Legal
Data processing agreement
Last updated 21 October 2026
Data Processing Agreement (DPA)
Last Updated: 21 October 2026
Version: 1.0.0
1. Parties
Controller: Customer (you), as identified in the Order Form or Account
Processor: NairaCloud Technologies Limited, incorporated in Nigeria, Lagos, Nigeria ("NairaCloud", "we", "us")
2. Definitions
Terms defined in GDPR Art. 4, NDPA 2023, and the Agreement apply. Key terms:
- "Personal Data": Any information relating to an identified or identifiable natural person
- "Processing": Any operation on Personal Data
- "Subprocessor": Third party engaged by Processor to process Personal Data
- "Security Incident": Breach of security leading to accidental/unlawful destruction, loss, alteration, unauthorized disclosure/access
- "Services": Cloud infrastructure services per the Agreement
- "Agreement": Terms of Use + Order Form + this DPA + SLAs
3. Scope and Duration
3.1 Scope
Applies to all Personal Data processed by Processor on behalf of Controller in connection with the Services.
3.2 Duration
Term of Agreement + 90 days post-termination (grace period for data export/deletion).
3.3 Territorial Scope
Processing occurs in the locations where the Processor and its Subprocessors operate (see Exhibit A).
4. Nature and Purpose of Processing
Processor processes Personal Data for:
- Hosting & Compute: Running Customer instances, containers, workloads
- Storage: Block, object, backup storage
- Networking: Load balancing, DNS, content delivery
- Monitoring & Observability: Metrics, logs, traces, alerting
- Billing & Invoicing: Usage calculation, payment processing, tax compliance
- Support & Operations: Ticket handling, incident response, maintenance
- Security & Fraud Prevention: Authentication, authorization, anomaly detection, abuse mitigation
- Platform Improvement: Aggregated, pseudonymized analytics (opt-in)
5. Categories of Personal Data
| Category | Examples |
|---|---|
| Identity Data | Name, email, username, SSH keys, API keys |
| Contact Data | Address, phone, organization details |
| Billing Data | Payment references, invoice history, tax IDs (no full card numbers) |
| Authentication Data | Hashed passwords, MFA secrets, session tokens, audit logs |
| Technical Data | IP addresses, instance metadata, resource usage, logs, metrics |
| Communications | Support tickets, emails, chat transcripts |
| Location Data | Datacenter region selection (no precise geolocation) |
Special Category Data (GDPR Art. 9): Not processed by Processor unless Controller uploads to instances (Controller remains Controller for such data).
6. Categories of Data Subjects
- Controller's employees, contractors, agents
- Controller's customers, end users, website visitors
- Trial users, prospects
- Support requestors
7. Processor Obligations
7.1 Processing Instructions (GDPR Art. 28.3.a, NDPA 2023)
Processor shall:
- Process Personal Data only on documented instructions from Controller (this DPA + Agreement + Controller's lawful commands via dashboard/API)
- Not use Personal Data for Processor's own purposes
- Inform Controller if instruction infringes GDPR/NDPA/other laws
- Reject unlawful government access requests where legally permissible
7.2 Confidentiality (GDPR Art. 28.3.b)
- All personnel authorized to process Personal Data bound by written confidentiality obligations
- Access on need-to-know basis, least privilege
- Annual confidentiality acknowledgments
7.3 Security of Processing (GDPR Art. 28.3.c, Art. 32, NDPA 2023)
Technical Measures
- Encryption of Personal Data in transit and at rest
- Access controls based on least privilege, with multi-factor authentication and periodic access reviews
- Network isolation and segmentation
- Vulnerability management with regular scanning and timely patching
- Centralized logging and monitoring
- Encrypted backups with periodically tested recovery procedures
- Secure development practices and security testing
Organizational Measures
- Documented security policies and procedures
- Annual security awareness training
- Background checks for personnel with data access (per local law)
- 24/7 incident response, with breach notification to Controller
- Regular third-party security assessments
- Internal audits and management reviews
Physical Security (via Subprocessors)
- Data centers operated by vetted providers with industry-standard physical controls
- Geographic redundancy
7.4 Subprocessors (GDPR Art. 28.2, 28.4, NDPA 2023)
7.4.1 General Authorization
Controller generally authorizes Subprocessors listed in Exhibit A.
7.4.2 New Subprocessors
- 30-day written notice before onboarding
- Controller may object within 14 days (good faith commercial reason)
- If objection unresolved, Controller may terminate affected Services (no penalty)
7.4.3 Subprocessor Agreements
Written contracts imposing equivalent obligations (GDPR Art. 28.3-4), including:
- Processing only per Controller instructions
- Confidentiality
- Security measures
- Sub-subprocessor flow-down
- Data subject rights assistance
- Breach notification
- Deletion/return
- Audit rights
7.4.4 Liability
Processor remains fully liable for Subprocessor acts/omissions (GDPR Art. 28.4).
7.5 Data Subject Rights Assistance (GDPR Arts. 12-23, NDPA 2023)
Processor shall, at Controller's request and expense:
- Provide access to Personal Data
- Rectify, erase, restrict processing
- Provide data in structured, commonly used, machine-readable format (JSON/CSV)
- Assist with objection to processing, automated decision-making
- Response: Within 10 business days of Controller request
- Tools: Dashboard self-service (Data Export, Delete Account) and manual support for complex requests
7.6 Security Incident / Breach Notification (GDPR Art. 33-34, NDPA 2023)
- Notification: Without undue delay, max 48 hours after awareness
- Content: Nature, categories/approx. number of data subjects/records, likely consequences, measures taken/proposed, DPO contact
- Coordination: Processor assists Controller with DPA/Supervisory Authority notification (Art. 33) and data subject notification (Art. 34)
- Logs: Incident response logs retained 7 years
7.7 Deletion or Return of Data (GDPR Art. 28.3.g, Art. 17)
- On termination: Delete or return all Personal Data within 90 days (grace period for Controller export)
- Backup deletion: Within 90 days (rolling backup cycle)
- Certification: Written confirmation of deletion on request
- Legal holds: Preserve data subject to legal hold; notify Controller
7.8 Audit Rights (GDPR Art. 28.3.h)
- Self-assessment: Annual security summary and Subprocessor list on request
- On-site/Remote Audit: Once per year, 30 days' notice, business hours, reasonable scope, Controller bears cost unless material non-compliance found
- Third-party audit: Processor may require NDA, reasonable restrictions (security, other customers' data)
- Regulator audit: Full cooperation with Supervisory Authority/NDPC
7.9 Data Protection Impact Assessment (DPIA) (GDPR Art. 35)
- Processor conducts DPIAs for new/high-risk processing
- Shares summary with Controller on request
- Consults Supervisory Authority where required
7.10 Records of Processing Activities (ROPA) (GDPR Art. 30, NDPA 2023)
- Processor maintains ROPA for Controller processing
- Available to Supervisory Authority/NDPC on request
- Controller may request relevant extracts
8. International Transfers (GDPR Ch. V, NDPA 2023)
8.1 Transfer Mechanisms
| Destination | Mechanism |
|---|---|
| EEA → Nigeria | Standard Contractual Clauses + Supplementary Measures |
| EEA → third countries | Standard Contractual Clauses + Supplementary Measures |
| Other | Standard Contractual Clauses + Supplementary Measures per EDPB recommendations |
8.2 Supplementary Measures
- Encryption in transit and at rest, with keys controlled by the Processor
- Pseudonymization where feasible
- Contractual, technical, and procedural controls
- No government access beyond lawful process (transparency reports annually)
8.3 Transfer Impact Assessments (TIAs)
Conducted for all third-country transfers. Updated annually or on legal change.
9. Liability (GDPR Art. 82)
- Each Party liable for own GDPR/NDPA violations
- Processor liability limited per Agreement's Limitation of Liability clause
- No exclusion of liability for fraud, willful misconduct, data subject rights
- Controller indemnifies Processor for Controller's instruction violations
10. Governing Law and Dispute Resolution
- Governing Law: Federal Republic of Nigeria
- Jurisdiction: Lagos State courts (exclusive)
- Alternative: Mediation (Lagos Court of Arbitration) before litigation
- GDPR/NDPA: Data subjects may sue in their habitual residence (Art. 79 GDPR)
11. General
- Entire Agreement: This DPA + Agreement = full understanding
- Amendments: Written, signed (electronic accepted)
- Severability: Invalid provisions severed, remainder enforced
- Assignment: Neither Party without consent (not unreasonably withheld); except affiliates, acquirers
- Notices: Email to DPO/controller email on file; deemed received on send
- Language: English controls
12. Contact
NairaCloud DPO: dpo@nairacloud.xyz
Controller DPO: [Controller to provide]
EXHIBIT A: SUBPROCESSORS
| Category | Purpose | Location |
|---|---|---|
| Payment processing | Payment processing | Nigeria |
| Email delivery | Transactional email | Various |
| Managed data & caching | Database and cache hosting | Various |
| Infrastructure hosting | Compute and storage | Various |
| Monitoring | Error and performance monitoring | Various |
Subprocessor updates: available on request (30-day notice via email + dashboard)
EXHIBIT B: TECHNICAL AND ORGANIZATIONAL MEASURES (TOMs) SUMMARY
| Domain | Measures |
|---|---|
| Access Control | Least privilege, MFA, just-in-time access, quarterly access reviews, automated offboarding |
| Asset Management | Asset inventory, encrypted disks, approved software list, vulnerability scanning |
| Business Continuity | Redundant deployment, daily backups, disaster recovery plan tested quarterly |
| Change Management | Peer-reviewed changes, automated deployment gates, canary releases, quick rollback |
| Cryptography | Encryption of data in transit and at rest, managed keys, certificate automation |
| HR Security | Background checks, NDAs, annual training, phishing tests, disciplinary process |
| Incident Management | 24/7 on-call, runbooks, severity classification, breach notification, post-mortems |
| Logging & Monitoring | Centralized logging, retention controls, alerting, audit trails |
| Network Security | Network segmentation, access controls, DDoS protection |
| Physical Security | Via providers: certified data centers with physical access controls |
| Supplier Management | Vendor risk assessments, DPA flow-down, annual reviews, termination clauses |
| Vulnerability Mgmt | Automated scanning, patching SLAs, security testing |
EXHIBIT C: DATA SUBJECT RIGHTS PROCEDURES
| Right | Processor Procedure | SLA |
|---|---|---|
| Access (Art. 15) | Dashboard export (JSON/CSV) or support request | 10 business days |
| Rectification (Art. 16) | Dashboard profile edit or support request | 5 business days |
| Erasure (Art. 17) | Dashboard "Delete Account" (soft delete 30d, then purge) | 30 days |
| Restriction (Art. 18) | Flag account, suspend processing (retain data) | 10 business days |
| Portability (Art. 20) | Dashboard export (machine-readable) | 10 business days |
| Objection (Art. 21) | Analytics opt-out via dashboard; marketing unsubscribe | Immediate (analytics) / 5 days (marketing) |
| Automated Decision (Art. 22) | Not applicable (no solely automated significant decisions) | N/A |
EXHIBIT D: SECURITY INCIDENT NOTIFICATION TEMPLATE
To: Controller DPO / Security Contact
From: NairaCloud Security Team
Date: [Timestamp]
Classification: CONFIDENTIAL
- Incident ID: INC-[YYYYMMDD]-[NNN]
- Discovery Date/Time: [UTC]
- Description: [What happened, how discovered]
- Personal Data Affected: [Categories, approx. count, data subjects]
- Likely Consequences: [Risk assessment]
- Measures Taken: [Containment, eradication, recovery]
- Measures Proposed: [Remediation, prevention]
- DPO Contact: dpo@nairacloud.xyz
- Next Update: [Date/Time]
This DPA incorporates by reference the Standard Contractual Clauses (EU) 2021/914 for Controller-to-Processor transfers, as amended by the UK Addendum. In case of conflict, this DPA prevails.