This agreement forms part of the Terms of Service between On Orbit Corporate Limited, RC 9646160 ("On Orbit", the processor) and the business that holds an On Orbit account ("the Customer", the controller). It applies whenever On Orbit processes personal data that the Customer puts into the service. It meets section 29 of the Nigeria Data Protection Act 2023.
1. Roles
The Customer decides why and how personal data about its customers, leads and staff is processed. On Orbit processes that data only to provide the service. If the Customer's instructions break the NDPA, On Orbit will say so and may refuse them.
2. What On Orbit will do
- Process the data only on the Customer's documented instructions. The Terms of Service, the Customer's settings and the Customer's actions in the app are those instructions.
- Make sure every person with access to the data is bound by confidentiality.
- Keep technical and organisational security measures in place (Annex B).
- Use sub-processors only as set out in section 4.
- Help the Customer answer requests from data subjects, mainly through export, edit and delete tools in the app.
- Tell the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting the Customer's data. The notice will say what happened, what data and people are affected, and what On Orbit is doing. This gives the Customer time to meet its own 72-hour duty to tell the NDPC.
- Help the Customer with data protection impact assessments and with questions from the NDPC, where those concern the service.
- At the end of the contract, let the Customer export its data for 90 days, then delete it, unless the law requires On Orbit to keep it.
- Give the Customer the information it reasonably needs to show compliance, and allow one audit a year on 30 days' notice, at the Customer's cost. A recent independent report can replace an audit.
3. What the Customer will do
- Have a lawful basis for all personal data it puts into On Orbit and give people the notices the NDPA requires.
- Not put data into On Orbit that it has no right to hold.
- Answer data subject requests about its own customers and staff. On Orbit will pass on any request it receives.
- Manage its own staff logins and remove access for people who leave.
4. Sub-processors
The Customer authorises On Orbit to use the sub-processors on On Orbit's current list, which On Orbit gives to any Customer on request. On Orbit will give 30 days' notice by email before adding or replacing one. The Customer may object on reasonable data protection grounds. If the parties cannot agree, the Customer may end the contract and get a pro-rata refund of prepaid fees. On Orbit stays responsible for each sub-processor's work.
5. Transfers outside Nigeria
On Orbit transfers data outside Nigeria only under Part VIII of the NDPA: to a country the NDPC recognises as adequate, under binding clauses that protect the data, or on another lawful ground.
6. Connected platforms
The Customer connects its own WhatsApp, Instagram and Facebook accounts with Meta, and its own ad accounts with Google, Meta and Snap. The Customer has its own agreement with each platform, and those platforms are not On Orbit's sub-processors for that traffic. On Orbit only stores and displays the messages and ad data the Customer chooses to connect.
Annex A: The processing
| Item | Detail |
|---|---|
| Data subjects | The Customer's leads, buyers, suppliers, job applicants and staff |
| Data types | Names, phone numbers, emails, addresses, messages, purchase and payment history, ID documents a business chooses to upload, employment and payroll details, bank details for salary payment, email marketing lists, ad performance data |
| Sensitive data | Only if the Customer chooses to store it, such as health notes on leave or ID documents |
| Purpose | Running the Customer's sales, stock, finance, HR, payroll, messaging, marketing, ad reporting and online store |
| Duration | For the life of the contract, plus 90 days |
Annex B: Security measures
On Orbit keeps these measures in place and reviews them at least once a year.
- Data encrypted in transit and at rest.
- Each business's data kept separate from every other business's data.
- Staff permissions by role, with payroll and salary data limited to named roles.
- Audit logs of changes to key records.
- Rate limiting, error monitoring and uptime monitoring.
- Regular database backups.