Data Processing Agreement

1. Subject-matter & duration

Processing occurs for the duration of the customer’s subscription and any post-termination grace period specified in the Terms.

2. Nature & purpose

PrivacyScan processes personal data solely to provide the scanning, reporting, and collaboration features requested by the Controller, and to secure and maintain the service.

3. Categories of data subjects & data

Data subjects: the Controller’s account users and workspace members. Personal data: name, email, authentication data, workspace activity, and any personal data incidentally contained in scan targets that the Controller submits.

4. Controller obligations

The Controller warrants that it has a lawful basis for submitting scan targets and for inviting members, and that it has issued required notices to data subjects.

5. Processor obligations

• Process personal data only on documented instructions from the Controller.
• Ensure personnel with access are bound by confidentiality.
• Implement appropriate technical and organizational measures (see the Trust Center).
• Assist the Controller with data-subject requests, DPIAs, and breach notifications.
• On termination, delete or return personal data as instructed, subject to legal retention.

6. Sub-processors

PrivacyScan engages the sub-processors listed at /legal/subprocessors and imposes equivalent obligations on each.

7. International transfers

Where transfers occur outside the EEA/UK/Nigeria, PrivacyScan relies on Standard Contractual Clauses or an equivalent transfer mechanism.

8. Security incidents

PrivacyScan will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data.

9. Contact

Data protection queries: privacy@privacytoolbox.ng. Security: security@privacytoolbox.ng.