Data Processing Agreement

1. Definitions

1.1 In this DPA, the terms “personal data”, “processing”, “data controller”, “data processor”, “data subject”, and “personal data breach” have the meanings given to them in the Nigeria Data Protection Act 2023 (“NDPA”) and its subsidiary instruments, including the General Application and Implementation Directive 2025 (“GAID”).

1.2 “Client Personal Data” means personal data processed by the Processor on behalf of the Controller in connection with the Service, as more particularly described in Annex 1.

1.3 “Sub-processor” means any third party engaged by the Processor to process Client Personal Data in providing the Service, as listed in Annex 3.

2. Roles of the Parties

2.1 The Parties agree that, in relation to Client Personal Data, the Controller is the data controller and the Processor is the data processor, for the purposes of the NDPA. The Processor shall process Client Personal Data only on the documented instructions of the Controller, including as set out in this DPA and the Agreement, unless required to do otherwise by applicable law, in which case the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such notice.

3. Scope and Duration of Processing

3.1 The subject matter, duration, nature and purpose of processing, and the categories of data subjects and types of Client Personal Data, are set out in Annex 1. The Processor shall process Client Personal Data only for the duration of the Agreement, save as otherwise required to comply with clause 10 (Deletion and Return of Data) or applicable law.

4. Processor Obligations

4.1 The Processor shall: (a) process Client Personal Data only on the Controller's documented instructions, including regarding cross-border transfers, unless required otherwise by law; (b) ensure that persons authorised to process Client Personal Data are subject to a binding duty of confidentiality; (c) implement appropriate technical and organisational security measures as set out in Annex 2, taking into account the state of the art, costs of implementation, and the risks presented by the processing; (d) assist the Controller, at the Controller's reasonable expense, in responding to data subject requests exercising their rights under the NDPA; (e) assist the Controller in ensuring compliance with its obligations relating to data security, breach notification, and data protection impact assessments, taking into account the nature of processing and information available to the Processor; (f) at the Controller's election, delete or return all Client Personal Data at the end of the provision of the Service, in accordance with clause 10; and (g) make available to the Controller information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as set out in clause 8.

5. Sub-processors

5.1 The Controller authorises the Processor to engage the sub-processors listed in Annex 3 as of the date of this DPA. The Processor shall give the Controller at least fourteen (14) days' prior notice of any intended change to that list (whether addition or replacement), during which the Controller may object on reasonable data protection grounds. If the Parties cannot resolve the objection, the Controller may terminate the affected part of the Service without penalty.

5.2 The Processor shall impose data protection obligations on each sub-processor that are substantially no less protective than those set out in this DPA, and shall remain liable to the Controller for the performance of each sub-processor's obligations.

6. International Transfers

6.1 Where the processing of Client Personal Data involves a transfer outside Nigeria (including to a sub-processor listed in Annex 3), the Processor shall ensure the transfer is carried out in accordance with the NDPA, on the basis of: (a) an adequacy determination by the NDPC in respect of the destination country; (b) appropriate safeguards, including standard contractual clauses or other mechanisms recognised by the NDPC; or (c) another lawful basis for transfer permitted under the NDPA and the GAID. Details of current cross-border transfers are set out in Annex 3.

7. Personal Data Breach Notification

7.1 The Processor shall notify the Controller without undue delay, and in any event within twenty-four (24) hours, after becoming aware of a personal data breach affecting Client Personal Data, to enable the Controller to meet its own obligation to notify the NDPC within seventy-two (72) hours under the NDPA.

7.2 The Processor's notification shall, to the extent known at the time, describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects, and shall be supplemented as further information becomes available.

8. Audit Rights

8.1 On reasonable prior written notice (of at least thirty (30) days), and not more than once per year (except following a personal data breach or where required by the NDPC), the Controller or its appointed auditor may audit the Processor's compliance with this DPA, subject to reasonable confidentiality restrictions and to not unreasonably disrupting the Processor's operations. Alternatively, the Processor may satisfy this obligation by providing a recent third-party audit report or security certification covering the relevant controls.

9. Liability and Indemnification

9.1 Each Party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement, save that nothing in this DPA limits either Party's liability for a breach of the NDPA that arises from that Party's own failure to comply with its obligations as controller or processor.

10. Deletion and Return of Data

10.1 On termination or expiry of the Agreement, the Processor shall, at the Controller's election, delete or return all Client Personal Data (including copies held by sub-processors) within thirty (30) days, save to the extent applicable law requires the Processor to retain some or all of the Client Personal Data, in which case the Processor shall isolate and protect that data from further processing except as required by that law.

11. General

11.1 This DPA forms part of, and is governed by the same governing law and dispute resolution provisions as, the Agreement between the Parties.

11.2 In the event of any conflict between this DPA and the Agreement in relation to the processing of personal data, this DPA shall prevail.

Annex 1 — Details of Processing

• Subject matter: Provision of the TerraSell field sales automation and CRM platform to the Controller.
• Duration: For the term of the Agreement, and until deletion or return of Client Personal Data under clause 10.
• Nature and purpose of processing: Hosting, storage, and processing of Client Personal Data to enable field visit management, route optimisation, geofenced attendance, distributor and stock tracking, pipeline management, analytics, and AI-assisted insights within the Service.
• Categories of data subjects: The Controller's employees and field representatives (Authorised Users); healthcare professionals, distributors, retailers, and other business contacts entered into the Service by the Controller.
• Categories of personal data: Names, job titles, phone numbers, email addresses, employer/affiliation, professional details, device and location (GPS) data of field representatives while the app is in active use, and records of visits, orders, and interactions logged in the Service.
• Special category / sensitive data: The Service is not designed to process patient health records or other sensitive personal data as defined under the NDPA. If the Controller enters any such data into the Service, the Controller is solely responsible for ensuring it has a lawful basis to do so and for notifying the Processor in writing, so that appropriate additional safeguards can be discussed.

Annex 2 — Technical and Organisational Security Measures

• Encryption of personal data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
• Role-based access control and multi-factor authentication for administrative access to production systems.
• Logical separation of each Client's data within the multi-tenant environment.
• Regular security testing, including at least one independent penetration test per year.
• Logging and monitoring of access to production systems, with alerting for anomalous activity.
• A documented incident response plan, including the breach notification process described in clause 7.
• Regular data backups, with tested restoration procedures.
• Staff training on data protection obligations, and confidentiality undertakings for all personnel with access to Client Personal Data.

Annex 3 — Authorised Sub-processors

• Cloud hosting and infrastructure provider (e.g., AWS or Azure) — [Insert Vendor Name, Processing Location] — hosts the Service and all Client Personal Data.
• Mapping and geolocation provider (e.g., Google Maps Platform or Mapbox) — [Insert Vendor Name] — supports route optimisation and location-based features.
• Messaging provider (e.g., WhatsApp Business API / Twilio) — [Insert Vendor Name] — supports in-app and SMS/WhatsApp notifications.
• Payment processor (e.g., Paystack or Flutterwave) — [Insert Vendor Name] — processes subscription payments.
• AI / language-model service provider — [Insert Vendor Name] — supports natural-language query and insight features within the Service.
• TerraSell will give Clients at least fourteen (14) days' notice of any change to this list, as set out in clause 5.

Signatures

For and on behalf of the Controller (Client) — Authorised Signatory. Name: ____________________ Date: ____________________ Witness: ____________________

For and on behalf of TerraSell Limited (Processor) — Authorised Signatory. Name: ____________________ Date: ____________________ Witness: ____________________