Data Processing Agreement

These documents were prepared against the Nigeria Data Protection Act 2023 and the NDP Act General Application and Implementation Directive 2025 (GAID), in force from 19 September 2025. They have not yet been reviewed by a qualified legal practitioner and are not legal advice. They are published so that the Service is never operating without terms, and they are due for professional review.

This agreement governs personal data that you, the customer, put into WeSelling about other people — your customers, your staff, your suppliers. It forms part of our Terms of Service and applies for as long as you hold an account.

1. Roles

For the personal data covered by this agreement, you are the data controller and WeSelling is the data processor, as those terms are used in the Nigeria Data Protection Act 2023 and the NDP Act General Application and Implementation Directive 2025 (GAID).

This agreement does not cover the personal data we process as a controller in our own right — administering your account, billing, platform security, fraud prevention and our own legal compliance. That is described in our Privacy Notice. The distinction matters: the Act places obligations on controllers and processors separately, and we hold both sets in different respects.

2. What is processed

Subject matter	Providing the Service described in our Terms.
Duration	For as long as you hold an account, plus the retention period on closure.
Nature and purpose	Storage, retrieval, organisation, display, transmission to the integrations you enable, and deletion — all as directed by your use of the Service.
Types of personal data	Names, contact details, addresses, order and transaction records, payment references, communications you send through the Service, staff records including attendance and payroll data, and any other personal data you choose to enter.
Categories of data subject	Your customers, your staff, your suppliers, your partners, and anyone else whose details you enter.

You decide what goes into these fields. If you enter data of a kind that attracts additional protection under the Act, you are responsible for having a basis to process it.

3. Our obligations

• We act on your instructions. We process the personal data only to provide the Service and as you direct through it, except where the law requires otherwise — in which case we will tell you before processing, unless the law forbids us from saying so.
• Confidentiality. Everyone we allow to access the data is bound by a duty of confidentiality and given access only to the extent their work requires it.
• Security. We maintain appropriate technical and organisational measures, including encryption in transit and at rest, access control, tenant isolation, audit logging, and credential storage that is not readable back from our interfaces.
• Assisting you. We will help you meet your own obligations under the Act — responding to data subject requests, assessing security, and reporting breaches — so far as is reasonable given the nature of the processing and what is available to us.
• Breach notification. If we become aware of a personal data breach affecting your data, we will notify you without undue delay and give you the information you need to make your own report to the Nigeria Data Protection Commission.
• Deletion and return. On closure of your account we retain your data for 90 days so it can be restored, and delete it after that. You can export your records at any time before then. Backups are deleted on their own rotation.
• Audit. We will provide the information reasonably needed to demonstrate compliance with this agreement, and will co-operate with an audit you or your auditor conduct on reasonable notice, at reasonable frequency, and without compromising the confidentiality of other customers.

4. Your obligations

• You must have a lawful basis for the personal data you enter, and give the people it concerns whatever privacy information the law requires.
• You are responsible for the accuracy of what you enter and for keeping it current.
• You must not instruct us to process personal data in a way that would breach the Act.
• You are responsible for who you grant access to inside your own account, and for removing that access when it is no longer needed.
• Where you send messages through the Service, you must hold whatever consent the law and the relevant provider require.

5. Subprocessors

You authorise us to engage subprocessors to provide the Service. Each is bound by written terms no less protective than this agreement. Our current subprocessors are:

Subprocessor	What it does	Where
Our hosting and database provider	Runs the application and stores the database and backups	the European Union
Our transactional email provider	Delivers sign-in links, receipts and account notices	[to be completed]
Our error and uptime monitoring provider	Receives diagnostics when something fails	[to be completed]

We will give you notice before adding or replacing a subprocessor, and you may object on reasonable data protection grounds; if we cannot resolve the objection you may close your account.

Integrations you enable are not subprocessors of ours. When you connect your own Paystack, Flutterwave, Monnify, Stripe, Meta, Twilio or Termii account, that provider processes data for you, under your agreement with them, on credentials you supply. We transmit data to them because you have told us to. Their processing, pricing, retention and security are governed by your contract with them, not by this one.

6. Data subject requests

If a person contacts us directly about data you control, we will not respond to the substance ourselves — we will tell them to contact you and let you know it happened. The Service provides search, export, correction and deletion tools so you can answer them.

7. International transfers

Personal data is stored in the European Union and is therefore transferred outside Nigeria. We rely on the recipient jurisdiction's own data protection regime together with contractual protections in our agreements with the suppliers concerned. Where an integration you enable is operated from elsewhere, that transfer happens under your own agreement with that provider.

8. Liability

The liability provisions of our Terms of Service apply to this agreement. Nothing here excludes or limits either party's liability under data protection law where that liability cannot lawfully be excluded.

9. Contact

For anything arising from this agreement, including a breach notification or an audit request: team@weselling.store.