Data Processing Agreement

1. Definitions

“Applicable Data Protection Law” means the Nigeria Data Protection Act 2023 and any other data protection law applicable to the processing, including the GDPR and UK GDPR where relevant. “Customer Personal Data” means personal data that UseTimio processes on the Customer’s behalf under the Terms. “Controller”, “processor”, “data subject”, “processing” and “personal data breach” carry the meaning given in Applicable Data Protection Law.

2. Roles of the parties

The Customer is the controller of Customer Personal Data and determines the purposes and means of its processing. UseTimio is the processor and processes it only on the Customer’s documented instructions. UseTimio is an independent controller for its own account, billing, security and marketing data, which is governed by the Privacy Policy rather than by this DPA.

3. Processing instructions

The Customer’s use of the platform — the settings it chooses, the members it enrols, the features it enables and the support requests it raises — constitutes its documented instructions. UseTimio will not process Customer Personal Data for any other purpose, and specifically will not sell it, use it for advertising, or use it to train artificial intelligence models. Where we believe an instruction breaches Applicable Data Protection Law, we will tell the Customer and may suspend that processing until it is resolved.

4. Customer obligations

The Customer warrants that it will:

• Have a lawful basis for every category of data it enters into the platform.
• Give its data subjects the privacy notice Applicable Data Protection Law requires of it.
• Obtain explicit consent before enrolling anyone in biometric check-in, and offer an alternative method.
• Disclose location-verified check-in to affected staff before enabling it.
• Assign roles so that access to personal data inside its workspace is limited to those who need it.
• Keep exported data secure once it leaves the platform.

5. Confidentiality and personnel

UseTimio limits access to Customer Personal Data to personnel who need it to deliver or support the service, binds them to confidentiality, and removes access when it is no longer required.

6. Security measures

UseTimio implements appropriate technical and organisational measures, described in full under Security Practices, including encryption in transit, hashed credentials, role-based access control, tenant isolation, rate limiting, and daily backups. Those measures may be updated over time provided the level of protection is not reduced.

7. Sub-processors

The Customer gives general authorisation for UseTimio to engage the sub-processors listed on the sub-processors page. Each is bound by data protection obligations no less protective than this DPA, and UseTimio remains liable to the Customer for their performance. We give at least 14 days’ notice before adding or replacing one, and the Customer may object on reasonable data protection grounds as described on that page.

8. Assisting with data subject rights

The platform lets the Customer view, correct, export and delete member records directly, which satisfies most requests without our involvement. Where a request cannot be met through the product, UseTimio will provide reasonable assistance. If a data subject contacts us directly, we will not respond substantively to their request; we will refer them to the Customer and notify the Customer promptly.

9. Personal data breaches

UseTimio will notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the nature of the breach, the categories and approximate volume of data involved, the likely consequences, and the measures taken or proposed. Notice goes by email to the organization owner’s address on file, so the Customer must keep it current. UseTimio will assist the Customer in meeting its own notification duties to regulators and data subjects.

10. Return and deletion

On termination of the account, UseTimio will retain Customer Personal Data for 30 days so the Customer can export it or reactivate, then delete it. The Customer may ask for immediate deletion in writing from the owner’s address. Residual copies in encrypted backups are deleted as those backups roll off within approximately 14 days. UseTimio may retain billing records where law requires it, and anonymised aggregate statistics that cannot identify any individual.

11. Audits and information

UseTimio will make available the information reasonably necessary to demonstrate compliance with this DPA, including completing a security questionnaire. Where the Customer’s regulator requires an on-site audit, the parties will agree scope, timing and cost in advance; audits are limited to once per year unless a regulator or a breach requires otherwise, and must not compromise the confidentiality of other customers.

12. International transfers

Customer Personal Data may be processed outside Nigeria by the sub-processors listed on that page. Those transfers rely on the recognised safeguards incorporated in each provider’s data processing terms, typically Standard Contractual Clauses. Further detail is on the Compliance page.

13. Annex — details of processing

14. General

If this DPA conflicts with the Terms of Service in relation to the processing of Customer Personal Data, this DPA prevails. It is governed by the laws of the Federal Republic of Nigeria, without prejudice to mandatory protections available to data subjects under their local law. Liability under this DPA is subject to the limitations in the Terms of Service.