Data Processing Agreement

This DPA applies when Axum processes personal data for you to provide the Service. You are the controller of that data. Axum is your processor. "Data protection law" means the Nigeria Data Protection Act 2023, the GAID 2025, and any other data protection law that applies to the processing.

Axum is the controller only for its own account, billing and website data. The Privacy Policy covers that data.

We process the personal data only to provide the Service and on your documented instructions. The Terms, your settings and your use of the Service are your instructions. If we think an instruction breaks data protection law, we tell you.

You confirm that you have a lawful basis to give us the data, and that you gave any notices that the law requires.

Only people who need access to provide the Service can get access to the data. Those people must keep the data confidential.

We use appropriate technical and organisational measures to protect the data. These include encryption in transit, separation of each customer's data, access controls and backups.

You allow us to use service providers (sub-processors) to provide the Service. The current list is in the provider table on axumworks.com/security. We can give you a full list on request.

We tell you by email at least 30 days before we add or replace a service provider. You can object for reasonable data protection reasons in that period. If we cannot solve the objection, either party can end the affected part of the Service. We choose service providers whose terms include data protection commitments. We stay responsible for our service providers.

If a person asks us to access, correct or delete their personal data, we send the request to you. We help you to answer it, as far as the Service allows.

We also give you reasonable help with data protection impact assessments and with questions from a data protection authority, when they relate to our processing.

We tell you without undue delay, and in no more than 48 hours, after we find a personal data breach that affects your data. We give you the information that we have and that you need to meet your duties. We also take reasonable steps to limit the breach.

When your account ends, you can export your data first. We delete your personal data within 30 days after the account ends, unless the law requires us to keep it.

We give you the information that you reasonably need to show that we follow this DPA. You can ask for an audit once a year, with 4 weeks' written notice. You pay the cost of the audit, and the auditor must keep our information confidential.

We and our service providers can process data in Nigeria, the United States and other countries. When data protection law requires it, we use a lawful transfer mechanism.