Data processing agreement

This data processing agreement ("DPA") forms part of the Terms of service between Profynix Technology Limited, a private company limited by shares registered in Nigeria (RC 8770418) ("Profynix", the "Processor"), and the business that uses Profynix (the "Customer", the "Controller"). It applies whenever Profynix processes personal data on the Customer's behalf. By accepting the Terms of service, the Customer accepts this DPA. If the Customer needs a signed copy, write to hello@profynix.com.

1. Definitions

• Data Protection Law means the laws that apply to the processing, including the Nigeria Data Protection Act 2023 and the regulations and directives made under it, including the General Application and Implementation Directive 2025 (together, NDPA), and, where they apply, the UK GDPR and Data Protection Act 2018, and the EU General Data Protection Regulation (GDPR).
• Customer Personal Data means personal data in Customer Data that Profynix processes for the Customer under the Terms of service.
• Subprocessor means a third party Profynix engages to process Customer Personal Data.
• Personal Data Breach, controller, processor, data subject and processing have the meanings given in Data Protection Law.

2. Roles

The Customer is the controller of Customer Personal Data and Profynix is its processor. All Customer Data, including Customer Personal Data, belongs to the Customer. Profynix uses it only to provide the Service to the Customer and acquires no ownership of it. The Customer is responsible for having a lawful basis for the processing, for giving data subjects the information the law requires, and for the accuracy of the data and the instructions it gives. Profynix is a separate controller for its own account, billing and security data, as described in its Privacy policy.

3. Profynix's obligations

Profynix will:

1. process Customer Personal Data only on the Customer's documented instructions, which are the Terms of service, this DPA and the Customer's use and configuration of the Service (including instructions authorised users give the Profynix AI), unless the law requires otherwise; in that case Profynix will tell the Customer first unless the law forbids it;
2. tell the Customer if it believes an instruction breaks Data Protection Law;
3. make sure people authorised to process Customer Personal Data are bound by confidentiality;
4. apply the security measures in Annex 2;
5. use Subprocessors only as set out in section 5;
6. help the Customer, taking into account the nature of the processing, to answer data subject requests, and with security, breach notification, data protection impact assessments and consultations with regulators;
7. at the end of the Service, return or delete Customer Personal Data as set out in section 8;
8. not use Customer Personal Data to train AI models, and use only AI providers that do not train their models on it;
9. make available the information reasonably needed to show compliance with this DPA, and allow audits as set out in section 9.

4. Data subject requests

If Profynix receives a request from a data subject about Customer Personal Data, it will pass it to the Customer without undue delay and won't answer it itself, except to tell the person to contact the Customer. The app lets the Customer find, correct, export and delete most records itself; where it doesn't, Profynix will help on request.

5. Subprocessors

• The Customer gives general authorisation for Profynix to use Subprocessors. The current list is in Annex 3.
• Profynix will put data protection terms in place with each Subprocessor that protect Customer Personal Data to the standard of this DPA, and remains responsible for its Subprocessors.
• Profynix will give at least 30 days' notice of a new Subprocessor by updating Annex 3 and emailing company owners. The Customer may object on reasonable data protection grounds within that time. If we can't resolve it, the Customer may end the affected part of the Service and receive a refund of prepaid fees for the unused period.
• Services the Customer chooses to connect (such as WhatsApp, Meta, X, LinkedIn, TikTok, a bank-data provider or a payment provider for the Customer's own invoices) aren't Subprocessors of Profynix. The Customer engages them directly, and data flows to them on the Customer's instructions.

6. International transfers

Customer Personal Data is hosted in the United Kingdom. Encrypted backups are stored in the United States, and data may be processed in the other countries listed in Annex 3. Where Data Protection Law requires safeguards for a transfer, Profynix relies on an adequacy decision or an equivalent recognised framework, the European Commission's standard contractual clauses, the UK International Data Transfer Addendum, the Subprocessor's own data processing terms, or the other bases permitted under sections 41 to 43 of the NDPA.

7. Personal Data Breaches

Profynix will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe, as far as known, what happened, the data and people affected, the likely consequences and the measures taken or proposed. Profynix will give the Customer the information it reasonably needs to meet its own obligation to notify regulators (within 72 hours under the NDPA and GDPR) and data subjects. Notifying the Customer is not an admission of fault.

8. Return and deletion

The Customer can export or download its data at any time: many records as CSV files straight from the app, and a full copy of its company's data on request from account settings ("Request my data") or at hello@profynix.com, which Profynix sends within 30 days. This includes after the Customer cancels (the company stays read-only) and, after the company is closed, until its data is deleted. When the Customer asks for its company to be deleted, or the Terms of service end, the company becomes read-only for 30 days so the Customer can export what it needs or change its mind. After that, Profynix deletes Customer Personal Data within a further 60 days (90 days in total), and deleted data rolls out of backups within about 90 days, unless the law requires Profynix to keep some of it. Anything kept for that reason stays protected and is used only for that purpose.

9. Audits

Profynix will answer the Customer's reasonable written questions about its data protection and security practices, no more than once a year unless there's been a Personal Data Breach or a regulator requires it. If that isn't enough to show compliance, the Customer may, at its own cost and with at least 30 days' notice, have an independent auditor bound by confidentiality carry out an audit during business hours, in a way that doesn't disrupt the Service or expose other customers' data.

10. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of service, except where Data Protection Law doesn't allow it. If this DPA conflicts with the Terms of service on data protection, this DPA prevails. If standard contractual clauses apply and conflict with this DPA, the clauses prevail.

Annex 1: Details of the processing

Annex 2: Security measures

• Tenant isolation: every company's records are separated in the database with row-level security, so one company can't read another's data.
• Access control: roles and relationship-based permissions decide who can see and do what; the Profynix AI acts with the permissions of the person using it, never more.
• Human approval: money movements, bulk messages, deletions, access changes and system changes produce a preview and run only after an authorised person approves them.
• Audit trail: actions, including approvals, are recorded with who did them and when.
• Encryption in transit: all public connections use HTTPS (TLS) with HSTS; server administration and backup transfers run over an encrypted private network.
• Encryption at rest: backups are encrypted with AES-256 before they leave the production server; payment-provider and integration secrets are encrypted in the database; system secrets are kept in a dedicated secrets manager. We don't currently make a separate promise about disk-level encryption of the production server.
• Credentials: user passwords are stored only as salted hashes; one-time codes expire quickly and are purged.
• Staff access: the internal Control Center needs a passkey and a second factor; high-risk staff actions (such as deleting a company) need a second approver; public SSH access to the production server is closed.
• Server hardening: brute-force protection, automatic blocking of unexpected container activity, and security headers on every site.
• AI data minimisation: email addresses and phone numbers are stripped from business descriptions during setup before they reach a model; only the data needed for a task is sent. Customer Personal Data is not used to train AI models, and only AI providers that do not train on it are used.
• Payments: card data is handled by a licensed payment provider and never touches Profynix servers.
• Backups and recovery: nightly encrypted backups to a separate server in another region (aim: no more than 24 hours of data lost), with restores tested.

Annex 3: Subprocessors