Data Processing Agreement

01

Parties and purpose

This agreement is between the business that uses AGA CRM (the "Client", the controller) and AGA Digital Tech Ltd (RC 8793326), trading as AGA CRM, of No. 8, Road 3, Ogidi Street, Akobo, Ibadan, Oyo State, Nigeria ("AGA", the processor). It forms part of the Terms of Service and takes priority over them for the processing of personal data.

It is designed to meet the Nigeria Data Protection Act 2023, Article 28 of the GDPR and the UK GDPR. No signature is needed; if you need a signed copy, write to info@theagacrm.com.

02

Roles

• For support data (the emails, chats, tickets, customer profiles, files, call records and notes in your workspace), you are the controller and we are your processor.
• For account and billing data about your staff and your subscription, we are a controller, under our Privacy Policy.
• Services you connect yourself, such as your email provider, remain under your own contract with them.

03

What we process

04

Your instructions

We process support data only on your documented instructions: these terms, the settings you choose and the actions your staff take. We do not sell it, use it for advertising, or use it to train AI models. If we think an instruction breaks the law, we tell you.

Our staff look at support data only when you ask us to, to fix a fault or security issue, or when the law requires it.

05

Confidentiality

Everyone at AGA with access to support data is bound by confidentiality, and access is limited to those who need it.

06

Security

We keep these measures in place and will not weaken them:

• Encrypted connections (TLS 1.2 or newer) to the service.
• Passwords stored only as hashes; mailbox passwords, payment keys and two-factor keys encrypted (AES-256).
• Each workspace kept separate, with role-based permissions inside it.
• Two-factor sign-in required for workspace owners and our administrators.
• Automatic sign-out after inactivity, and sessions that can be ended remotely.
• An audit trail of actions in each workspace.
• Virus scanning of uploaded and emailed files, and a bot check on forms.
• Hourly encrypted backups held in three places, kept 30 days, with the decryption key stored offline.
• Round-the-clock monitoring with alerts to on-call staff.

07

Subprocessors

You authorise us to use the subprocessors listed in the annex below. Each is bound by data protection terms no weaker than ours, and we remain responsible for them.

We email workspace owners at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we cannot offer an alternative, you can end the affected service and we refund any prepaid fees for it.

08

Transfers

AGA is in Nigeria; the service is hosted in the United Kingdom; our team may access it from Northern Cyprus; some subprocessors are in the United States and other countries.

Transfers rely on recognised protection in the receiving country where available, or on standard contractual clauses (including the UK addendum where needed), together with the security measures above.

09

Helping you with requests

You can answer most requests from people yourself in AGA CRM: correct a customer profile, export everything about a customer, or erase a customer completely. If someone sends a request to us about support data, we pass it to you and help you answer it.

10

Deletion and return

• You can export your data at any time while the workspace exists, including when it is read-only.
• You can set closed tickets to be deleted automatically after a period you choose (at least 30 days).
• Erasing a customer removes their profile, tickets, messages, notes, call records and files straight away.
• When an owner deletes the workspace, it is permanently deleted 7 days later.
• A read-only workspace is kept until you delete it. We may delete one with no paid plan and no sign-ins for 12 months, after 30 days’ notice by email.
• Deleted data leaves our encrypted backups within 30 days.
• On written request we delete sooner and confirm in writing. Payment records are kept as accounting law requires.

11

Breaches

If a breach affects your support data, we tell your workspace owners without undue delay and within 72 hours of becoming aware of it, with what we know: what happened, the data and people affected, likely consequences, and what we are doing. We keep you updated.

You decide whether to notify regulators and individuals; we help you do it.

12

Audits

Once a year, or after a breach affecting your data, you can check our compliance with this agreement on 30 days’ written notice. We answer a written questionnaire at no charge; an on-site audit is at your cost and must protect other clients’ data.

We do not currently hold a SOC 2 or ISO 27001 certification.

13

Liability, term and law

This agreement lasts as long as we process support data for you. The liability limits in the Terms of Service apply, except that each party is responsible for fines and claims caused by its own breach of data protection law.

Nigerian law governs this agreement and the courts of Oyo State have jurisdiction; standard contractual clauses are governed by the law they specify.

14

Annex: subprocessors

Every party that can receive data through AGA CRM, what it is in law, and when it receives anything.