Data processing agreement
The terms for processing personal data on a partner's behalf.
1. Parties, roles and the main agreement
This agreement is between the business named in the Order Form (the "Controller") and Remayn Labs Technology Limited, [RC number] (the "Processor", "Remayn"). It forms part of the agreement for Entrustt set out in the Order Form and the terms of service (the "Main Agreement").
For personal data that the Controller sends to Entrustt or that Entrustt creates for it ("Customer Data"), the Controller is the controller and Remayn is its processor. For Remayn's own account, billing, security and product-usage data, Remayn is a controller, as described in the privacy notice.
The Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025 apply. Where the Controller is also subject to other law, it tells Remayn in writing what it needs.
2. What is processed, why and for how long
The subject matter, purpose, kinds of data, people concerned, and duration are set out in Annex 1. Remayn processes Customer Data only to provide Entrustt under the Main Agreement and on the Controller's documented instructions. The Main Agreement, this agreement, the Controller's settings in Entrustt, and written instructions given through the documented channels are its instructions. If Remayn thinks an instruction breaks the law, it tells the Controller and may pause that instruction.
Remayn does not process Customer Data for its own purposes, sell it, or use it to train models for other partners.
3. What the Controller must do
- Have a lawful basis under the Nigeria Data Protection Act 2023 for every record it sends, and give the notices and obtain the consents the law requires, including from the account holder who names a next of kin.
- Decide and record what each customer has agreed may be disclosed, and set that in Entrustt. Entrustt applies those rules and does not decide them.
- Carry out any data protection impact assessment the law requires for its use of Entrustt, with Remayn's help. Customer inactivity monitoring and processing linked to a person's death are likely to need one. The assessment outcome is [recorded by the Controller and shared with Remayn on request].
- Be registered with the NDPC where the law requires, and give Remayn evidence of that on request.
- Answer individuals who exercise their rights.
4. Confidentiality and staff
Remayn allows access to Customer Data only to people who need it to provide Entrustt. They are bound by confidentiality duties and trained in data protection. Human reviewers at Remayn, where the Order Form provides for them, work only inside the review tools and on the Controller's rules.
5. Security
Remayn puts in place and keeps the technical and organisational measures in Annex 2 to protect Customer Data against loss, misuse, unauthorised access, disclosure and change. Remayn may update the measures if the protection does not fall. Remayn does not currently hold SOC 2, ISO/IEC 27001 or PCI DSS certification.
6. Sub-processors
The Controller gives Remayn general written permission to use the sub-processors on the sub-processor list. Remayn gives the Controller at least [30 days] written notice, by email to the contacts in the Order Form and by updating the list, before a new sub-processor processes Customer Data. The Controller may object on reasonable data protection grounds within [14 days]. If the parties cannot resolve the objection in good faith, the Controller may end the affected service and Remayn refunds fees prepaid for the period after it ends.
Remayn puts in place with each sub-processor a written contract with data protection duties no less protective than this one, and stays fully responsible for its sub-processors.
7. Requests from individuals
If an individual asks Remayn about Customer Data, Remayn does not answer on the merits. It passes the request to the Controller within [5 business days]. Remayn helps the Controller respond, with suitable technical and organisational measures, and gives the information the Controller needs within [10 business days] of a request.
8. Personal data breaches
Remayn tells the Controller without undue delay, and aims to do so within [48 hours], after it becomes aware of a personal data breach affecting Customer Data. The notice includes what is known: what happened, the kinds of data and the approximate number of people involved, the likely effects, and what Remayn has done and plans to do. Remayn updates the Controller as facts become clear and helps it investigate.
The Controller decides whether and how to notify the Nigeria Data Protection Commission, which must be done within 72 hours of becoming aware of a breach likely to risk people's rights, and affected people where the risk is high. Remayn keeps a record of breaches.
9. Impact assessments and regulators
Remayn gives reasonable help with impact assessments, prior consultation with the NDPC, and requests from a regulator that has authority over the Controller, such as the Central Bank of Nigeria, the Pension Commission, the Securities and Exchange Commission, the National Insurance Commission or the NDPC.
10. Where data is processed
Customer Data is processed and stored in [hosting region and country, to be confirmed]. Remayn does not move Customer Data to another country unless the Nigeria Data Protection Act 2023 allows it and the Controller has agreed in writing. Remayn records the basis for any transfer and, for the Controller's record, will describe the safeguards on request.
Some Controllers have their own rules about where data must be stored. Tell Remayn in the Order Form. The Controller is responsible for deciding whether those rules apply to Customer Data.
11. Information and audits
Remayn makes available the information reasonably needed to show that it meets this agreement, including a response to a security questionnaire once a year.
If that is not enough, or where a regulator with authority over the Controller requires it, the Controller may audit Remayn on [30 days] notice, in business hours, no more than once in any 12 months (more often after a confirmed breach). The audit is subject to confidentiality, is limited to the Controller's data and the systems used for it, and gives no access to other partners' data. The Controller pays its own costs, and Remayn's reasonable costs beyond [2 days].
12. Return and deletion
When the Main Agreement ends, Remayn, at the Controller's choice, returns Customer Data in a structured, commonly used format within 30 days, and deletes it from live systems within 90 days. Backups are overwritten in the normal cycle, within [90 days] after that. Remayn confirms deletion in writing on request. Remayn may keep data longer only where the law requires and then only for that purpose.
13. Liability, indemnity, insurance and events outside control
Liability under this agreement is subject to the limits and exclusions in the Main Agreement, including the separate cap for data protection breaches. Nothing limits a person's own right to claim damages from a controller or processor under the Nigeria Data Protection Act 2023, or a fine a regulator imposes.
The indemnities in the Main Agreement apply. Remayn keeps [cyber liability insurance of at least a stated amount, if held]. The provisions on events outside a party's control in the Main Agreement apply, and do not excuse a failure to keep Customer Data secure.
14. Order of documents, term and disputes
If this agreement conflicts with the Main Agreement on the processing of personal data, this agreement wins. It lasts as long as Remayn holds Customer Data. Nigerian law governs it, and disputes are resolved as the Main Agreement provides.
Annex 1. Details of processing
| Subject matter | Providing Entrustt: inactivity monitoring, a next-of-kin register, human-reviewed disclosure of information, and an audit log |
| Nature | Storing, matching, monitoring, reviewing, logging disclosure steps, and sending signed webhooks |
| Purpose | To check on customers who have gone quiet, to reach the next of kin they named, and to keep a record, as the Controller instructs |
| People concerned | The Controller's account holders, the next of kin they name, and the Controller's authorised users and reviewers |
| Kinds of data | Account reference, activity dates and inactivity flags, next-of-kin name, relationship, email, phone and address, Controller user credentials, audit log entries, and disclosure request records. No sensitive data is expected. Information linked to death or loss of capacity is treated as high sensitivity. |
| Lawful basis | Set by the Controller. See section 3. |
| Frequency | Continuous |
| Retention | The life of the Main Agreement and then 90 days, unless the Controller sets a shorter period. Audit log entries are kept for [period to be confirmed]. |
| Location | [Hosting region and country] |
| Remayn data protection contact | [Data protection officer, name and email] |
| Remayn registration with the NDPC | [Registration status and number, once registered] |
Annex 2. Security measures
Each measure below will be confirmed by Remayn engineering before this agreement is signed.
- Encryption of data in transit (TLS 1.2 or later) and at rest [confirm].
- Separation of each partner's data, with tests that one partner cannot reach another's [confirm method].
- Access by role and on a least-privilege basis, with multi-factor sign-in for staff [confirm].
- API keys that are scoped and stored hashed. Signed webhooks [confirm method].
- An audit log of access and disclosure actions that cannot be edited after the fact [confirm].
- Logging and monitoring, with alerts [confirm].
- Patching of software and dependencies on a regular cycle [confirm cadence].
- Code review and automated checks before release [confirm].
- Backups, with restore tests at least once a year [confirm].
- A written incident response plan, practised at least once a year [confirm].
- Confidentiality agreements and security training for staff [confirm].
- The Sandbox kept apart from Production, with made-up data only in the Sandbox [confirm].
- Limits on how much data is collected, and controls for retention and deletion [confirm].
- Independent penetration test: [state the date it was done, or "planned for date"].
- Our hosting provider's own certifications are described by that provider. They are not Remayn's certifications.
Annex 3. Sub-processors
The current list is published on the sub-processor page, with the service each provides, the kinds of data, where it is processed, and the date it was added.