completes the required data-protection assessment, identifies the applicable lawful basis and sensitive or special-category data condition, and obtains explicit consent where required.

8.1 Device permissions

The app or game may request microphone, camera, media or file access, notifications, local-network access or other permissions only when needed for a feature. The permission prompt and any preceding in-product explanation identify the purpose. You can change permissions in the product or device settings, although disabling a permission may prevent the related feature from working.

8.2 Local saves, offline storage and synchronisation

The app or game may store encrypted or access-controlled local saves, caches, configuration and offline progress on your device. When synchronisation is enabled, relevant data is transmitted to Woyono’s systems. Local data may remain until you sign out, clear app data or uninstall the product. Device, console or platform backups are controlled by the relevant platform provider.

8.3 Push notifications

Woyono uses a platform-issued push token to deliver account, interview, event, security or progression notifications. Notification content is minimised on lock screens where practicable. You can disable notifications in Woyono or device settings.

8.4 Purchases and platform accounts

Apple, Google, console platforms or other payment providers may process account and payment information as independent controllers. Woyono normally receives a transaction reference, receipt status, entitlement and limited fraud or refund information rather than full card details.

9.1 Consumer eligibility

The direct consumer service is intended for people aged 16 or over. This is Woyono’s service eligibility rule and is not a statement that 16 is the statutory digital-consent age in every country. In the United Kingdom, a child aged 13 or over may generally consent for an online service where consent is the lawful basis. Nigerian consent requirements are assessed under NDPA section 31, the Child Rights Act and applicable NDPC guidance.

9.2 High-privacy defaults

Users under 18 receive high-privacy defaults, age-appropriate explanations and restrictions on marketing, public-profile visibility, precise location, social interaction and unnecessary data collection. Woyono considers the best interests and differing needs of children when designing online services likely to be accessed by them.

9.3 Younger users in supervised programmes

A programme involving users below the normal consumer age requires a separate assessment and programme notice, appropriate authority, age and consent mechanisms, safeguarding controls, restricted access and parental or guardian involvement where required by law. Educational or social-care exceptions are used only where their legal conditions are met.

10.1 Cookies and similar technologies

The website, app and browser-based game may use cookies, local storage, SDK identifiers and similar technologies. Strictly necessary technologies support security, authentication, accessibility, network stability and requested functionality. Non-essential analytics, advertising or personalisation technologies are not activated until consent where consent is required. More information is provided in the Cookie and Technologies Policy and consent settings.

10.2 Analytics

Where enabled, analytics helps Woyono understand usage, reliability and feature performance. Woyono minimises identifiers, applies available regional and retention controls, and does not use identifiable interview content for advertising. Under-18 analytics is minimised and marketing identifiers are disabled.

10.3 Marketing

Woyono sends consumer electronic marketing only where permitted, normally with consent. Every marketing message provides an unsubscribe method. Service, security, account and legal messages are not marketing and may still be sent where necessary.

10.4 Research

Participation in an identifiable research activity is optional and uses a separate notice or consent process describing the study, data, recipients and retention. Statistical or de-identified information may be used for research and product evaluation where individuals are not reasonably identifiable and applicable safeguards are applied.

13.1 Account deletion

Where account creation is available, you may initiate deletion through the app or game account/privacy settings where provided, or request deletion outside the product by contacting privacy@woyono.com from the email associated with the account. Woyono removes or de-identifies information from active systems and instructs processors as required, subject to legal retention and documented exceptions.

13.2 Backups and derived information

Deletion is propagated to active systems, relevant derived profiles, scores, embeddings, indexes and instructed processors where required. Information remaining in securely isolated backups expires through the applicable backup-rotation cycle and is not returned to routine active use. If a backup is restored, relevant deletion or suppression instructions are reapplied.

15.1 UK and EEA rights

Depending on the circumstances, you may have rights to access personal data, correct inaccurate information, request erasure, restrict processing, object to legitimate-interest or direct-marketing processing, receive portable data, withdraw consent and obtain safeguards relating to significant automated decisions. EU GDPR rights apply where the EU GDPR governs the processing.

15.2 Nigerian rights

Under the NDPA, Nigerian data subjects may request access, information, rectification, erasure or restriction under section 34; withdraw consent under section 35; object under section 36; request safeguards for qualifying automated decisions under section 37; and exercise portability rights under section 38.

15.3 How to exercise rights

Contact privacy@woyono.com, dpo@woyono.com or, for Nigerian matters, dpo-ngr@woyono.com. We normally verify a request through a logged-in account, a code sent to the registered email, username, Woyono user ID, session reference, platform identifier or organisation/programme ID. If we reasonably doubt identity, we may request proportionate additional information. Formal identification is requested only where reasonably necessary and is not retained longer than needed for verification.

15.4 Product and device choices

Permissions, optional analytics, recording, acoustic profile, marketing and notifications can be managed through relevant Woyono, browser, operating-system, app-store or console settings. Withdrawing consent does not affect processing that was lawful before withdrawal.

16.1 Complaining to Woyono

You may make a data-protection complaint by emailing privacy@woyono.com. Woyono accepts complaints made through other reasonable channels, acknowledges a UK data-protection complaint within 30 days, makes appropriate enquiries, keeps you informed and communicates the outcome without undue delay. A complaint may be made separately from a rights request.

16.2 Supervisory authorities

• United Kingdom: Information Commissioner’s Office — ico.org.uk;
• Nigeria: Nigeria Data Protection Commission — ndpc.gov.ng; or
• European Economic Area: the supervisory authority in the country where you live, work or consider the infringement occurred.

16.3 Personal-data breaches

Where a qualifying personal-data breach occurs, Woyono notifies the relevant regulator within the applicable statutory period, including within 72 hours where required under UK GDPR Article 33 or NDPA section 40. Woyono notifies affected individuals without undue delay where the applicable high-risk threshold is met.