Terms of service

1. Who we are and what these terms cover

Entrustt is a product of Remayn Labs Technology Limited, a company registered in Nigeria ([RC number]) with its registered office at [registered address] ("Remayn", "we", "us").

These terms govern the access of a bank, fintech, insurer, pension administrator, registrar or other business ("you") to the Entrustt API, dashboard, sandbox and documentation (together, "Entrustt"). They are for businesses. They are not for individuals using Entrustt in a personal capacity.

2. Words we use

• Customer Data means the data you send to Entrustt or that Entrustt creates for you, including account references, activity signals, next-of-kin records and audit log entries.
• Next-of-Kin Record means the details of a person a customer of yours has named as someone to contact.
• Inactivity Signal means information you send us showing that a customer has been inactive.
• Human Review means a check by a named person who reads the supporting documents before any information is disclosed.
• Sandbox means the test environment that uses made-up data. Production means the live environment.
• Order Form means the signed or accepted document that names you, the fees, the term and any special terms.

3. Documents and which one wins

Your agreement with us is made up of the Order Form, the data processing agreement, the service level agreement, the acceptable use policy, these terms and the documentation. If they conflict, they apply in that order, with the Order Form first.

You accept these terms by signing an Order Form, by accepting them online, or by using Production, whichever happens first.

4. Access, keys and environments

We give you a non-exclusive, non-transferable right to use Entrustt for your own business during the term. You may let your employees and contractors use it for you, and you are responsible for what they do.

Keep your API keys and webhook secrets safe. Do not share them across customers or environments. Tell us at once if you think a key has leaked.

The Sandbox is for testing. Put only made-up data in it. The Sandbox has no service commitment and we may reset it. Production needs a signed Order Form.

5. Pilots

A pilot is a trial with a fixed scope, set out in the Order Form. A pilot runs for [90 days] unless the Order Form says otherwise. During a pilot there are no service credits, support is on a best-effort basis, and each party's liability is capped at the lower of [NGN amount] and the fees paid. If the pilot does not become a paid agreement in writing, we return or delete Customer Data within [30 days] of the pilot ending.

6. Fees, tax and payment

You pay the fees in the Order Form. Fees are stated in [naira or US dollars] and exclude Value Added Tax, which you pay in addition at the rate in force (7.5% at the date of these terms) against a valid tax invoice.

If the law requires you to deduct withholding tax, you deduct only the amount required, pay it to the tax authority on time, and send us the tax credit note or receipt within [30 days]. If you do not, you pay us the amount you deducted.

Invoices are payable within [30 days]. Late amounts carry interest at [1.5% a month] or the legal maximum, whichever is lower. We give at least [60 days] written notice of any fee change that applies at renewal.

7. What you are responsible for

You decide why and how the personal data you send us is used, so you are responsible for the following.

• Lawful basis and notice. Before you send us a Next-of-Kin Record or an Inactivity Signal, you must have a lawful basis under the Nigeria Data Protection Act 2023, and you must have given the notices and obtained the consents the law requires. That includes the consent of the account holder who named the person, and, where the law requires it, the person named. You warrant that you have done this. We do not check it, but we may pause processing of a record if we are told there is a defect.
• Accuracy. Keep the data you send accurate and up to date.
• Reviewers. Name real, authorised people as reviewers. A shared login, a service account or a script is not a reviewer.
• Your endpoint. Keep your webhook endpoint secure, check the signature on every event, and ignore an event ID you have already processed.
• Do not depend on us in real time. Entrustt is not built to sit in the path of a customer transaction. Do not make it a blocking step in a payment or login.
• Your own decisions. Entrustt output is not, on its own, proof that a person has died or lost capacity. Do not use it as the only basis for a decision that has legal effect.
• Requests from individuals. You answer requests from your customers about their personal data. We help as set out in the data processing agreement.

8. What data you may send

You may send: a reference for the account holder (we prefer a pseudonymous reference to a name), last-activity dates and inactivity flags, the name, relationship and contact details of the next of kin, and the policy settings you choose.

Unless we agree in writing first, do not send card numbers, PINs, passwords, one-time codes, full national identity or bank verification numbers, biometric data, health data, or account balances. Where we need an identity number, send a token or the last four digits.

9. What Entrustt does, and what it does not

Entrustt shares information. It does not hold, move or release money, securities, policy proceeds, pension entitlements or any other asset. You must not use Entrustt or its outputs to start, authorise or settle any such movement without your own independent checks and approval.

Every disclosure request goes through Human Review by your authorised reviewer and, where the Order Form says so, by us. We may refuse or delay a disclosure that we reasonably believe is unlawful, fraudulent or harmful.

Entrustt does not give legal advice. It does not replace probate, letters of administration or a court order, and it does not decide who is entitled to an estate. A next of kin named in Entrustt is a contact. A person named is not made a beneficiary or an heir by being named.

Whether, and when, you may tell a person about a customer's accounts, including after the customer has died, depends on your own legal duties, including banking confidentiality, and on what the customer agreed. You decide what each customer has agreed to and you set the disclosure rules in your configuration. We apply them as you set them.

10. Personal data

For Customer Data, you are the controller and Remayn is your processor. The data processing agreement applies. For our own website, billing, security and product-usage data, Remayn is the controller, as described in the privacy notice.

11. Security and certifications

We protect Customer Data with the measures described in the data processing agreement. Customer data is kept separate for each partner.

We are honest about where we stand. As at the date of these terms, Remayn does not hold SOC 2, ISO/IEC 27001 or PCI DSS certification or attestation. Entrustt is not designed to receive or store payment card data. Our hosting providers keep their own certifications, which they describe in their own documentation. We will update this section if we obtain any certification. See also our security page.

12. Sub-processors

You give us general permission to use the sub-processors on our sub-processor list. We give you at least [30 days] notice before a new one processes Customer Data. You may object on reasonable data protection grounds within [14 days]. If we cannot resolve it, you may end the affected service and we refund fees prepaid for the period after it ends. We stay responsible for our sub-processors.

13. Intellectual property and feedback

We own Entrustt, including the API, dashboard, documentation and models, and statistics about usage that do not identify you or any individual. You own Customer Data. You give us the right to process Customer Data only to provide Entrustt to you and as the data processing agreement allows.

If you give us feedback, we may use it freely and without paying you for it.

14. Confidentiality

Each party keeps the other's non-public information confidential and uses it only for this agreement. A party may share it with its employees, advisers and subcontractors who need it and who owe equal duties, and where the law or a regulator requires. A regulator with authority over you, such as the CBN, PenCom, the SEC, NAICOM or the NDPC, may ask for information, and you may give it. This duty lasts for [3 years] after the agreement ends, and for as long as we hold personal data or trade secrets.

15. Suspension

We may suspend access, to the smallest extent needed, if continued access creates a serious security risk, if use is unlawful or breaks the acceptable use policy, or if undisputed fees are unpaid [14 days] after written notice.

Where we can, we tell you first, and we restore access promptly once the cause is fixed. Suspension for non-payment does not delete Customer Data. Where there is an imminent risk of harm to a person, active fraud, a security compromise or a legal order, we may suspend at once and tell you as soon as the law allows.

16. Warranties and disclaimers

Each party confirms that it has the authority to enter into this agreement. We will provide Entrustt with reasonable skill and care and in line with the documentation.

We do not promise that Entrustt will be uninterrupted or error-free. We do not warrant that a customer will respond to a check-in, that a next of kin can be reached, or that any person is entitled to any information or asset. Apart from what is stated in this agreement, we give no other warranties to the extent the law allows.

17. Indemnities

You indemnify us against third-party and regulator claims, and the resulting losses and reasonable costs, that arise from your breach of the lawful basis and notice commitments in section 7, from Customer Data you had no right to send, or from your breach of the acceptable use policy.

We indemnify you against third-party claims that Entrustt, used as these terms allow, infringes that third party's intellectual property rights. [Counsel to decide whether Remayn also indemnifies for its own breach of data protection obligations, subject to the cap in section 18.]

The indemnified party must give prompt notice, allow the other to control the defence, cooperate, and not settle a claim in a way that admits fault without consent.

18. Limits on liability

Each party's total liability to the other under this agreement in a contract year is capped at the greater of (a) the fees paid and payable in the 12 months before the first event giving rise to liability and (b) [NGN amount]. For data protection breaches there is a separate cap of [amount or multiple of annual fees].

Neither party is liable for indirect or consequential loss, or loss of profit, revenue or goodwill.

Nothing here limits liability for death or personal injury, fraud, wilful misconduct, your duty to pay fees, or anything else the law does not allow to be limited. Nothing in this agreement limits a data subject's own rights against a controller or processor under the Nigeria Data Protection Act 2023, or any fine a regulator imposes on a party.

19. Events outside our control

Neither party is liable for a delay or failure caused by events it could not reasonably control, such as a power or network failure, a regional outage at a cloud provider, a government action or regulator directive, a strike or a pandemic. This does not excuse a duty to pay fees. The affected party must tell the other promptly and keep Customer Data secure. If the event lasts more than 30 days, either party may end the affected service.

20. Term, ending and leaving

An Order Form runs for its initial term, normally [12 months], and then renews for successive 12-month terms unless either party gives [60 days] notice before the end of the term. After the first term you may end the agreement for convenience on [90 days] notice. We may do so on [180 days] notice and with exit help.

Either party may end the agreement if the other commits a material breach and does not fix it within 30 days of notice, or becomes insolvent.

When the agreement ends we, at your choice, return Customer Data in a structured, commonly used format within 30 days and delete it from live systems within 90 days. Backups are overwritten in the normal cycle after that. On request we confirm deletion in writing. We give up to [60 days] of reasonable exit help at our then-current rates. We revoke your webhook secrets on ending. Sections that by their nature should survive do so.

21. Governing law and disputes

This agreement is governed by the laws of the Federal Republic of Nigeria.

If there is a dispute, senior people from each side meet within 10 days of a written notice and try to resolve it for 30 days. If that fails, the dispute is finally resolved by arbitration under the Arbitration and Mediation Act 2023 by a sole arbitrator. The seat is Lagos, the language is English, and the arbitration is administered under the rules of [institution to be confirmed]. Either party may ask a court of competent jurisdiction for urgent interim relief.

22. General

• Notices are given by email to the contacts in the Order Form.
• Changes. We may update these terms. Material changes take effect for you at your next renewal or on [30 days] notice, whichever is later.
• Assignment. Neither party may transfer the agreement without the other's written consent, except to a successor of the whole business.
• Compliance. Each party complies with anti-bribery and sanctions laws that apply to it.
• Name use. We may not use your name or logo publicly without your written consent.
• Whole agreement. The documents in section 3 are the whole agreement. A signed Order Form, an electronic signature or an online acceptance is valid.
• If a part is unenforceable, the rest still applies.

23. Contact

Questions about these terms: contact us. For security issues, see how to report a vulnerability.