Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the customer identified in the applicable SabaothCloud account or order ("Customer") and SabaothCloud ("SabaothCloud", "we", "us", or "our"), with a business address in Ibadan, Nigeria. It applies when SabaothCloud processes Personal Data on Customer's behalf through the Services.

This DPA is intended to support compliance with the Nigeria Data Protection Act 2023 ("NDP Act"), the Nigeria Data Protection Commission ("NDPC") directives applicable to the processing, including the NDP Act General Application and Implementation Directive, and other applicable data-protection law. It does not replace Customer's obligation to provide a lawful, transparent privacy notice to its data subjects.

1. Definitions

"Personal Data", "Data Subject", "Data Controller", "Data Processor", "processing", and "process" have the meanings given in the NDP Act. "Customer Data" means data submitted to or stored in the Services by or for Customer. "Sub-processor" means a third party appointed by SabaothCloud to process Personal Data for the Services. "Security Incident" means a breach of security that results in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

2. Roles and scope

Customer is the Data Controller of Personal Data contained in Customer Data, and SabaothCloud is the Data Processor. Customer determines the purposes and means of processing. SabaothCloud will process Personal Data only to provide, secure, support, and maintain the Services, or on Customer's documented instructions, unless processing is required by applicable law.

SabaothCloud may process account, user, audit, and support data as an independent controller where it determines the purposes of that processing, such as account administration, billing, fraud prevention, security, legal compliance, and service improvement. This DPA does not govern that independent processing; our Privacy Policy applies instead.

3. Processing details and instructions

The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects are described below and in Customer's configuration of the Services. Customer's documented instructions include this DPA, the applicable order, product documentation, and configuration choices. Customer may issue additional reasonable instructions that are consistent with the Services.

• Subject matter: hosting, storage, transmission, backup, access, monitoring, and support for Customer Data.
• Purpose: providing the managed database, compute, networking, API, and related Services selected by Customer.
• Duration: the term of the applicable Services, plus the period needed to return, delete, or securely expire Customer Data.
• Processing location: Germany is SabaothCloud's primary data-center and storage location. Limited processing may occur elsewhere where necessary to provide the Services.
• Personal Data: identifiers, contact details, account credentials, technical identifiers, logs, usage data, and any other data Customer places in the Services.
• Data Subjects: Customer's users, employees, contractors, customers, suppliers, website visitors, and other individuals whose data Customer submits.

Customer must not submit sensitive or highly sensitive Personal Data, children's data, payment-card data, or regulated data unless the selected Services and this DPA are suitable for that processing and Customer has completed any required assessment, notice, consent, or other legal step.

4. Customer responsibilities

Customer is responsible for establishing a lawful basis, giving required notices, obtaining valid consents where needed, responding to Data Subjects, and ensuring its instructions comply with applicable law. Customer must use appropriate access controls, configure its environments securely, and maintain independent backups where needed.

Customer will not instruct SabaothCloud to process Personal Data in a way that violates the NDP Act, another applicable law, or a Data Subject's rights. Customer will promptly notify SabaothCloud if it identifies an instruction that may be unlawful.

5. Confidentiality and personnel

SabaothCloud will keep Customer Data confidential and will ensure that personnel authorized to process Personal Data are bound by confidentiality obligations and receive appropriate privacy and security training. SabaothCloud will limit access to Personal Data to people who need it to perform their role.

6. Security measures

SabaothCloud will maintain technical and organizational measures appropriate to the risk of processing, taking account of the nature of the Services and the state of technology. Measures include access management, authentication, least-privilege controls, encryption in transit where supported, secure development practices, logging and monitoring, backups, vulnerability management, incident response, business continuity procedures, and personnel confidentiality.

Customer acknowledges that security also depends on its configuration, credentials, applications, users, and instructions. SabaothCloud may update measures where the overall level of protection is not reduced.

7. Sub-processors

Customer gives SabaothCloud general authorization to use Sub-processors that are reasonably necessary to provide the Services. SabaothCloud will maintain a current list or provide information about relevant Sub-processors on request. We will impose written data-protection obligations on Sub-processors and remain responsible for their performance to the extent required by applicable law.

Where required by law or our written process, we will provide notice of a material Sub-processor change. Customer may raise a reasonable, data-protection-based objection. The parties will work in good faith to address it; if no reasonable solution is available, either party may use the termination rights in the applicable agreement.

8. Data Subject requests

Taking into account the nature of the processing, SabaothCloud will reasonably assist Customer with requests from Data Subjects to exercise rights under applicable law. If a Data Subject contacts SabaothCloud directly about Customer Data, we will not respond on the merits unless required by law and will refer the request to Customer where practicable.

9. Security incidents

SabaothCloud will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Data. The notice will include available information about the nature of the incident, affected data or systems, likely consequences, mitigation taken, and a contact for follow-up. We will provide updates as material information becomes available and reasonably cooperate with Customer's investigation, notifications, and remediation.

Customer remains responsible for deciding whether and how to notify Data Subjects, the NDPC, or another authority, unless applicable law places that obligation on SabaothCloud. Neither party will make a public statement about an incident that identifies the other without consultation, except where legally required.

10. Impact assessments and regulatory assistance

SabaothCloud will reasonably assist Customer with information needed for a data protection impact assessment, consultation with the NDPC, or demonstrating compliance, taking into account the information available to a processor and the nature of the processing. Customer is responsible for deciding whether a DPIA is required and for completing it unless the parties agree otherwise in writing.

11. Cross-border processing

Customer authorizes SabaothCloud to process Personal Data in Germany, which is SabaothCloud's primary data-center and storage location. SabaothCloud will not transfer Personal Data to another country except in accordance with Customer's documented instructions and applicable transfer requirements under the NDP Act, NDPC directives, and other applicable law.

Before a transfer from Nigeria, the parties will cooperate to document the applicable lawful mechanism, such as an adequacy decision, an approved Cross-Border Data Transfer Instrument, appropriate contractual safeguards, or another permitted basis. SabaothCloud will maintain appropriate technical and organizational safeguards for the transfer and will provide relevant processing-location information on reasonable request. This public DPA does not list infrastructure partner identities; they may be disclosed confidentially where necessary for compliance or audit.

12. Audits and compliance information

SabaothCloud will make available information reasonably necessary to demonstrate compliance with this DPA and will cooperate with lawful audits or inspections by Customer or a competent regulator. Customer must give reasonable advance notice, limit requests to the processing covered by this DPA, protect confidential information, and avoid disrupting the Services. Customer will bear its audit costs unless a regulator requires otherwise or the audit identifies a material breach by SabaothCloud.

13. Return and deletion

At the end of the Services, SabaothCloud will, at Customer's choice and where technically available, return or delete Customer Data, unless retention is required by applicable law. Customer is responsible for exporting data before termination. Data in routine backups may remain until securely overwritten in the ordinary backup cycle, but will remain protected and will not be restored except for disaster recovery or legal requirements.

14. Term, precedence, and changes

This DPA begins when Customer accepts it or starts using the Services and continues while SabaothCloud processes Personal Data for Customer. If this DPA conflicts with the Terms of Service or an applicable order, this DPA controls for the conflict concerning Personal Data processing. We may update this DPA to reflect changes in applicable law or the Services, provided that an update will not materially reduce the protections required by applicable law.

15. Liability

The liability, indemnification, and dispute provisions in the Terms of Service or applicable order apply to this DPA unless this DPA expressly states otherwise. Nothing in this DPA limits a party's liability to the extent that applicable law does not permit the limitation.

16. Contact

Privacy and data-protection questions should be sent to privacy@sabaothcloud.com. General enquiries can be sent to hello@sabaothcloud.com.