Data Processing Agreement
Version 2026-09-29
1. Parties and roles
This agreement is between you (the business, the data controller) and [Company Name Ltd] (RC [number]), [registered address] (the data processor), and forms part of the Terms of Service. It applies to personal data Reeplii processes on your behalf under the Nigeria Data Protection Act 2023 (NDPA) and its General Application and Implementation Directive.
2. What is processed
- Data subjects: your customers and prospects.
- Data: phone numbers, names, custom fields you upload, consent records, message and voice-note content and transcripts, delivery status.
- Purpose: sending and receiving WhatsApp messages you instruct, AI-assisted replies, and related reporting. Duration: while your account is open, plus the deletion period below.
3. Our commitments as processor
- Process personal data only on your documented instructions (your use of the service), unless required by law.
- Ensure staff with access are bound by confidentiality.
- Apply appropriate security: encryption in transit, encrypted storage of WhatsApp credentials, row-level access isolation between businesses, least-privilege access, and an audit log of sensitive actions.
- Help you respond to data subject requests: Reeplii provides contact export and permanent erasure tools.
- Notify you without undue delay, and in any case within [24] hours, after becoming aware of a personal data breach affecting your data, so you can meet the NDPA's 72-hour notification duty to the Commission.
- Help you with data protection impact assessments where needed.
4. Sub-processors
- You authorise the following sub-processors. We will give [30] days' notice of changes, and you may object.
- Supabase: Database, authentication, file storage (EU (Ireland))
- Cloudflare: Hosting and scheduled jobs (Global edge)
- Meta (WhatsApp Business Platform): Sending and receiving WhatsApp messages (Global)
- Twilio: WhatsApp delivery for the Naira-wallet option (United States)
- Groq: AI replies and English voice-note transcription (zero data retention enabled) (United States)
- Spitch: Voice-note transcription for Nigerian languages (Nigeria / cloud)
- Paystack: Subscription and wallet payments (Nigeria)
- Flutterwave: Subscription and wallet payments (Nigeria)
5. International transfers
Where sub-processors are outside Nigeria, transfers rely on the mechanisms allowed under Part VIII of the NDPA. [Lawyer to confirm and attach transfer clauses.]
6. Deletion and return
You can export your data at any time. When your account closes, we delete your customers' personal data within [30] days, except where the law requires us to keep it.
7. Audits
On reasonable notice, we will provide information needed to demonstrate compliance with this agreement.