Data Processing Agreement

This page sets out, in plain language, how we handle personal data on your behalf when you are our client. It is a summary of the Data Processing Agreement we sign with you. Where the two differ, the signed agreement is the one that counts. We built it around the Nigeria Data Protection Act (NDPA) 2023, and it is NDPA-aligned.

In the law, you are usually the data controller and we are your data processor. You decide what personal data is collected and why. We act on your documented instructions.

1. Who is who

You are the controller: the person or company whose customers, staff or records the data belongs to. Inventrium (IBSS) is the processor: we handle that data only to deliver the service you have engaged us for, such as hosting, email, support, an ERP or a website.

2. What data we handle

Only the personal data the service needs. In practice that can include the names, email addresses and phone numbers of your staff and customers, login and access records, support messages, and whatever sits inside the systems we host or manage for you. We do not collect personal data for our own purposes from the systems we run for you.

3. Why we handle it

To carry out the service in your contract and nothing else. That means setting up and running your systems, fixing faults, keeping backups, answering your users and giving you the reports you ask for. We act on your documented instructions. If an instruction looks unlawful to us, we tell you before acting.

4. Where your data lives

We tell you where each service stores your data before you commit, and we choose hosting to suit where your data needs to stay. Some platforms we resell, such as Google Workspace, Microsoft 365 and Zoho, store data in their own regions. We name the location for each service in your onboarding pack, and we flag any transfer outside Nigeria so you can decide on it.

5. How long we keep it

For as long as the service runs, plus any period the law or your own policy requires. When the engagement ends, we hand your data back in a usable format and then delete the copies we hold, on a timeline we agree with you. You can ask for earlier deletion at any point.

6. Who else touches it (sub-processors)

We use a small set of trusted platforms to deliver the work, for example the email, hosting and ERP vendors named in your contract. We list them for you, we hold each to confidentiality, and we tell you before we add or change one that handles your data. You can object to a new sub-processor.

7. How we protect it

These are the measures we apply, described as capabilities rather than guarantees. Every person has their own login and sees only what their role needs. We enforce a second sign-in step on the accounts we administer. We keep encrypted backups and test that they restore. We review access when someone joins or leaves, and we keep a record of the admin access we hold for you.

8. If something goes wrong

If we become aware of a personal data breach affecting your data, we tell you without undue delay and give you what you need to meet your own NDPA reporting duties. The NDPA sets a 72-hour window for reporting certain breaches to the regulator, and that duty sits with you as the controller. We help you meet it.

9. The rights you keep

Your data stays yours. You can ask us for a copy of what we hold for you, ask us to correct or delete it, or ask us to help you answer a request from one of your own data subjects. We do not charge to hand your data back at the end of an engagement.

10. NDPA and the DPCO point

We do the technical set-up, preparation and security work. We are not a licensed Data Protection Compliance Organisation (DPCO). Where the NDPA requires an audit or a filing, a licensed DPCO carries it out and files it. You can use a DPCO you already work with, or we can introduce one. We do not certify or guarantee compliance ourselves.

11. Ask for the full agreement

This page is the summary. For the signed Data Processing Agreement, the current list of sub-processors or a security questionnaire response, see our Trust Center or Strategic Engagements page, or contact us and we will send what we hold.