Data processing terms

These data processing terms (the “Terms”) form part of the agreement between Estreat Technologies Limited (“Estreat”) and the customer named in the Order Form (the “Customer”) for the provision of the Estreat platform (the “Service”). They apply whenever Estreat processes personal data on the Customer’s behalf. Where a negotiated data processing addendum has been signed by both parties, that document prevails to the extent of any inconsistency.

Terms defined in the terms of service have the same meaning here. “NDPA” means the Nigeria Data Protection Act 2023, “GAID” means the General Application and Implementation Directive 2025, and the “Commission” means the Nigeria Data Protection Commission. “Customer Personal Data” means personal data within Customer Data.

Estreat is not a law firm and does not provide legal advice. These Terms describe contractual obligations, not advice on the Customer’s own compliance position.

1. Roles of the parties

In relation to Customer Personal Data the Customer is the data controller and Estreat is the data processor. The Customer determines the purposes and means of the processing and is responsible for the lawfulness of the instructions it gives, including for having a lawful basis under section 25 of the NDPA and for providing any notice or obtaining any consent that the law requires.

Estreat is a data controller in its own right only in respect of account administration, security and billing data described in its privacy notice. Nothing in these Terms makes Estreat a joint controller with the Customer, and Estreat does not determine the purposes for which Customer Personal Data is processed.

Each party will comply with the obligations that apply to it in its role under the NDPA and GAID. Each party is responsible for its own registration with the Commission and for its own filings, where those obligations apply to it.

2. Annex: details of processing

The following describes the processing carried out by Estreat as processor, for the purposes of the record-keeping requirements that apply to both parties.

3. Processing on documented instructions

Estreat will process Customer Personal Data only on the Customer’s documented instructions, which comprise these Terms, the terms of service, the Order Form, the configuration the Customer applies in the Service, and any further written instruction the Customer gives. Estreat will not process Customer Personal Data for its own purposes, will not sell it, will not disclose it except as these Terms permit, and will not use it to train artificial intelligence or machine learning models.

Where Estreat is required by law to process Customer Personal Data other than on the Customer’s instructions, it will inform the Customer of that requirement before processing unless the law prohibits it from doing so. Where Estreat considers that an instruction is likely to infringe the NDPA or other applicable law, it will inform the Customer promptly and may pause the affected processing while the matter is resolved.

4. Confidentiality of personnel

Estreat will ensure that any person authorised to process Customer Personal Data is subject to a written duty of confidentiality that survives the end of their engagement, is informed of the confidential nature of the data, has received data protection and security training, and processes the data only as necessary to perform their role.

Access to Customer Personal Data is granted on a least-privilege basis to named individuals, requires multi-factor authentication for administrative access, is logged, and is reviewed periodically. Estreat does not grant standing access to customer content for support purposes.

5. Security measures

Estreat will implement and maintain technical and organisational measures appropriate to the risk, taking account of the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing. Those measures include encryption of data in transit using TLS 1.2 or above, encryption at rest, tenant isolation, least-privilege access control with multi-factor authentication on administrative access, logging and monitoring of administrative and record-level actions, encrypted backups with tested restore, peer-reviewed change management, and recurring vulnerability scanning and remediation.

The measures in force at the date of these Terms are described in more detail on the trust and security page, which is incorporated into these Terms by reference. Estreat may update those measures, provided that no update reduces the overall level of protection during the subscription term.

6. Subprocessors

The Customer gives general authorisation for Estreat to engage subprocessors to assist in providing the Service. Estreat will:

• assess each subprocessor before engagement, including its security measures and its position on cross-border transfer;
• impose on each subprocessor, by written contract, data protection obligations no less protective than those in these Terms;
• remain fully liable to the Customer for the performance of each subprocessor’s obligations;
• maintain a current list of subprocessors, naming each subprocessor, the processing it performs and the region in which it operates, and make that list available to the Customer on request and on change.

Estreat will give the Customer at least thirty days’ prior written notice before a new subprocessor begins processing Customer Personal Data. The Customer may object on reasonable data protection grounds within that period. Where the Customer objects, the parties will discuss the objection in good faith, and Estreat will either refrain from engaging the subprocessor for that Customer, offer a reasonable alternative, or, if no alternative is available, permit the Customer to terminate the affected subscription with a pro-rata refund of prepaid fees for the unexpired term.

7. Assistance with data subject requests

The Service is designed to allow the Customer to locate, extract, correct, restrict and delete Customer Personal Data without assistance from Estreat, so that the Customer can answer requests under Part V of the NDPA within the statutory period.

Where a data subject contacts Estreat directly in relation to Customer Personal Data, Estreat will not respond substantively to the request. It will inform the data subject that the request should be directed to the Customer, and will notify the Customer without undue delay. Where the Customer requires further help to respond, Estreat will provide reasonable assistance, and may charge for assistance that goes materially beyond the functionality of the Service, at rates agreed in advance.

8. Breach notification

Estreat will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification will be sent to the Customer’s administrative and security contacts and will include, to the extent known at the time, the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, the measures taken or proposed to address it, and a point of contact at Estreat. Where full information is not available at first, Estreat will provide it in stages as the investigation proceeds.

Estreat will cooperate with the Customer and provide reasonable assistance so that the Customer can meet its duty under section 40 of the NDPA to notify the Commission within 72 hours of becoming aware of the breach, and its duty to notify affected data subjects where the Act requires it. That assistance includes providing relevant log extracts, the incident timeline, and a written account of the facts.

Notification under this clause is not an admission of fault or liability by Estreat. Estreat will not notify the Commission or any data subject on the Customer’s behalf in respect of a breach of Customer Personal Data, unless the Customer instructs it in writing to do so and the parties agree the terms of that instruction.

9. Assistance with impact assessments

Estreat will provide the Customer with reasonable assistance in carrying out an impact assessment under section 28 of the NDPA in relation to processing carried out through the Service, and in any prior consultation with the Commission that follows from it. That assistance takes the form of documentation about the Service, its architecture, its data flows, its retention behaviour and its security measures, which the Customer may rely on in its own assessment. The assessment itself, and any decision arising from it, remains the Customer’s responsibility as controller.

10. Cross-border transfers

Customer Personal Data is hosted in the region recorded in the Order Form. The default region is Nigeria, and an EU region is available where the Customer requires it. Estreat will not move Customer Personal Data to another region without the Customer’s instruction or agreement, except to the limited extent necessary for a disclosed subprocessor to perform its function.

Where Customer Personal Data is transferred outside Nigeria, Estreat will ensure the transfer is made in accordance with Part VIII of the NDPA, relying on a determination of adequacy by the Commission, on a legally binding instrument or contractual terms providing an adequate level of protection, or on another basis permitted by the Act. Estreat will record the destination and mechanism relied on for each transfer and will make that record available to the Customer on request.

11. Audit and information rights

Estreat will make available to the Customer the information reasonably necessary to demonstrate compliance with these Terms. That information comprises the security overview, the architecture and data flow summary, completed vendor security questionnaires, the subprocessor list, and, once available, the summary of any independent penetration test or external audit report.

Where that information is not sufficient for the Customer to meet an obligation imposed on it by the NDPA, by GAID or by its own regulator, the Customer may audit Estreat’s processing of Customer Personal Data. An audit will be conducted no more than once in any twelve-month period unless a breach has occurred or a regulator requires otherwise, on at least thirty days’ written notice, during business hours, subject to confidentiality obligations, and in a manner that does not disrupt the Service or compromise the security or confidentiality of another customer’s data. The Customer bears the cost of an audit it initiates, other than Estreat’s own reasonable internal costs where the audit reveals a material breach of these Terms by Estreat.

Estreat does not currently hold ISO/IEC 27001 certification or a SOC 2 report, and makes no representation that it does. The current position and roadmap are stated on the trust and security page.

12. Deletion or return on termination

The Customer may export Customer Personal Data in a structured, commonly used and machine-readable format at any time during the subscription term.

On termination or expiry of the subscription, Estreat will make Customer Personal Data available for export for thirty days, and will then delete it from production systems within thirty days, unless the Customer instructs earlier deletion or return, or unless retention is required by law. Backup copies are deleted in accordance with the backup retention cycle and in any event within ninety days of termination. On written request Estreat will certify the deletion.

Where Estreat is required by law to retain Customer Personal Data beyond those periods, it will inform the Customer, retain only what the law requires, and continue to protect it under these Terms for as long as it is retained.

13. Liability and precedence

The limitations and exclusions of liability in the terms of service apply to claims under these Terms, save where the law does not permit that. In the event of a conflict, these Terms prevail over the terms of service in respect of the processing of Customer Personal Data, and a signed negotiated addendum prevails over both.

14. Governing law and contact

These Terms are governed by the laws of the Federal Republic of Nigeria and are subject to the exclusive jurisdiction of the courts of Lagos State, Nigeria. Notices under these Terms are given in writing to privacy@estreat.ng, and security matters to security@estreat.ng.