Data Processing Agreement

This Data Processing Agreement (“DPA”) supplements the Master Services Agreement, Statement of Work, or professional engineering agreement (“Principal Agreement”) entered into by and between:

• The Client: The entity identified as the client or customer in the Principal Agreement, acting in the capacity of a Data Controller (“Controller”).
• Rayida Tech: A digital technology and software engineering consultancy registered in Nigeria, acting in the capacity of a Data Processor (“Processor”).

This Agreement sets out the data protection and security commitments required under the Nigeria Data Protection Act (NDPA) 2023 whenever Rayida Tech processes personal data on behalf of the Controller during the provision of software engineering, artificial intelligence integration, web application development, or managed hosting services.

Terms used in this DPA shall have the meanings ascribed to them under the NDPA 2023:

• “Personal Data”: Any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller.
• “Data Controller”: An individual, private entity, or public body that determines the purposes and means of processing personal data.
• “Data Processor”: An individual, private entity, or public body that processes personal data on behalf of and in accordance with the instructions of a Data Controller.
• “Data Subject”: The natural person to whom personal data relates.
• “Personal Data Breach”: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.
• “NDPC”: The Nigeria Data Protection Commission, the statutory regulatory authority established under the NDPA 2023.
• “Sub-processor”: Any vetted third party appointed by the Processor to process personal data on behalf of the Controller.

The Processor shall process personal data solely on documented, written instructions from the Controller, including with respect to international transfers, unless required to do so by applicable Nigerian or international law.

The subject matter, duration, nature, and purpose of processing, alongside categories of data subjects and data types, are defined in Schedule 1 of this DPA and the applicable Statement of Work.

The Controller represents, warrants, and agrees that:

• It possesses a lawful basis under Section 25 of the NDPA 2023 for collecting and transferring personal data to the Processor.
• It has provided appropriate statutory privacy notices to data subjects regarding processing by technology vendors.
• Its instructions to the Processor comply with all applicable Nigerian and international data privacy laws.

The Processor agrees and commits to:

• Process personal data strictly to deliver the agreed services defined in the Principal Agreement.
• Ensure that all personnel, software engineers, and contractors authorized to process personal data are subject to binding statutory or contractual confidentiality obligations.
• Promptly notify the Controller if, in its technical assessment, an instruction given by the Controller infringes the NDPA 2023 or other applicable privacy rules.

In accordance with Section 39 of the NDPA 2023, the Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. These measures include:

• Cryptographic Protections: Encryption of data in transit using modern TLS 1.3 standards and encryption at rest using AES-256 for persistent database storage.
• Access Controls: Role-based access controls (RBAC), multi-factor authentication (MFA), and least-privilege credentials.
• Data Isolation: Logical separation of client data stores and database Row-Level Security (RLS) enforcement.
• Vulnerability Management: Automated static code analysis, dependency auditing, and strict input validation to prevent SQL injection, cross-site scripting (XSS), and header injection.
• Resilience & Recovery: Automated database backups and tested incident recovery procedures.

The Controller grants general written authorization to the Processor to engage vetted infrastructure sub-processors (including cloud hosting providers such as Vercel, Supabase, and transactional email providers such as Resend).

The Processor shall ensure that each sub-processor is bound by written contractual obligations no less protective than those imposed under this DPA, and remains fully liable to the Controller for the performance of its sub-processors.

Any transfer of personal data outside the Federal Republic of Nigeria shall be conducted strictly in accordance with Part VIII of the NDPA 2023, utilizing recognized transfer mechanisms such as Standard Contractual Clauses, transfers to jurisdictions with adequate data protection frameworks, or explicit Controller authorization.

Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Controller's statutory obligation to respond to requests from data subjects exercising their rights under Part VI of the NDPA 2023.

If the Processor receives a direct data subject request relating to Controller data, it shall promptly forward such request to the Controller without responding directly, unless specifically authorized.

The Processor shall notify the Controller in writing without undue delay and in any event within forty-eight (48) hoursof becoming aware of a confirmed Personal Data Breach affecting the Controller's data.

This prompt notification period is established to enable the Controller to meet its statutory duty under Section 40 of the NDPA 2023 to notify the Nigeria Data Protection Commission (NDPC) within seventy-two (72) hours of becoming aware of a high-risk breach.

The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with the obligations laid down in this DPA, and allow for and contribute to audits or technical reviews conducted by the Controller or an independent auditor mandated by the Controller, subject to reasonable advance notice, non-disclosure agreements, and security protocols.

Upon termination of the Principal Agreement or completion of the contracted services, the Processor shall, at the Controller's written choice, securely delete or return all personal data to the Controller, and delete all existing copies, unless Nigerian statutory law requires continued retention.