LEGAL

Data Processing Addendum

Last updated: January 2026

1. Purpose

This Data Processing Addendum ("DPA") forms part of the agreement between ZidoSoft Ltd. ("Processor") and the client ("Controller") and governs the processing of personal data by ZidoSoft on behalf of the Controller.

2. Definitions

"Personal Data," "Data Subject," "Processing," "Controller," and "Processor" have the meanings given in the Nigeria Data Protection Regulation (NDPR) or equivalent applicable data protection law.

3. Scope and Roles

The Controller determines the purposes and means of processing personal data. The Processor processes personal data only on documented instructions from the Controller, as set out in the engagement agreement and this DPA.

4. Processor Obligations

ZidoSoft shall:

  • Process personal data only on documented instructions from the Controller
  • Ensure persons authorized to process personal data are bound by confidentiality obligations
  • Implement appropriate technical and organizational security measures
  • Assist the Controller in responding to data subject requests
  • Assist the Controller in ensuring compliance with security, breach notification, and impact assessment obligations
  • Delete or return personal data at the end of the provision of services
  • Make available all information necessary to demonstrate compliance and allow for audits

5. Subprocessors

The Controller authorizes ZidoSoft to engage subprocessors for the provision of services. A current list of subprocessors is maintained on the Security page. ZidoSoft shall:

  • Impose data protection obligations on subprocessors equivalent to those in this DPA
  • Provide advance notice of changes to subprocessors
  • Remain liable to the Controller for the performance of subprocessor obligations

6. Security Measures

ZidoSoft implements and maintains the following security measures:

  • Encryption of personal data in transit (TLS 1.2+) and at rest (AES-256)
  • Access controls including multi-factor authentication for administrative access
  • Network isolation and segmentation
  • Continuous monitoring and audit logging
  • Regular security testing including penetration testing
  • Documented incident response procedures
  • Regular backup and recovery testing

7. Data Breach Notification

In the event of a personal data breach, ZidoSoft shall notify the Controller without undue delay and in any event within 48 hours of becoming aware of the breach. Notification shall include:

  • Nature of the breach
  • Categories and approximate number of data subjects affected
  • Categories and approximate number of records affected
  • Likely consequences of the breach
  • Measures taken or proposed to address the breach

8. Data Subject Rights

ZidoSoft shall assist the Controller in responding to requests from data subjects exercising their rights under applicable data protection law. Where ZidoSoft receives a request directly, it shall forward it to the Controller without undue delay.

9. International Transfers

ZidoSoft shall not transfer personal data outside Nigeria unless:

  • The transfer is to a country with an adequate level of data protection
  • Appropriate safeguards are in place (such as standard contractual clauses)
  • The Controller has provided explicit consent

10. Data Retention and Deletion

ZidoSoft shall retain personal data only for the duration of the engagement and as required by law. Upon termination, ZidoSoft shall, at the Controller's choice, delete or return all personal data and delete existing copies, unless legal retention obligations apply.

11. Audit Rights

The Controller has the right to audit ZidoSoft's compliance with this DPA, subject to reasonable advance notice and confidentiality obligations. ZidoSoft shall make available relevant documentation and personnel to support the audit.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the main engagement agreement between the parties.

13. Governing Law

This DPA is governed by the laws of the Federal Republic of Nigeria.

14. Contact

For DPA execution or questions, contact privacy@zidosoft.dev.