1. Who we are
MSSPACE is a platform for professional engagement, consultancy, training, recruitment, projects, audits, conformity assessment and certification-related services. We also provide workspaces for organisations, certification bodies and MSSPACE staff.
For the processing described in this policy, the responsible MSSPACE operator is:
- Legal company name: MSSPACE INC
- Countries: United States and Nigeria
- United States address: 8 The Green, STE A, Dover, Delaware, United States
- Nigeria address: 229 Mafemi Crescent, Utako, Abuja, Nigeria
- Privacy and data-deletion contact: admin@msspaceglobal.com
This policy covers MSSPACE websites, applications, account services and the features described below, including staff social publishing. Feature-specific notices may provide additional information.
When an organisation or certification body determines why its employees’, customers’ or auditees’ information is processed, it may be a separate data controller. MSSPACE may process those records on its behalf. Its own privacy notice and the relevant service agreement also apply. Contact us if you need help identifying the responsible organisation.
2. Information we process and where it comes from
The information involved depends on the services you use:
| Activity | Information that may be involved |
|---|---|
| Accounts and profiles | Name, contact details, location, time zone, account type, profile photograph, biography, preferences and account-security records. |
| Professional verification | Qualifications, certificates, professional scopes, experience and audit logs, references, identity/KYC submissions and review decisions. |
| Engagements and workspaces | Bookings, negotiations, agreed fees, schedules, assignments, attendance, progress, messages, submitted work and performance records. |
| Audits, certification and assurance | Organisation and department contacts, audit evidence, findings, corrective actions, disputes, reports, review decisions, certification scope and certificate-verification information. |
| Training and assessments | Enrolments, learning activity, questions and answers, assessment results, marking, exam-session events and issued qualifications. Any additional monitoring must be explained through the relevant assessment notice. |
| Recruitment and staff work | Application details, education, experience, assessment and interview records, hiring decisions, employment-related assignments, progress and feedback. |
| Payments and wallets | Invoices, payment references, negotiated earnings, wallet records, payout-account details and identity documents where required. Payment gateways handle the payment credentials submitted directly to them. |
| Meetings and events | Invitations, registration details, schedules, participation and meeting-history records. Any audio/video recording requires an appropriate feature-specific notice; meeting-history records alone do not imply that a recording was made. |
| Reviews and support | Ratings, comments, complaints, correspondence, moderation decisions and support requests. |
| Technical operation | IP address, browser/device information, session identifiers, timestamps, relevant security events and application logs. |
Information may come directly from you, from someone authorised to invite or assign you, from your organisation or certification body, from your nominated referees, from service providers, or from the operation of the platform. Connected social networks supply only information made available under the permissions you authorise.
Please submit information that is relevant to the service and that you are entitled to share. Avoid including unnecessary sensitive information about yourself or other people in reports, messages or social posts.
3. Why we use information
We use information to:
- Create and secure accounts, verify professional eligibility and manage access.
- Arrange and deliver bookings, consultancy, training, assessments, recruitment, audits and certification workflows.
- Support communication, attendance, assignments, review, corrective action and dispute resolution.
- Process payments, earnings, refunds, reconciliation and required financial records.
- Display approved profile, service, review and verification information as part of the relevant feature.
- Operate authorised social connections and publish content selected by staff.
- Provide support, prevent misuse, investigate security incidents and maintain reliable services.
- Send relevant service notices and manage optional communications according to applicable requirements and available preferences.
Where a lawful basis is required, we identify it for the particular processing. This may be performing a contract or taking requested steps before one, meeting a legal obligation, pursuing a legitimate operational or security interest after considering your rights, or obtaining consent for an optional activity. An employer or certification body may need its own lawful basis for records it submits.
We do not treat acceptance of this policy as blanket consent to unrelated processing. Withholding information needed to deliver or secure a service may prevent us from providing that service.
4. LinkedIn, Facebook and Instagram connections
The social publishing feature allows authorised MSSPACE staff to connect accounts or Pages they are permitted to manage, prepare content and arrange publication. Social-platform connections use the platform’s authorisation screen. MSSPACE does not need your LinkedIn, Facebook or Instagram password for this connection.
Depending on the authorised platform and feature, we may receive or store:
- Account or Page identifiers, display names, profile/logo images and the list of manageable Pages needed for account selection.
- Access tokens, refresh tokens where provided, permission information and token-expiry details needed to maintain the connection.
- Text, images, videos, scheduled times and account selections supplied for publication.
- Published-post identifiers, publishing status, errors and, where used by an enabled feature, permitted engagement information.
We use social-platform data to operate the authorised account-management and publishing functions. We do not sell it, use it to build unrelated marketing lists, or use it to enrich MSSPACE professional-verification, recruitment or credit profiles. A post you independently create in MSSPACE is distinct from information retrieved through a platform API.
MSSPACE operates the publishing engine on infrastructure it controls. Authorising a connection still involves the selected social network, which processes information under its own privacy terms. Content selected for publication is transmitted to that network and becomes visible according to the chosen destination and that network’s rules.
Private and shared workspaces control ordinary staff access to the publishing workspace. Shared spaces make information available to their authorised members. Limited access by authorised administrators or service personnel may be needed for support, security or legal obligations.
Media supplied for social publication may be served through publicly accessible media URLs so platforms can retrieve it, including during preparation or processing. Do not use social-post uploads to store confidential audit evidence, identity documents or other private business records.
Disconnecting and requesting social-data deletion
You can remove a connection through the Social media Accounts area where you have the required workspace permissions. You can also revoke MSSPACE’s authorisation through the connected platform’s own account settings.
Removing a connection erases its reusable credentials and stops future queued publication. To erase associated drafts, uploads, publishing history or other stored data, make a deletion request as well. For erasure, contact admin@msspaceglobal.com with the subject “Social media data deletion request”, identifying the network and the account/Page or workspace concerned. We may request proportionate information to verify your authority. Do not send passwords, access tokens or client secrets.
We will identify the relevant stored connection information, tokens and associated content, remove information no longer required, and explain any limited information that must remain for a lawful reason. We aim to acknowledge the request within 3 working days and complete it within 28 calendar days of receipt, subject to necessary verification and applicable law. Future queued publication is stopped when disconnection or revocation is received or detected; an external request already in progress may finish and cannot always be recalled. reusable social credentials have a separate 24-hour maximum removal period. A shorter platform requirement takes precedence.
Removing information from MSSPACE does not automatically remove content already published on a social network or copies independently held by other people. Such content may also need to be removed through the network concerned. We will explain the available actions for content under our control.
5. Who can see information
Information is made available according to the relevant workspace, role, assignment and publication rules. Recipients may include:
- The organisation, certification body, professional, trainer, examiner, recruiter or other participant involved in the service.
- Department representatives, supervisors, reviewers and decision-makers where their work requires access.
- Staff or technical providers authorised to support the service, manage security or meet a legal obligation.
- Hosting, storage, communications and payment providers needed for the relevant function.
- Authorities or other recipients where disclosure is legally required or necessary to establish or defend a legal claim.
Approved public professional profiles, service information, moderated reviews and published certification-verification information may be visible to other users or the public. Shared links and QR codes can make designated information available to people who receive them, according to that feature’s access rules. Consider the intended audience before sharing a link.
Confidential audit evidence, identity/KYC documents and internal work records are not made public merely because a public profile or verification card exists. A public certificate-confirmation view is distinct from access to the original certificate or complete audit file.
We do not sell or rent personal information. Any optional disclosure outside these stated purposes requires an appropriate lawful basis and notice.
6. International processing
MSSPACE serves users in different countries. Its current core application and publishing hosting is in the United States; other providers or service participants may process information elsewhere.
Where a transfer is subject to legal safeguards, we must identify and apply the appropriate arrangements for that transfer. You may contact us for information about the relevant recipients, locations and safeguards. Contact us before submitting information if your organisation requires a particular processing location or transfer arrangement.
7. How long information is kept
We retain information for the purpose for which it is needed, using the schedule below. These are MSSPACE’s selected operating periods, not a statement that every law requires the same periods. A shorter applicable privacy or platform limit takes precedence unless a valid legal obligation requires the specific information to remain. Any longer retention must have a recorded legal, scheme or contractual basis; it does not permit unrestricted reuse or marketing.
Periods run from the event stated in each row. An unrelated login, automated email or background job does not restart a retention period.
| Record category | MSSPACE retention and deletion period |
|---|---|
| Account and ordinary profile data | Kept while the account serves an active purpose. Following a valid closure/deletion request, remove public access promptly and erase or irreversibly anonymise unnecessary personal data within 28 calendar days of receipt, subject to proportionate identity verification and lawful exceptions. Retain only the separate records covered below. |
| Inactive or incomplete professional accounts | The existing 30-day suspension rules and reminders apply. Suspension is not permanent erasure. Review suspended accounts after 12 months; data without a continuing documented purpose is referred for Super Admin-authorised deletion. Permanent deletion of a professional account is not an automatic consequence of inactivity. This does not postpone a valid deletion request. |
| Raw identity/KYC documents | Delete within 90 days after the final verification decision, keeping only the minimum verification result/reference still needed. Preserve a document longer only where an identified law or regulator requires that document, or a specific investigation needs it; record that reason and expiry. Unneeded bank-account details are removed within 28 days after account closure and settlement. |
| Invoices, payment/earnings ledgers and essential financial records | 7 years from the end of the financial year of the final relevant transaction, with access restricted after the service ends. Keep the necessary transaction evidence, not every identity document, full bank credential or unrelated message. A different period required by applicable law must be recorded and applied to the affected record. |
| Final audit, assurance, consultancy and certification case evidence | Default 7 years from the final report or certification decision, subject to the responsible organisation/CB’s documented scheme and service requirements. Preserve the current and previous complete certification-cycle evidence where required by the applicable schedule. Delete surplus working copies and unnecessary personal information earlier. A minimum certificate-validation record may remain while a credential is valid and for 7 years after expiry or withdrawal. |
| Training and examination records | Detailed answers, ordinary assessment evidence and routine exam-monitoring events: 12 months after the result becomes final or the appeal closes, whichever is later, unless a documented scheme/legal requirement needs longer. Keep only the minimum qualification/award-verification record while the credential is valid and for 7 years after expiry or withdrawal. |
| Unsuccessful recruitment applications | 12 months after the final hiring decision or last relevant recruitment action, whichever is later, then erase or irreversibly anonymise. Apply a longer specific employment-record requirement or legal hold where necessary. Earlier applications with a specific shorter retention notice keep that notice unless a documented lawful hold applies. Keeping someone for future vacancies requires a separately stated purpose and an expiry; it does not restart the original application’s clock. |
| Unused social drafts and social-upload files | Unused drafts: 90 days after the last meaningful edit. Unattached uploads: 30 days after upload. Keep material linked to a genuine future scheduled post until publication/cancellation is resolved. Unneeded publishing media and first-party publishing history expire 12 months after publication or cancellation, or earlier after a valid deletion request. Platform-derived copies may have much shorter limits below. |
| Disconnected or revoked social credentials | Stop new and queued publication immediately when disconnection/revocation is received or detected. An external publication request already in progress may finish. Erase access tokens, refresh tokens and other reusable connection secrets without delay and no later than 24 hours after the disconnect/revocation is received or detected. Do not wait for the general 28-day request deadline. |
| Data retrieved through LinkedIn/Meta APIs | Keep it only for the authorised purpose and applicable platform limit. For LinkedIn, other members’ retrieved profile data is restricted to a 24-hour cache; retrieved member social activity to 48 hours; retrieved profile data for an authorised organisation to 8 weeks; and retrieved activity for an authorised organisation to 6 months, subject to shorter member-data limits. Other retrieved organisation activity is limited to 6 weeks; permitted aggregate Page administration/reporting data to 1 year. Apply any shorter Meta or LinkedIn requirement. These limits do not automatically extend to original content independently supplied by a user. |
| Ordinary support cases, non-record messages and event/meeting administration | 24 months after the case, engagement or event closes. Remove unnecessary attachments earlier. A message that is genuinely required audit, financial, employment or dispute evidence follows that particular record’s schedule instead. Actual recordings, if a feature permits them, require a separate notice and purpose-specific expiry; this policy does not authorise recording. |
| Operational, security and access logs | Routine technical/access logs: 30 days. Authentication/security-event logs: 90 days. Privileged administrative access/change logs: 12 months. Preserve the minimum incident evidence longer only for a documented investigation or legal hold. Do not log passwords, reusable social tokens or unnecessary document contents. |
| Staff work and employment records | Routine detailed task/activity data: 12 months after completion, unless it forms part of a necessary performance, employment or legal record. Necessary personnel/decision records: employment plus 3 years, with payroll/financial evidence and any specific longer statutory requirement handled separately. Reduce retained detail to the actual recordkeeping need. |
| Backups, if maintained | Residual copies removed from live processing must be isolated from ordinary use and expire within a maximum 90-day backup rotation, or sooner where law/platform requirements require it. Apply completed erasures before restored data is returned to service. Reusable social credentials must meet the earlier credential-removal deadline, including by an effective secure-erasure mechanism. This rule does not imply that a new backup service has been purchased or enabled. |
Deletion requests and exceptional retention
We aim to acknowledge a privacy/deletion request within 3 working days and complete valid requests within 28 calendar days of receipt, or sooner where applicable rules require. If identity or authority needs checking, we will ask promptly and explain the effect on any applicable legal deadline. We will not use verification to delay a request unnecessarily.
Where a specific law permits a necessary extension or requires some records to remain, we will explain the reason, identify the data affected and state the response date or retention criteria. An internal approval queue is not, by itself, a reason to miss a legal deadline. A scheduled retention period alone is not an exemption from a valid erasure request. Essential retained records are separated from ordinary account use; closing an account does not erase another person’s lawful audit, certification or payment record.
A legal hold must identify its owner, the records needed, the reason and a review date. Review it at least every 90 days, release it promptly when the need ends, and resume the applicable deletion schedule. A hold must not freeze unrelated records or override an incompatible platform restriction without a lawful basis.
Deletion means erasure or irreversible anonymisation of the affected information across the relevant databases, files, caches and derived copies. Hiding a row, marking it inactive, removing a menu item or replacing a name with a linkable identifier is not sufficient. Retain only a minimal completion/exception log for 3 years, without copying the erased documents, post content or reusable credentials into it. A minimal marketing-suppression record may remain as long as it is needed to respect an opt-out; review that need annually.
Retention is administered through scheduled controls and authorised operational reviews; this schedule does not mean every category is deleted automatically. A person can request erasure before a routine retention period ends.
8. Security
We use access controls, secure transport, server-side protection of integration credentials, session controls and operational safeguards appropriate to the information processed. Access is limited by workspace and role requirements. Authorised service personnel may need controlled access to operate or support the system.
Protect your own credentials, use the access controls available to you and report suspected unauthorised access promptly. Public links and published social content should be treated according to their intended audience. No system can guarantee absolute security.
9. Browser storage and communications
Cookies or browser storage may support sign-in, session security, display preferences and remembering a booking or application destination. Pages may also load assets from external providers, which can receive normal connection information.
Any optional analytics or marketing tracking must be identified and controlled in accordance with applicable requirements. External font, icon, image and embedded-content providers can receive your IP address and browser information when their resources load. Browser settings can restrict cookies, but disabling essential storage may prevent sign-in or other requested functions.
You can adjust available notification/newsletter preferences, use an unsubscribe option where provided, or contact us about optional marketing. Necessary security, transaction and service notices may still be sent.
10. Automated indicators and account rules
MSSPACE may calculate progress, performance, professional eligibility, review or screening indicators and apply published account-lifecycle rules. These calculations may affect what a user can see or do. They should be explained in the relevant feature.
If you believe information is wrong or an automated restriction or indicator has affected you unfairly, contact us to request correction or an appropriate human review. We will explain available review rights and the relevant decision process under applicable law.
11. Your choices and rights
Depending on the law applicable to your information, you may request access to it, correction of inaccuracies, deletion, a portable copy, restriction of processing or an explanation/review of a relevant automated decision. You may also be able to object to certain processing and withdraw consent for an activity that relies on it.
Send requests to admin@msspaceglobal.com. We may verify identity or authority using information proportionate to the request. We will respond within applicable legal time limits, explain any valid restriction or necessary extension, and identify a remaining lawful retention requirement where relevant. Withdrawing consent does not undo processing lawfully completed before withdrawal.
Where an organisation or certification body controls the record, we may help route your request to it and assist under the relevant agreement. You may also complain to the relevant data-protection authority. In Nigeria, this is the Nigeria Data Protection Commission.
12. Children and persons needing additional protection
Professional and staff services are intended for adults. If you believe a child has supplied information without appropriate authorisation, contact us so we can investigate and take the necessary action. If a service permits children or other people requiring additional protection, it must provide an appropriate notice and obtain any authorisation required before collecting their information.
13. Updates and contact
We will display the effective date of this policy and provide appropriate notice of material changes. Where a new use requires consent or another step, updating the policy alone does not replace that requirement.
For privacy questions, complaints or data-deletion requests, contact:
MSSPACE INC United States: 8 The Green, STE A, Dover, Delaware, United States Nigeria: 229 Mafemi Crescent, Utako, Abuja, Nigeria admin@msspaceglobal.com