Data Processing Addendum

This addendum forms part of the agreement between the customer and Timothy Odebunmi, trading as Omnisocial, when the customer determines the purposes and means of processing and Omnisocial processes personal data only to provide the service.

For consumer accounts and for the operator's own account, billing, security and website data, the operator is the controller and this addendum does not apply.

Where a workspace owner determines how member and content data is used, the workspace owner may be the controller for that workspace data and the operator acts as its processor.

The subject matter, duration, nature and purpose of processing, and the types of personal data and categories of data subjects, are those described in the service documentation and the customer's configuration.

• "Customer" means the person or entity that accepts this addendum and controls the relevant personal data.
• "Personal data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given by applicable data-protection law, including the Nigeria Data Protection Act 2023 where it applies.
• "Subprocessor" means a third party engaged by Omnisocial to process personal data on the customer's behalf.
• "Services" means the Omnisocial publishing, scheduling, calendar, workspace and related functionality described in the agreement.

We process customer personal data only on the customer's documented instructions, including those expressed through the product's configuration and the actions the customer takes, unless law requires otherwise. If law requires processing beyond those instructions, we will inform the customer unless the law prohibits us from doing so.

We will tell the customer if, in our view, an instruction infringes applicable data-protection law. We may suspend the affected processing until the instruction is clarified, without liability for the delay.

We do not sell customer personal data, use it for advertising, or use it to train generative AI models. We do not use customer data for our own purposes beyond providing and securing the services.

We limit access to customer personal data to personnel who need it to provide the services. Those personnel are bound by confidentiality obligations and receive appropriate training.

We do not disclose customer personal data to a third party except as permitted by this addendum, instructed by the customer, or required by law.

These measures are appropriate to the risk. We do not claim certification under ISO 27001, SOC 2 or any other standard, and nothing in this addendum creates a certification obligation.

• Encryption of data in transit.
• Access controls and least-privilege administration.
• Private Amazon S3 storage in US East 1 with short-lived, approximately four-hour access links for current media. Legacy Cloudflare R2 objects may be public and are excluded from that description.
• Logging and monitoring for security and reliability.
• Secure configuration and patching of the application and hosting environment.
• Procedures to restore availability and access after an incident.

The customer authorises the subprocessors listed below for the described processing. We will give notice before adding or replacing a subprocessor that processes customer personal data, giving the customer a reasonable opportunity to object on data-protection grounds.

• Amazon Web Services (AWS), US East 1 (N. Virginia): private storage for current media.
• Contabo: application database and cache, processing location Germany.
• Google Firebase: authentication.
• Google Analytics for Firebase (legacy, disabled on release): historical analytics data retained by Google under its own retention and deletion terms.
• Resend: transactional email delivery.
• Zoho Mail: incoming support and privacy email. Its processing is governed by its own terms and locations.
• Cloudflare R2 (legacy): earlier media storage that may still contain existing media and may be publicly accessible.

A current subprocessor list is available from the operator on request. The list above reflects the providers used by the service at the effective date of this addendum.

Where processing involves a transfer of personal data outside Nigeria, we rely on an applicable lawful transfer mechanism and require appropriate safeguards from the recipient.

AWS media storage is configured in US East 1. Google (including historical Google Analytics for Firebase data) and Resend may process data in the United States and other locations they disclose. The virtual private server provider is Contabo, with processing location Germany. Zoho Mail processes incoming support and privacy email under its own terms and locations.

The customer is responsible for determining whether its own instructions require additional transfer safeguards.

Taking into account the nature of the processing, we provide reasonable assistance so the customer can respond to access, correction, deletion, restriction, portability and objection requests.

If a data subject contacts us directly about data the customer controls, we will direct the request to the customer unless the law requires us to act ourselves.

We provide reasonable assistance with data-protection impact assessments and prior consultations where required, at the customer's cost for work that is clearly outside normal support.

We notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data. The notice describes what happened, the data and individuals affected, the likely consequences and the steps taken or proposed.

We cooperate with the customer's notifications to authorities and data subjects. The customer is responsible for its own regulatory notifications unless the law assigns that duty to us.

On termination, or on the customer's written request, we delete or return customer personal data, at the customer's choice, subject to legal retention requirements.

Deletion from active systems is completed within 30 days of verification. Backups expire within 90 days unless a shorter legal or platform limit applies.

If the customer needs an export, it must request one before termination. We may keep data longer where required by law, and in that case only for the required purpose.

We provide the information reasonably needed to demonstrate compliance with this addendum. Where an audit is required, the customer may conduct one with reasonable notice, during business hours, under confidentiality, and without disrupting the service or other customers.

Audits are limited to the relevant systems and records. The customer bears its own costs and any costs of an audit that exceeds one request per year, unless the audit reveals a material breach.

Each party's liability under this addendum is subject to the limitations in the agreement, except where the law does not allow a limitation. Nothing in this addendum limits data-subject rights or a regulator's powers.

This addendum applies while we process customer personal data and continues for as long as necessary to comply with its surviving obligations.

We may update the subprocessor schedule and security measures as the service changes, giving notice where required. Updated terms apply from the stated effective date.

Timothy Odebunmi, trading as Omnisocial, based in Nigeria. Email: hello@executioninc.org.