Data Processing Agreement (Template)

Between Washermann Africa Ltd and the counterparty ("Processor" or "Controller" as applicable). Version date: September 1, 2026

1. Definitions

"Personal Data", "Processing", "Data Subject", "Controller", and "Processor" have the meanings in the Nigeria Data Protection Act 2023 (NDPA).

2. Roles & scope

  • The Controller determines the purposes and means of processing; the Processor processes Personal Data only on the Controller's documented instructions.
  • Subject matter: provision of the Washermann laundry marketplace and related services.
  • Data subjects: customers, employees (for B2B), vendors, reps.
  • Data types: identity, contact, address & location, order data, and (for payouts/KYC) financial and identity-document data.
  • Duration: for the term of the underlying agreement.

3. Processor obligations

The Processor shall:

  1. process only on documented instructions and for the stated purposes;
  2. ensure persons authorised to process are bound by confidentiality;
  3. implement appropriate technical and organisational security measures (encryption in transit, access control, hashing of secrets, logging);
  4. not engage sub-processors without general/specific authorisation, and flow down equivalent obligations;
  5. assist the Controller in responding to data-subject requests (access, correction, deletion, objection, portability);
  6. assist with security, breach notification, and data-protection impact assessments;
  7. notify the Controller without undue delay on becoming aware of a personal-data breach;
  8. at the Controller's choice, delete or return Personal Data at the end of the services, save where retention is legally required.

4. International transfers

Any transfer of Personal Data outside Nigeria will use a valid NDPA transfer mechanism (adequacy, appropriate safeguards, or consent).

5. Sub-processors (current list for Washermann as processor)

Paystack (payments), Cloudinary (media/document storage), Resend (email), Termii (SMS), Meta/WhatsApp (messaging), Google Firebase (push), and cloud hosting. The list may change with notice.

6. Audits

The Processor makes available information necessary to demonstrate compliance and allows reasonable audits, subject to confidentiality and notice.

7. Liability & term

Liability is as set in the underlying agreement. This DPA runs for the duration of processing and survives as to confidentiality and deletion obligations.

8. Governing law

These terms are governed by the laws of the Federal Republic of Nigeria.