Privacy Policy — WML Service Desk
1. Who we are
WML Service Desk ("the App") is operated by WestMetro Limited ("WestMetro", "we", "us"), a company registered in Nigeria, of Lagos, Nigeria. WestMetro is the data controller for personal data processed through the App. You can contact us about this policy or your data at hello@westmetrong.com.
This policy explains what information the App collects, how we use it, how we protect it, and the choices you have. It applies to the App at https://servicedesk.westmetro.ng and to any Google account you connect to it.
2. Information we collect
Account information. Your name, work email address, job role and login credentials, which WestMetro uses to create and manage your account.
Business records you create in the App. Client and contact details, engagement records, service requests, tasks, invoices, agreements and attached documents entered by authorised users in the course of WestMetro's business.
Technical information. IP address, browser type, login times and activity logs, collected automatically for security, troubleshooting and audit purposes. We use only session cookies that are strictly necessary for signing in. We do not use advertising or tracking cookies.
3. Information we access from your Google account
If you choose to connect your Google account, the App asks for your permission on Google's consent screen before accessing anything. The App requests only the following:
| Google permission | What it allows | Why we need it |
|---|---|---|
Google Drive: files created by this app (drive.file) |
Create, update and organise files and folders that the App itself creates in your Google Drive | To save copies of documents generated in the App (for example invoice PDFs, engagement files and signed agreements) into the correct folders in your Drive |
The App cannot see, open, read or delete any other files in your
Google Drive. The drive.file permission limits access to files and
folders the App itself creates. The App does not access your Gmail, Contacts,
Calendar or any other Google service.
We store the OAuth access and refresh tokens Google issues, plus the IDs of the Drive files and folders the App creates. We need these to keep filing documents for you. We do not store copies of any other Google data.
4. How we use Google user data
We use Google user data only to provide the App's user-facing features described above, which means filing documents created in the App into your Google Drive. We do not:
- sell Google user data;
- use or transfer Google user data for advertising, including targeted, personalised or interest-based advertising;
- use Google user data to determine creditworthiness or for lending purposes;
- transfer Google user data to third parties, except as needed to provide or improve the App's user-facing features, to comply with applicable law, or as part of a merger or acquisition with notice to you;
- allow humans to read Google user data, unless you have given us specific permission (for example in a support request), it is necessary for security purposes such as investigating abuse, or it is required by law;
- use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.
WML Service Desk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. How we use other information
We use account, business and technical information to provide and operate the App, authenticate users, keep accurate business and financial records, provide support, secure the App and detect misuse, and meet our legal, tax and regulatory obligations.
Our lawful bases under the Nigeria Data Protection Act 2023 are: performance of contracts with our clients and staff; compliance with legal obligations (including tax and record-keeping rules); our legitimate interests in running and securing our business; and your consent where we ask for it, such as when you connect your Google account.
6. Sharing and disclosure
We do not sell personal data. We share it only:
- with service providers who host and operate the App for us (cloud hosting and infrastructure), under contracts that require them to protect the data and use it only on our instructions;
- with Google, when you choose to have the App file documents into your Google Drive;
- with regulators, tax authorities, courts or law enforcement where the law requires it;
- with a successor organisation in a merger, acquisition or sale of assets, with notice to you.
7. Data storage and security
The App runs on secured cloud servers. We protect data with encryption in transit (HTTPS/TLS), access controls limited to authorised personnel, OAuth tokens stored on our server with access restricted to the application's service account, regular backups, activity logging and timely security updates. No system is perfectly secure, but we follow industry practice and promptly investigate any suspected breach. Where the law requires, we notify affected users and the Nigeria Data Protection Commission.
8. Data retention
- Google OAuth tokens: stored on our server while the Google Drive integration is in use. We delete the stored token from our servers on request (email hello@westmetrong.com) and when the integration is removed.
- Records of Drive file IDs: deleted when the Google Drive integration is removed, unless they are part of a business record we must keep.
- Documents already saved to your Google Drive: these belong to you and stay in your Drive until you delete them.
- Account information: kept while your account is active and deleted or anonymised within 90 days after it is closed, unless the law requires longer retention.
- Business and financial records: kept for as long as tax, accounting and other legal rules require.
9. Your choices and rights
You can revoke the App's access to your Google account at any time at https://myaccount.google.com/permissions. Once access is revoked, the App can no longer reach your Google Drive. We delete the stored token from our servers on request (email hello@westmetrong.com) and when the integration is removed.
Under the Nigeria Data Protection Act 2023 and other applicable laws, you may ask to access, correct, delete or receive a copy of your personal data, object to or restrict certain processing, and withdraw consent at any time. Withdrawing consent doesn't affect processing that already took place. To make a request, email hello@westmetrong.com. We respond within 30 days. You may also complain to the Nigeria Data Protection Commission (NDPC).
To ask us to delete data obtained from Google, email hello@westmetrong.com with the subject "Google data deletion". We will confirm once it is done.
10. Children
The App is a business tool for authorised WestMetro staff and is not directed at anyone under 18. We do not knowingly collect children's data.
11. International transfers
Our hosting providers and Google may process data outside Nigeria. Where this happens, we rely on safeguards permitted by the Nigeria Data Protection Act 2023.
12. Changes to this policy
We may update this policy from time to time. We will post the new version on this page with a new effective date and, for significant changes, notify users in the App or by email.
13. Contact
WestMetro Limited
Lagos, Nigeria
Email: hello@westmetrong.com