TryangulPrivacy Policy
Effective date: 29 October 2026 · Version 1.0
Tryangul is operated by APHR Technologies Limited (RC 9673605) ("Tryangul", "we", "us", "our"). This policy explains how we collect, use, share and protect personal data when you use Tryangul, which pays teams across Africa in two ways: Tryangul Payroll, software that computes payroll, handles statutory compliance and disburses pay for a business that employs its own team, and Tryangul Employer of Record (EOR), where Tryangul employs the team on the business's behalf.
1. What this policy covers
This policy applies to:
- Clients: businesses that create a Tryangul account, and the people who administer it.
- Workers: the employees and contractors whose pay is processed through Tryangul, whether the Client employs them (Payroll) or Tryangul employs them for the Client (EOR).
- Visitors: people who use our website or contact us.
It covers both Tryangul Payroll and Tryangul EOR. Our legal role is different under each, as Section 2 explains.
2. Our role: Processor or Controller
Under Tryangul Payroll, we are a Processor. For Worker payroll data (names, bank details, salary, tax and pension information), the Client is the Controller. The Client decides what is collected and why, and we process it only on the Client's instructions to run payroll. If you are a Worker paid through Tryangul Payroll and have a question about your data, contact your employer first. We will help with technical and security matters and pass on any request we receive to the relevant Client.
Under Tryangul EOR, we are also a Controller. We are the legal employer of EOR Workers, so we are the Controller of the data we need to employ them: the employment contract, identity checks, pay, the tax, pension and other statutory filings we make in our own name, and the end of employment. The Client decides the work and the pay it asks us to offer, and we process the data it gives us for those purposes on its instructions. If you are employed through Tryangul EOR, contact us directly about your data.
For Client and account data, we are a Controller. For data about the Client company and its users (account holders, billing, support conversations, website and marketing data), we decide how the data is used. This policy applies directly to that data.
3. Where we operate and which laws apply
Tryangul is built to work across several African countries. We process personal data in line with the data protection law that applies to the Client and Workers concerned, including:
- Nigeria: Nigeria Data Protection Act 2023
- Ghana: Data Protection Act 2012 (Act 843)
- Kenya: Data Protection Act 2019
Where a country is not listed here, we apply the law of the country where the Client operates. Availability by country is shown during onboarding. Nothing in this policy limits rights you have under your local law.
4. Information we collect
Client and account data (we are Controller)
- Business details: company name, registration details, industry, team size.
- User details: name, work email, phone number, role, and password (stored hashed, never in plain text).
- Billing data: balance funding records, security deposit records for EOR, transaction history, invoices. We do not store full card numbers.
- Support records: emails, in-app chats and tickets.
Worker payroll data (Processor under Payroll, Controller under EOR)
Provided by the Client or the Worker, and used only to run payroll and, under EOR, to employ the Worker:
- Identity: full name, date of birth, gender, and for EOR Workers a copy of a government-issued ID, which we review before employing them.
- Government identifiers where required by local law, for example tax, national ID and bank verification numbers.
- Employment: job title, start date, salary and pay components, the employment contract and offboarding records for EOR Workers, and payout account details (bank, mobile money, foreign-currency account or stablecoin account).
- Statutory: pension, social security, health and housing contribution details, and supporting documents such as rent documentation for tax relief.
- Payslips and payment history generated through Tryangul.
Collected automatically
- Device and usage data: IP address, browser type, pages visited, timestamps.
- Security logs: login attempts, multi-factor authentication events, API key usage.
Website visitors and prospects
- Contact details you submit through waitlist, demo or contact forms.
- Aggregate analytics using cookies, only if you agree to them (see Section 12).
5. How we use data and why
| Purpose | What it covers | Legal basis |
|---|---|---|
| Running payroll | Computing gross-to-net pay, generating payslips, initiating disbursement where the Client has chosen it | Performance of the contract with the Client |
| Employing EOR Workers | Issuing and managing employment contracts, checking identity, paying and filing in our own name as employer, and ending employment | Performance of the employment contract; legal obligation as employer |
| Statutory compliance | Generating tax, pension, social security and other statutory schedules, and remitting where the Client has enabled it | Legal obligation (on the Client's behalf, or our own as employer under EOR) and contract |
| Account security | Authentication, fraud and anomaly detection, audit logging | Legitimate interest in keeping the platform secure |
| Customer support | Answering queries and resolving payroll disputes | Contract; legitimate interest |
| Product improvement | Aggregated, de-identified analysis of product use | Legitimate interest |
| Marketing | Waitlist updates and product announcements | Consent, which you can withdraw at any time |
| Legal compliance | Responding to lawful requests from regulators or courts | Legal obligation |
We do not rely on consent to process Worker payroll data, because the employment relationship makes consent an unreliable basis. Contract and legal obligation apply instead.
6. Who we share data with
We share personal data only where needed to provide the service, and only with providers bound by a written data processing agreement. We do not sell personal data, and we do not share Worker payroll data for third-party marketing.
Our core providers are:
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean | Application hosting and primary database, including uploaded documents | United States (New York) |
| Resend | Transactional email | EU (Ireland) |
| Paystack | Balance funding, bank account verification and payouts (Nigeria) | Nigeria |
Payment, verification and payout providers vary by country. The current list, including providers for markets we have launched since this policy's effective date, is published at tryangul.com/subprocessors. We update it before a new provider handles personal data.
We may also disclose data to regulators, tax authorities and courts where the law requires it.
7. International transfers
Tryangul is a cross-border service. Our application and primary database are hosted in the United States (New York), and transactional email is sent from the European Union (Ireland). Payroll data can also move between countries when a Client pays a team in several markets or when a payout runs through a provider in another country.
When we transfer personal data across borders, we use the safeguards recognised by the applicable law, such as contractual protections, adequacy decisions where they exist, and other approved mechanisms. We require every provider to maintain protection equivalent to this policy. On request, we will describe the mechanism that applies to a given transfer.
8. How long we keep data
| Data | Retention |
|---|---|
| Payslips, invoices and payroll run records | The period required by the law of the country where the Client operates, and at least 7 years by default |
| Account and billing records | Life of the account, plus 7 years for financial records |
| Audit and security logs | 2 years, or longer for an active investigation |
| Marketing and waitlist contacts | Until you unsubscribe, or after 2 years of inactivity |
| Data after account closure | Kept only for the statutory periods above, then securely deleted or anonymised |
9. Your rights
If you are a Worker paid through Tryangul Payroll. Your employer is the Controller of your payroll data. Contact your employer first to access, correct or request deletion of your data. You can also email privacy@tryangul.com and we will route your request to the right employer. Some data, such as payroll records within a statutory retention period, cannot be deleted on request. We will tell you which parts of a request we can and cannot fulfil, and why.
If you are employed through Tryangul EOR. We are your employer. Email privacy@tryangul.com and we will handle your request ourselves, involving the Client you work for where it holds the data concerned. You have the rights listed below, subject to the statutory retention periods in Section 8.
If you are a Client, user or visitor. Subject to the law that applies to you, you may:
- access the personal data we hold about you
- correct inaccurate or incomplete data
- request erasure where we are not legally required to keep it
- object to or restrict certain processing
- receive your data in a portable format
- withdraw consent where processing is based on consent
- complain to your local data protection authority
To exercise these rights, email privacy@tryangul.com. We respond within the time required by applicable law.
10. How we protect data
- Encryption in transit (TLS) and at rest.
- Sensitive fields, such as government identifiers and full account numbers, encrypted at the application layer.
- Multi-factor authentication with an authenticator app, available on every account. After signing in, Admin, Payer and Tryangul staff accounts are prompted to turn it on.
- Role-based access, so people see only the data their role needs.
- An append-only audit log of who accessed or changed what, and when.
- Regular access reviews, and prompt revocation when someone leaves a Client's team or ours.
11. Data breaches
If a personal data breach is likely to put your rights or freedoms at risk, we will notify the relevant data protection authority within the time the applicable law requires (72 hours in most of the markets we serve). We will also notify affected Clients without undue delay and, where the risk is high, affected Workers, with enough information to let you protect yourself.
12. Cookies
Our website uses only the cookies it needs to function, such as keeping you signed in. With your consent, it may also use aggregate analytics cookies that do not identify you individually; these stay off unless you accept them. You can change your choice at any time from Cookie settings at the foot of every page. We do not use third-party advertising cookies.
13. Children
Tryangul is a business tool and is not directed at children. We do not knowingly collect personal data about anyone under the legal working age in the relevant country.
14. Changes to this policy
We may update this policy as our service or the law changes. For material changes we will email Clients and update the effective date above. Continued use after a change takes effect means you accept the updated policy.
15. Contact us
- Privacy and data requests: privacy@tryangul.com
- Entity: APHR Technologies Limited (RC 9673605), operating as Tryangul
- Registered office: on file with the Corporate Affairs Commission (Nigeria)