Data Processing Addendum

The business is the data controller of personal information it enters into or collects through SABI about its customers, staff and contacts. SABI is its data processor. This addendum does not cover information SABI controls for its own purposes, which is described in the Privacy Policy.

• Subject matter and purpose: providing the SABI platform and its features the business uses, including bookings, orders, projects, classes, sales, payments records, staff and payroll records, messages, public pages, reports and support.
• Duration: while the business uses SABI, and afterwards only for the period in section 12.
• People concerned: the business’s customers, prospective customers, students or attendees (which may include children), staff and team members, and contacts.
• Types of information: names, contact details, addresses, booking, order and visit history, notes, preferences, measurements, photos, payment and invoice records, staff roles, schedules, pay and bank details, and message records.
• Sensitive information: only what the business chooses to record, such as allergy or health notes. The business decides whether it may do so.

SABI processes the information only on the business’s documented instructions. The Terms, this addendum and the business’s use and settings in SABI are those instructions. SABI may also process it where the law requires; if so, SABI will tell the business first unless the law prevents it. SABI will tell the business if it believes an instruction breaks data protection law.

The business is responsible for having a lawful basis, giving its own privacy notices, obtaining any consent required (including for sensitive information, children’s information and promotional messages), the accuracy of its information, and deciding which team members have access.

SABI limits access to people who need it to provide, secure or support the service, and makes sure they are bound by confidentiality.

SABI uses appropriate technical and organisational measures, taking into account the risks and the nature of the information. These include separating each business’s records, role-based access, encrypted connections, restricted access to payment and messaging settings, and support access the business can grant and remove. SABI reviews these measures from time to time.

The business authorises SABI to use subprocessors for hosting, database and storage, email (Resend), WhatsApp and SMS (Twilio), payments (such as Paystack, Flutterwave and Stripe, where used), and AI features (through an AI gateway and model providers including OpenAI and Google). SABI will impose data protection obligations on subprocessors that are appropriate to the processing, remains responsible for them as the law requires, and will give notice of new subprocessors so the business can object on reasonable grounds.

Where a payment or messaging provider acts as an independent controller under its own terms, it is not a subprocessor for that part of its processing.

Some subprocessors operate outside Nigeria. SABI will transfer personal information outside Nigeria only on a basis permitted by the Nigeria Data Protection Act 2023 and the NDPC’s directions, such as an adequacy finding, appropriate contractual safeguards or another lawful condition, and will record the basis relied on for each transfer.

SABI will help the business, through the platform’s features and reasonable support, to respond to requests from individuals to access, correct, delete, restrict, object to or move their information. If SABI receives such a request directly about the business’s records, it will pass it to the business and will not respond itself except as the business instructs or the law requires.

SABI will tell the business without undue delay after becoming aware of a personal data breach affecting the business’s information. SABI will share what it knows, and update it as it learns more, including the nature of the breach, likely consequences and steps taken. This helps the business decide whether to notify the NDPC within 72 hours and to inform affected individuals where the law requires. Telling the business is not an admission of fault.

SABI will give reasonable help with data protection impact assessments and with questions from the NDPC or another regulator about the processing, taking into account the information available to it.

When the business stops using SABI, it may export its records and SABI will delete or return the business’s personal information within a reasonable time, unless the law requires it to keep some of it. Copies in backups are deleted as backups are routinely replaced. Retained information stays protected by this addendum.

SABI will make available information reasonably needed to show it meets this addendum, such as written answers to security questions. If that is not enough, or a regulator requires it, the parties will agree a proportionate audit with reasonable notice, scope and confidentiality, at the business’s cost unless it reveals a material breach by SABI.

This addendum lasts as long as SABI processes personal information for the business. The limits of liability in the Terms apply, except where the law does not allow it. Questions: support@isabi.app.