Data processing agreement

You are the data controller and Pletopay is your data processor for Customer Data: personal data about your customers that you send to Pletopay, or that Pletopay processes to provide the service on your behalf. This includes customer records, invoices, subscriptions, checkout sessions, the receipts and invoices we email in your name, webhooks and reports.

Pletopay is a separate data controller, under the Privacy policy, for your team members’ data, business verification data, the bank details of payers and recipients that we must keep and check by law, and fraud-prevention and security records.

• Have a lawful basis for the Customer Data you send us, and tell your customers that Pletopay processes payments for you.
• Send only the data the service needs. Do not put sensitive personal data, BVNs or ID numbers in descriptions, metadata or other free-text fields.
• Make sure your instructions to us comply with the Act.

• Process Customer Data only on your documented instructions, which are the Terms of service, your API requests and your dashboard settings, unless the law requires otherwise. We will tell you if we believe an instruction breaks the Act, unless the law prevents us.
• Make sure everyone who processes Customer Data is bound by confidentiality.
• Protect Customer Data with appropriate technical and organisational measures, as section 39 of the Act requires and as described in the Privacy policy.
• Help you respond to requests from your customers to exercise their rights, and pass on any request we receive directly.
• Help you carry out data privacy impact assessments, and consult the Nigeria Data Protection Commission where needed.
• Tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting Customer Data, with the information you need to notify the Commission within the Act’s 72 hours.

You authorise us to use sub-processors for hosting, databases, file storage, email delivery and monitoring. We bind each one to data protection obligations at least as strict as these, and we remain responsible for them. The current list is available from hello@pletopay.com. We will give you at least 30 days’ notice of a new sub-processor; if you object on reasonable data protection grounds and we cannot address your objection, you may close your account.

We transfer Customer Data out of Nigeria only on a basis permitted by sections 41 to 43 of the Act, and we record the basis for each transfer.

We will give you the information you reasonably need to show that we comply with this agreement. Once a year, on 30 days’ written notice, you may audit our compliance yourself or through an independent auditor bound by confidentiality, at your own cost and without disrupting the service or other businesses’ data.

Before closing your account, you can export your customer data from the dashboard. Within 90 days of closure, we delete Customer Data, except records we must keep by law, such as transaction records under the Money Laundering (Prevention and Prohibition) Act 2022. We keep those as a controller for the periods in the Privacy policy.

The liability terms in the Terms of service apply to this agreement. If this agreement and the Terms of service conflict on data protection, this agreement prevails.