Data Processing Agreement

1. Who is who

This agreement is between the business that uses NODRO (“you”, the controller) and NODRO (“we”, the processor). It forms part of our Terms of Use and applies to personal data you put into NODRO, under the Nigeria Data Protection Act 2023 (NDPA) and, where it applies, the GDPR.

For data about the people who use NODRO themselves (their sign-in and account details), and for visitors to our website, we are the controller; our Privacy Policy covers that.

2. What we do with the data

• Purpose: to provide NODRO: storing and showing your records, running the technician app, producing service reports and share links, sending reminders, keeping backups.
• How: storing, organising, transmitting, displaying, exporting and deleting it.
• For how long: as long as you use NODRO, then until it is deleted under section 10.

3. Whose data, and what kind

• Your customers and their contacts: names, phone numbers, email addresses, site addresses and locations, notes, what they told you on a job, and signatures.
• Your team: names, usernames, roles, phone numbers, and the work they record.
• Photos and voice notes your technicians take, which can include people by accident.

You must not put sensitive personal data (for example health, religion or political views) into NODRO unless you have told us and we agree.

4. Your instructions

We handle the data only on your documented instructions: these terms and your use of NODRO. If we think an instruction breaks the law, we will tell you. If the law requires us to handle the data in another way, we will tell you first unless the law forbids it.

5. Confidentiality

Everyone at NODRO who can reach your data is bound to keep it confidential. NODRO staff use a separate console that shows counts and account details only: not your customers, equipment, jobs, notes or photos. Any access to the content of your records, for support you ask for, is limited to what is needed and recorded.

6. Security

• Encryption in transit (HTTPS) and for stored data and backups.
• Each business’s data kept apart; people see only what their role allows.
• Passwords stored only in hashed form; sign-in attempts limited; two-factor sign-in, required for NODRO staff.
• Files reachable only by links that expire.
• An audit log of important changes and of data exports.
• Encrypted nightly backups, kept 30 days, and a written plan for handling a breach.

We review these measures as NODRO changes and will not weaken them during the agreement.

7. Sub-processors

You allow us to use the providers on our sub-processors list. We have a written contract with each that gives your data the same protection as this agreement, and we stay responsible for them. We tell you at least 14 days before we add or replace one, so you can object; if we cannot meet your objection, you may close your account and have your data deleted.

8. Helping you with people’s requests

People can ask you to see, correct or delete their data. NODRO gives you the tools: download one customer’s data or all of the business’s data, erase a customer’s personal details while keeping your job records, and correct records. If someone contacts us directly, we pass the request to you within 5 working days and do not answer it ourselves unless the law requires us to.

9. Data breaches

If we learn of a breach of your data, we tell you without undue delay, and aim to within 48 hours, with what we know: what happened, what data and whose, what we are doing, and what you may need to do. You decide whether and how to tell the Nigeria Data Protection Commission and the people affected, within the 72 hours the NDPA allows; we give you the information you need to do so.

10. Returning and deleting data

You can download all your data at any time. When you delete your account, nothing is removed for 30 days, so you can change your mind; after that all your records and files are permanently deleted, except what the law requires us to keep. Backups and earlier file versions age out within 35 days.

11. Data stored outside Nigeria

Our main providers store data in the European Union (Frankfurt, Germany). Some others process data in the United States. We rely on the safeguards the NDPA allows for such transfers, such as contractual commitments that protect the data to a standard at least as high as Nigerian law.

12. Showing we comply

On reasonable request, no more than once a year unless there has been a breach, we give you the information needed to show we meet this agreement and let you, or an auditor you appoint, review it, at your cost and without disrupting other businesses.

13. Changes

We will tell you about material changes to this agreement before they take effect, and ask you to accept them again where the law requires. The date at the top shows the latest version. The Terms of Use set out liability and the law that applies.