This Data Processing Agreement ("DPA") forms part of the agreement between Ovaloop ("Processor") and the Customer ("Controller").
This DPA governs the processing of personal data by Ovaloop on behalf of the Customer in connection with Ovaloop services.
"Personal Data" means any information relating to an identified or identifiable natural person.
"Processing" means any operation performed on Personal Data including collection, storage, use, disclosure, transmission, or deletion.
Ovaloop may process:
•Customer records
•Employee records
•Supplier records
•Contact information
•Transaction records
•Business operational data
solely to provide contracted services.
Customer warrants that:
•It has lawful grounds to collect and process data.
•It has obtained necessary consents.
•It complies with applicable data protection laws.
Ovaloop shall:
•Process data only on documented instructions.
•Maintain confidentiality.
•Implement appropriate security measures.
•Notify Customer of material data breaches.
•Assist with lawful data subject requests.
Customer authorizes Ovaloop to engage third-party subprocessors including:
•Cloud hosting providers
•Payment providers
•Analytics providers
•Email delivery providers
•Customer support providers
Ovaloop remains responsible for subprocessor compliance.
Ovaloop shall maintain administrative, technical, and organizational safeguards appropriate to the risk presented by the processing activities.
Ovaloop shall notify Customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer data.
Upon termination, Customer may request export of available data.
Ovaloop may retain data where required by law or for legitimate security, backup, audit, or compliance purposes.
Customer acknowledges that data may be processed in jurisdictions where Ovaloop or its providers operate.
Upon reasonable written request, Ovaloop may provide information demonstrating compliance with this DPA.
This DPA shall be governed by the laws of the Federal Republic of Nigeria.