Izini — Data Processing Addendum

Izini RegTech Ltd (RC-9700347)

Version: 2026-10-07

Last updated: 7 October 2026

Preamble

This Data Processing Addendum ("DPA") forms part of, and is incorporated into, the Izini Terms of Use (the "Terms") between Izini RegTech Ltd, RC-9700347, of Lagos, Nigeria ("Izini", "Processor") and the customer that accepts the Terms ("Customer", "Controller"). Each is a "Party".

It governs Izini's processing of personal data on the Customer's behalf in the course of providing the Services, and is entered into to satisfy the requirement under the Nigeria Data Protection Act 2023 (the "NDPA") that a controller engage a processor under a written contract.

No signature is required. This DPA takes effect when the Customer accepts the Terms, and binds both Parties for as long as Izini processes personal data on the Customer's behalf. Where a Customer requires a separately executed copy, Izini will provide one on request to [email protected]; the terms of that copy will be these terms.

Capitalised terms not defined here have the meaning given in the Terms. Where this DPA and the Terms conflict on the subject of personal data processing, this DPA prevails.

1. Definitions and interpretation

1.1 "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach" and "Processing" have the meanings given in the NDPA.

1.2 "Customer Personal Data" means personal data contained in Customer Data that Izini processes on the Customer's behalf under the Terms.

1.3 "Sub-processor" means any third party engaged by Izini to process Customer Personal Data.

1.4 "NDPC" means the Nigeria Data Protection Commission.

1.5 "GAID" means the General Application and Implementation Directive issued under the NDPA.

1.6 References to a statute include that statute as amended or re-enacted, and any subsidiary instrument made under it.

1.7 The Annexes form part of this DPA. In the event of conflict, the body of this DPA prevails over an Annex, except that Annex 4 prevails on the subject of cross-border transfers.

2. Scope of processing and documented instructions

2.1 Roles. In respect of Customer Personal Data, the Customer is the Controller and Izini is the Processor. In respect of Izini's own account, billing, support and usage data, Izini is a Controller in its own right, and its Privacy Policy applies rather than this DPA.

2.2 Particulars. The subject matter, duration, nature and purpose of the processing, the categories of personal data, and the categories of data subjects are set out in Annex 1.

2.3 Documented instructions. Izini will process Customer Personal Data only on the Customer's documented instructions, including as to cross-border transfers, unless required to do otherwise by a law to which Izini is subject. Where such a law applies, Izini will inform the Customer of that requirement before processing, unless the law prohibits it on important grounds of public interest.

2.4 What counts as an instruction. The Terms, this DPA, and the Customer's use and configuration of the Services through its Workspace together constitute the Customer's complete documented instructions. Any other instruction must be agreed in writing, and Izini may charge for work outside the scope of the Services.

2.5 Unlawful instructions. Izini will inform the Customer without undue delay if, in its opinion, an instruction infringes the NDPA or the GAID. Izini may suspend performance of the instruction until it is withdrawn, confirmed or amended. Izini is not obliged to conduct a legal review of the Customer's instructions, and giving or failing to give notice under this clause is not advice on the Customer's compliance.

2.6 Controller's responsibilities. The Customer warrants that it has a lawful basis for the processing it instructs, that it has given data subjects the notices required of it, and that its instructions comply with the NDPA. The Customer is responsible for the accuracy, quality and legality of Customer Personal Data and for the configuration of its consent notices.

2.7 Prohibited uses. Izini will not:

(a) sell Customer Personal Data, or otherwise make it available to a third party for monetary or other valuable consideration;

(b) share it with any third party for cross-context behavioural advertising;

(c) use it for its own marketing, or to train generally available machine learning models;

(d) retain, use or disclose it for any purpose other than providing, securing and supporting the Services, or outside the direct business relationship between the Parties; or

(e) combine it with personal data Izini receives from or on behalf of any other customer, or collects from its own interaction with a data subject.

Izini may compile de-identified aggregated statistics as permitted by clause 14.5 of the Terms.

3. Processor obligations and confidentiality

3.1 Personnel. Izini will ensure that persons authorised to process Customer Personal Data are bound by an appropriate obligation of confidentiality, whether contractual or statutory, that survives the end of their engagement.

3.2 Need to know. Izini will limit access to Customer Personal Data to those personnel who need it to provide, secure or support the Services.

3.3 Competence. Izini will ensure that every person with access to Customer Personal Data understands their obligations under this DPA and under the NDPA, and maintains current knowledge of them. Where Izini engages additional personnel, it will extend documented training and confidentiality obligations to them before granting access.

3.4 Records. Izini will maintain a record of the categories of processing carried out on behalf of the Customer, and will make it available to the Customer or the NDPC on request.

3.5 Cooperation. Izini will, taking into account the nature of the processing and the information available to it, provide reasonable assistance to the Customer in meeting the Customer's own obligations under the NDPA in relation to security, breach notification, data protection impact assessments and prior consultation with the NDPC.

3.6 Notification of inability to comply. Izini will notify the Customer promptly if it determines that it can no longer meet its obligations under this DPA or under the NDPA. On receiving such a notice, the Customer may take reasonable and appropriate steps to stop and remediate the affected processing, and may terminate the affected part of the Services on written notice.

4. Technical and organisational measures

4.1 Izini will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, having regard to the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing, as well as the risk to data subjects.

4.2 Those measures are described in Annex 2. The Customer has reviewed them and agrees that, for the processing contemplated by the Terms, they are appropriate.

4.3 Izini may update the measures from time to time provided the updated measures do not materially reduce the overall level of protection.

4.4 Data minimisation by design. The consent banner identifies a browser by a randomly generated identifier stored on the End User's device, which is not derived from the End User's name, email address or account. With each recorded choice it stores the consent state, a timestamp, and technical information sent by the browser, including its user-agent string, language and approximate country or region. Identifiers the Customer sends through the SDKs, the consent topics API or the DSAR Enterprise Gateway are stored as sent; for usage counting, Izini uses a one-way hash of them. Where the Customer configures the Services to introduce directly identifying data into consent records, the Customer does so on its own lawful basis.

4.5 No re-identification. Where Izini holds or generates de-identified data derived from Customer Personal Data — including hashed identifiers used for usage counting and aggregated statistics — Izini will: take reasonable measures to ensure that data cannot be associated with a data subject; process it solely in de-identified form; not attempt to re-identify any data subject from it; and contractually oblige any recipient of it to do the same. This commitment is not affected by termination of the Terms.

5. Sub-processors and onward transfer

5.1 General authorisation. The Customer gives Izini general written authorisation to engage Sub-processors, subject to this clause.

5.2 Current Sub-processors. The Sub-processors engaged as at the effective date are listed in Annex 3.

5.3 Terms imposed. Izini will engage each Sub-processor under a written contract imposing data protection obligations no less protective than those in this DPA, insofar as applicable to the service provided.

5.4 Izini remains liable. Izini remains fully liable to the Customer for the performance of each Sub-processor's obligations, as though the acts and omissions were Izini's own.

5.5 Change notice. Izini will give the Customer at least thirty (30) days' notice before adding or replacing a Sub-processor, by email to the Customer's account contact or by in-product notice.

5.6 Objection. The Customer may object to a proposed Sub-processor on reasonable data protection grounds within fourteen (14) days of that notice. The Parties will discuss the objection in good faith and Izini will seek a workable accommodation, which may include configuring the Services so that the objecting Customer's data is not processed by that Sub-processor, where that is technically possible.

5.7 Limits of an objection. The Customer acknowledges that where a change originates with an upstream provider on which the Services depend, Izini may have no ability to prevent or reverse it, and that Izini's own objection rights against that provider may be shorter than the period in clause 5.6. Where Izini cannot accommodate an objection, the Customer may terminate the affected part of the Services on written notice and Izini will refund Fees prepaid for the unused period. That termination right is the Customer's sole remedy for an objection, and an objection does not oblige Izini to block or delay the change.

5.8 Emergency replacement. Where a Sub-processor must be replaced urgently to preserve the security or continuity of the Services, Izini may do so before the notice period expires, and will inform the Customer as soon as reasonably practicable.

6. Personal data breach escalation and cooperation

6.1 Notification. Izini will notify the Customer of a Reportable Breach affecting Customer Personal Data without undue delay after becoming aware of it and, where feasible, within forty-eight (48) hours, so that the Customer retains time within its own statutory reporting window to assess and report.

6.2 When Izini becomes aware. For the purpose of clause 6.1, Izini becomes aware of a breach when a member of Izini's personnel has actual knowledge of it. Where a breach occurs at a Sub-processor, Izini becomes aware when the Sub-processor notifies Izini, and the period in clause 6.1 runs from that notification rather than from the underlying incident. Izini imposes notification obligations on its Sub-processors under clause 5.3 and Annex 4, but does not warrant that a Sub-processor will detect or report a breach within any particular period.

6.3 What is reportable. A "Reportable Breach" is a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Customer Personal Data, including unauthorised internal access. It does not include unsuccessful or trivial events that do not compromise the security of Customer Personal Data — such as port scans, pings, failed login attempts, blocked broadcast or denial-of-service traffic, or attempts repelled by a control operating as intended. Izini will not issue a notification under clause 6.1 for such events, and their exclusion is not a waiver of Izini's obligation to log and monitor them.

6.4 Content. The notification will describe, to the extent known at the time: the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for further information. Where the full picture is not yet available, Izini will notify on the basis of what is known and supplement it as the investigation progresses, rather than delay notification to complete the picture.

6.5 Cooperation. Izini will cooperate with the Customer and take the reasonable steps the Customer directs to assist in the investigation, mitigation and remediation of the breach, and will provide the information the Customer reasonably needs to meet its own obligations to the NDPC and to data subjects.

6.6 No admission. Izini's notification of a breach is not an acknowledgement of fault or liability.

6.7 Customer's own duty. Notification to the NDPC and to affected data subjects is the Customer's responsibility as Controller. Izini will not notify the NDPC or any data subject on the Customer's behalf unless the Customer instructs it in writing to do so, or Izini is independently required by law.

7. Assistance with data subject rights

7.1 Functionality first. The Services include functionality enabling the Customer to retrieve, correct, restrict, export and delete Customer Personal Data, and to manage data subject requests through the DSAR module. The Customer will use that functionality in the first instance.

7.2 Requests received by Izini. If Izini receives a request from a data subject relating to Customer Personal Data, it will not respond to the substance of the request, except to acknowledge receipt and direct the data subject to the Customer. Izini will forward the request to the Customer without undue delay.

7.3 Further assistance. Taking into account the nature of the processing, Izini will provide reasonable assistance by appropriate technical and organisational measures, insofar as possible, to help the Customer fulfil its obligation to respond to data subject requests. Where assistance goes materially beyond the functionality of the Services, Izini may charge at its then-current professional services rates, having told the Customer in advance.

7.4 Regulator and third-party demands. If Izini receives a binding demand from a regulator, court or law enforcement body for Customer Personal Data, it will, unless legally prohibited, notify the Customer before disclosing, and will disclose only the minimum required.

8. Audit and demonstration of compliance

8.1 Information on request. Izini will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, and will respond to a reasonable data protection questionnaire not more than once in any twelve (12) month period.

8.2 Evidence pack. Izini will maintain and provide on request a compliance evidence pack comprising its then-current technical and organisational measures, its Sub-processor list, a summary of its breach history in the relevant period, and any third-party security assessment or certification it holds.

8.3 Sub-processor assurance. Where Izini holds a current audit report, certification or security assessment issued in respect of a Sub-processor — including SOC 2, ISO 27001 or an equivalent report — Izini will make it available to the Customer on request, subject to any confidentiality restriction the issuer or Sub-processor imposes. Where Izini holds a contractual audit right against a Sub-processor, it will consider in good faith a reasonable written request from the Customer that it exercise that right, and will share the outcome. Izini is not obliged to exercise a right where doing so would be disproportionate to the risk.

8.4 Remote verification session. Where the evidence provided under clauses 8.1 to 8.3 does not satisfy a requirement to which the Customer is subject, the Customer may request a remote verification session, which Izini will provide once in any twelve (12) month period on thirty (30) days' written notice. In that session, conducted by video conference and screen share, Izini will demonstrate the operation of the measures in Annex 2 as they actually run — including the list of accounts holding production access, the tenant isolation policies, access and audit logs, the change and deployment process, and evidence sampled against items the Customer nominates in advance. The Customer may have its own personnel or a mandated third-party auditor attend, subject to clause 8.7.

8.5 What is not permitted. The Customer may not obtain credentials for, directly access, scan or conduct penetration or vulnerability testing against Izini's production environment or any environment containing live Customer Personal Data — whether itself or through an auditor. The reason is not convenience: the Services are multi-tenant, and production holds personal data for which other controllers are responsible. Izini cannot expose those controllers' data to a third party, and applies the same protection to the Customer's own data. Testing against a sandbox or dedicated test environment may be agreed separately in writing.

8.6 Regulator-compelled access. Where a competent regulator or court having jurisdiction over the Customer compels an inspection going beyond clauses 8.1 to 8.4, Izini will cooperate to the extent legally required, and the Parties will agree in advance the scope, timing and any measures needed to protect other controllers' data.

8.7 Conditions. Any information provided under this clause is Izini's confidential information and is subject to clause 15 of the Terms. A third-party auditor must not be a competitor of Izini and must be bound by confidentiality obligations no less protective than clause 15. Audits must be conducted during Izini's normal business hours and in a manner that does not materially disrupt its operations. The Customer bears its own costs, and will reimburse Izini's reasonable costs where a request materially exceeds the scope described above.

8.8 Direct claims against Sub-processors. The Customer's rights under this clause are exercised against Izini only. Nothing in clause 8.3 gives the Customer a direct right of audit, inspection or claim against a Sub-processor, and Izini is not obliged to procure one where it does not already hold it.

9. Cross-border data transfers

9.1 Disclosure. The Customer acknowledges and instructs that Customer Personal Data is hosted and processed outside Nigeria. The primary hosting region is Zurich, Switzerland, where Customer Personal Data is stored and primarily processed. Other Sub-processors process Customer Personal Data in the locations identified in Annex 3, and content delivery is performed from globally distributed edge locations.

9.2 Instruction. The Customer's acceptance of the Terms and its use of the Services constitute its instruction to Izini to make those transfers.

9.3 Basis for transfer. Transfers are made on the basis of adequate safeguards secured by binding contractual terms, as set out in Annex 4, which Izini imposes on itself and on each Sub-processor that receives Customer Personal Data outside Nigeria. Izini does not rely on an adequacy determination by the NDPC, and the validity of these transfers does not depend on one being made.

9.4 Maintenance of safeguards. Izini will keep the safeguards in Annex 4 under review and will update them as necessary to reflect changes in the NDPA, the GAID or NDPC guidance. Where safeguards can no longer be maintained in respect of a recipient, Izini will suspend transfers to that recipient and, if the affected processing is essential to the Services, will tell the Customer and allow it to terminate the affected part without penalty.

9.5 Onward transfer. No Sub-processor may transfer Customer Personal Data onward to a further recipient outside Nigeria except under safeguards at least equivalent to those in Annex 4.

9.6 Customer's own assessment. The Customer remains responsible for its own transfer impact assessment where its regulator or internal policy requires one. The Services include a Transfer Impact Assessment module for that purpose; Izini's provision of that module is not an assessment of the Customer's transfers.

10. Return and deletion on termination

10.1 Export window. For thirty (30) days after termination or expiry of the Terms, the Customer may export Customer Personal Data using the export functionality in the Services, or request Izini's assistance at [email protected].

10.2 Deletion. After that period, Izini will delete or irreversibly anonymise Customer Personal Data within a further sixty (60) days. It is the Customer's responsibility to export what it needs within the export window.

10.3 Backups. Customer Personal Data contained in routine backups is deleted on Izini's ordinary backup expiry cycle. Until it is, it remains subject to this DPA and is not accessed except to restore service or as required by law.

10.4 Legal retention. Izini may retain Customer Personal Data to the extent and for as long as required by a law to which it is subject, and will retain it only for that purpose, subject to this DPA for as long as it is held.

10.5 Certification. Izini will certify deletion in writing on the Customer's request.

10.6 Survival of this DPA. Notwithstanding termination or expiry of the Terms, this DPA remains in force, and continues to bind Izini, until Izini has deleted or irreversibly anonymised all Customer Personal Data in accordance with this clause — at which point it automatically expires, save for clause 4.5, which continues indefinitely.

11. Liability

11.1 Each Party's liability under or in connection with this DPA is subject to the exclusions and the aggregate cap in clause 21 of the Terms. This DPA does not create a separate or additional cap, and liability under this DPA and under the Terms counts towards the same aggregate cap.

11.2 For the avoidance of doubt, clause 21.3 of the Terms applies: Izini is not liable for administrative fines or penalties imposed on the Customer by the NDPC or another regulator, except to the extent directly caused by Izini's breach of this DPA, and then only within the cap in clause 21.4 of the Terms.

12. Governing law and disputes

12.1 This DPA is governed by the laws of the Federal Republic of Nigeria.

12.2 Disputes arising out of or in connection with this DPA are resolved under clause 25 of the Terms — good-faith escalation, then arbitration under the Arbitration and Mediation Act 2023, seated in Lagos.

13. Special conditions and sector-specific terms

13.1 Where the Customer is subject to sector-specific regulation that imposes requirements on its processors beyond the NDPA — including Central Bank of Nigeria directives applicable to financial institutions, or NAICOM, NCC or sectoral guidance — those requirements do not bind Izini unless agreed in a written addendum signed by both Parties.

13.2 The Customer will tell Izini before onboarding if it is subject to such requirements, so that the Parties can agree whether an addendum is needed.

13.3 Nothing in this clause limits Izini's obligations under the NDPA as a processor.

14. Order of precedence and variation

14.1 Where this DPA conflicts with the Terms on the subject of personal data processing, this DPA prevails. On all other subjects the Terms prevail.

14.2 Where a signed Order Form or enterprise agreement expressly varies this DPA, that variation prevails for that Customer.

14.3 Izini may update this DPA on thirty (30) days' notice where the update is required by a change in law, by NDPC guidance, or to reflect a change in Sub-processors or measures that does not materially reduce protection. Any other variation requires the Customer's agreement.

Annex 1 — Particulars of processing

Categories of personal data

• Consent and preference data — a randomly generated device identifier, consent state per purpose or category, timestamp, browser user-agent string, language, and approximate country or region; and, for consent topics and SDK integrations, the user identifier the Customer sends.
• Data subject request data — where the Customer operates the DSAR or grievance modules, the identity and contact details of the requester and the content of the request and its handling, as supplied by the data subject or the Customer.
• Compliance record content — personal data the Customer chooses to enter into its registers, assessments, policies, training records, incident records and evidence, including the names and contact details of its own staff, its data protection officer, its vendors' contacts, and third parties named in an incident or assessment.
• Customer personnel account data — where Customer staff, guest collaborators or channel partner personnel hold Workspace accounts: name, email address, role and access log. Note: Izini processes this as Controller for account administration and as Processor insofar as it forms part of the Customer's own records.

Categories of data subjects

• End Users of the Customer's websites, applications and other digital surfaces.
• Data subjects who submit requests or grievances to the Customer.
• The Customer's personnel, contractors, advisers and guest collaborators.
• Individuals named by the Customer in its compliance records, including vendor contacts and individuals involved in an incident.

Special category data. The Services are not designed for, and the Customer should not enter, sensitive personal data as defined by the NDPA, except where a data subject request or an incident record unavoidably contains it. The Customer is responsible for minimising such content.

Annex 2 — Technical and organisational measures

Access control and tenant isolation

• Multi-tenant data is isolated at the database level by row-level security policies, enforced by the database engine rather than by application code alone.
• Role-based access within a Workspace, with Manager, Admin and Super Admin roles and configurable permissions, controlled by the Customer.
• Guest collaborator and channel partner access is scoped and granted by the Customer, and revocable by the Customer at any time.
• Authentication is provided by the platform's managed identity service, with password hashing and session management handled by that service.
• Access to production data is limited to a single named individual, a director of Izini. No other person holds production credentials, and there is no standing access for contractors or third parties.
• Administrative actions taken in the platform console are recorded by the platform provider's audit trail.

Encryption

• Personal data is encrypted in transit using TLS between all components: end user device, edge delivery network, application, and database.
• Secrets and API credentials are held in the platform secret stores rather than in source code or configuration files.
• Personal data is encrypted at rest by the database platform using AES-256, including backup copies, with encryption keys protected by FIPS 140-2 compliant hardware security modules. (Evidenced by the Supabase DPA, Schedule 1.)

Data minimisation

• Consent capture is designed to avoid directly identifying End Users: the banner uses a randomly generated device identifier rather than a name, email address or account identifier.
• Usage metering counts an Identified User once per calendar month against a one-way hash of the identifier, and does not retain a browsing history.

Logging and monitoring

• Application error and performance monitoring, with alerting.
• An audit module recording material actions taken within a Workspace.

Resilience and continuity

• Daily managed database backups operated by the database platform, encrypted in transit and at rest, held on storage independent of the project resources. (Evidenced by the Supabase DPA, Schedule 1.) Backups are retained in accordance with the database platform's schedule for Izini's plan.
• Edge delivery of the consent widget from a globally distributed network, so that consent capture degrades gracefully if a single region is unavailable.

Secure development and assurance

• Changes to the database schema are applied through reviewed, version-controlled migrations.
• Dependency vulnerability alerting on the source repository.
• Izini does not hold an independent security certification of its own. The certifications held by its principal Sub-processor are described in Annex 3.

Workstation and endpoint security

Izini operates without business premises. Production access is exercised only from devices under Izini's control, which are treated as in scope for this annex.

• Production credentials and secrets are held in the platform secret stores rather than in plain text.
• No production access is exercised from a shared or public device.

Personnel and segregation of duties

• Confidentiality obligations bind every person with access to Customer Personal Data, under contract or by virtue of their office as a director.
• Izini is a single-operator organisation. Segregation of duties, four-eyes approval of production change, and independent internal review are therefore not available, and Izini does not claim them. This is stated plainly because an omission would mislead. The compensating controls are: an audit trail maintained by the platform provider and outside Izini's unilateral control; version-controlled, reviewed database migrations that leave a durable history of every schema change; and the platform-level controls of the principal Sub-processor described in Annex 3, which are subject to SOC 2 Type 2 and ISO 27001 assurance and are not administered by Izini.
• Background screening is not applicable to a sole director operating the company.

Annex 3 — Sub-processors

As at the version date of this DPA. Changes are notified under clause 5.5, and this Annex is updated when they take effect.

Support chat runs on Chatwoot software hosted by Izini at helpdesk.izini.ng; it processes the identity and message content of the Customer's support contacts as part of Izini's own support function.

Assurance held for Supabase

Supabase is Izini's principal Sub-processor and the only one that holds the full corpus of Customer Personal Data. Izini's engagement with it is governed by the Supabase Data Processing Addendum (Version 1, 1 August 2026), under which Izini holds the following, available to the Customer under clause 8.3:

• Certifications — SOC 2 Type 2 and ISO 27001.
• Encryption — AES-256 at rest on all disks and backups, with keys protected by FIPS 140-2 compliant HSMs; TLS 1.2 with modern cipher suites in transit.
• Backups — daily by default, encrypted in transit and at rest, on storage independent of the project.
• Access control — least privilege via a central identity provider, mandatory non-SMS two-factor authentication for personnel, second-person approval for infrastructure change, and audit trails of interactions with customer projects.
• Testing — regular third-party penetration testing, and a breach response plan that is tested and updated.
• Breach notification to Izini — without undue delay and, where feasible, within 48 hours, which is the constraint reflected in clause 6.2.
• Transfer mechanism — Supabase's Data Processing Addendum incorporates standard contractual clauses for international transfers.

These are Supabase's controls, not Izini's. They are recorded here as the safeguard for this Sub-processor under Annex 4, and are not representations about Izini's own measures, which are in Annex 2.

Note. Analytics and marketing tools on izini.ng — Google Tag Manager, Google Analytics, Hotjar and Typeform — process data about visitors to Izini's own marketing site. Izini is Controller for that processing and it falls under the Privacy Policy, not this DPA. They are listed here only to avoid the impression of omission.

Annex 4 — Contractual safeguards for transfers outside Nigeria

These safeguards are the basis on which Customer Personal Data is transferred outside Nigeria under clause 9. Izini imposes each of them on itself, and secures equivalent commitments from each Sub-processor that receives Customer Personal Data outside Nigeria.

A4.1 Purpose limitation. The recipient processes the transferred data only for the purposes set out in Annex 1, and only on the Customer's documented instructions as relayed by Izini.

A4.2 Security. The recipient applies technical and organisational measures at least equivalent to those in Annex 2, and notifies Izini of a personal data breach without undue delay, so that Izini can meet clause 6.1.

A4.3 Confidentiality. The recipient ensures that persons authorised to process the data are bound by enforceable confidentiality obligations.

A4.4 Onward transfer restriction. The recipient does not transfer the data to a further recipient outside Nigeria except under safeguards at least equivalent to these, and not at all to a recipient in a jurisdiction where it cannot maintain them.

A4.5 Data subject rights. The recipient assists in giving effect to the rights of data subjects under the NDPA, including access, rectification, erasure, restriction, objection and portability, and does not obstruct a data subject's exercise of those rights.

A4.6 Government access. The recipient notifies Izini of any binding demand for the data by a public authority, unless legally prohibited; challenges a demand that appears unlawful or disproportionate; and discloses only the minimum required. The recipient will not grant a public authority direct or unfettered access to the data.

A4.7 Third-party rights and redress. Data subjects may enforce A4.1 to A4.6 against Izini as intended third-party beneficiaries. Izini remains accountable to the Customer, and through the Customer to data subjects, for the recipient's compliance, and does not require a data subject to pursue a foreign recipient directly in order to obtain redress.

A4.8 Governing law of the safeguards. These safeguards are governed by Nigerian law and disputes about them are resolved under clause 12, so that a data subject or the Customer is not compelled into a foreign forum to enforce them.

A4.9 Suspension and termination. Where a recipient can no longer comply with these safeguards, Izini suspends transfers to it and terminates the engagement if compliance cannot be restored, and gives the Customer the rights in clause 9.4.

A4.10 Review. Izini reviews these safeguards at least annually, and on any material change to the NDPA, the GAID or NDPC guidance on cross-border transfers.

Contact

Izini RegTech Ltd (RC-9700347), [registered office address], Lagos, Nigeria

© 2026 Izini RegTech Ltd. All rights reserved.