Izini — Terms of Use

Izini RegTech Ltd (RC-9700347)

Version: 2026-10-07

Last updated: 7 October 2026

1. Who we are and what this document is

These Terms of Use ("Terms") are a binding agreement between Izini RegTech Ltd, a company incorporated in the Federal Republic of Nigeria with registration number RC-9700347, whose registered office is at [registered office address], Lagos, Nigeria ("Izini", "we", "us", "our"), and the organisation that registers for, accesses or uses the Izini platform ("you", "your", "Customer").

You accept these Terms by ticking the box to accept them when you create an account, or by accepting them when the Services ask you to. Installing the Izini widget or SDK, calling our API, or otherwise using the Services also constitutes acceptance. If you do not agree, do not use the Services.

The individual who accepts these Terms represents that they have authority to bind the organisation for which the account is created, and "you" means that organisation. Where a channel partner or another person creates a Workspace for you, these Terms bind you from the moment any of your Authorised Users accepts them.

These Terms apply together with:

• the Data Processing Addendum ("DPA"), which governs our processing of personal data on your behalf and forms part of this agreement;
• the Izini Privacy Policy, which describes how we handle personal data for which we are the controller;
• any Order Form, plan selection, quotation or written statement of work agreed between us.

Where there is a conflict, the order of precedence is: (1) a signed Order Form or enterprise agreement, (2) the DPA, on the subject of personal data processing, (3) these Terms, (4) any other policy or documentation.

2. Definitions

"Controller", "processor", "personal data", "data subject" and "processing" have the meanings given in the NDPA.

3. The Services

Izini is a regulatory technology platform for organisations with obligations under the NDPA and comparable regimes. Depending on your plan, the Services may include:

(a) Consent management. A configurable consent banner delivered as a lightweight widget from our content delivery network, mobile SDKs, multilingual consent notices, a consent register, cross-surface consent synchronisation, and an automated cookie scanner.

(b) Compliance modules. Tooling for records of processing activities, impact and legitimate interest assessments, transfer impact assessments, data subject requests and grievance handling, breach and incident registers, risk registers, vendor due diligence and processor agreements, staff training records, policy and privacy notice generation, and the compliance audit workbench and evidence pack exporter.

(c) Developer surfaces. APIs, signed webhooks, a sandbox environment and integration guides.

(d) Partner surfaces. Where you are a channel partner or a data protection compliance organisation, a portfolio view of the client Workspaces to which you have been granted access.

We may add, change, improve or discontinue features. Where we discontinue a material feature you rely on, we will give you at least thirty (30) days' notice by email or in-product message, except where a shorter period is required for security, legal or supplier reasons.

4. Business use and eligibility

4.1 Business use only. The Services are provided only for business, professional or organisational purposes. They are not offered to consumers, and you must not register or use them for personal, family or household purposes.

4.2 Eligibility. The individual registering must be at least 18 years old and authorised to act for the organisation. You must register with accurate, current and complete information and keep it up to date. We may refuse, suspend or close an account where the information given is false, incomplete or misleading.

5. Accounts, users and credentials

5.1 Roles. The Services support role-based access with configurable permissions. You are responsible for assigning roles appropriately and reviewing them.

5.2 Seats. Your plan sets the number of team seats and projects available to you. You must not share a single set of credentials among multiple individuals.

5.3 Security of credentials. You are responsible for keeping credentials, API keys and project codes confidential, and for all activity under your Workspace, whether or not authorised by you. Tell us at [email protected] without undue delay if you suspect any compromise.

5.4 Your responsibility for Authorised Users. You are responsible for your Authorised Users' acts and omissions in connection with the Services as if they were your own.

6. Guest collaborators and channel partners

6.1 Guest access. The Services allow you to invite external parties — including a licensed data protection compliance organisation, auditor or adviser — into your Workspace as a Guest Collaborator with scoped, time-limited access. You decide who to invite, what they may see and for how long, and you are responsible for that decision.

6.2 Client-granted partner access. Where a channel partner or compliance organisation administers the Services for you, its access to your Workspace exists only because you granted it. You may withdraw that grant at any time from your Workspace settings. Izini is not a party to the engagement between you and your partner, does not supervise their work, and is not responsible for it.

6.3 Partners' own obligations. If you are a channel partner or reseller, you must hold a valid, current grant from each client Workspace you access, use client data only to perform the service that client engaged you for, and comply with any partner agreement in place between us. You must not represent yourself as Izini, nor make commitments on our behalf.

6.4 We are not your DPCO or DPO. Izini supplies software. Unless we have signed a separate written engagement saying otherwise, Izini does not act as your data protection officer, does not act as your data protection compliance organisation, and does not file returns or make representations to the Nigeria Data Protection Commission or any other regulator on your behalf.

7. Plans, fees, metering and payment

7.1 Free trial. We may offer a free trial of the length shown when you sign up. If you have not subscribed to a paid plan by the end of the trial, we may suspend or restrict the Services. We may change or withdraw trial terms for future sign-ups.

7.2 Plans. We offer monthly subscriptions, yearly subscriptions and custom enterprise arrangements. Every plan includes all compliance modules; plans differ in their monthly allowances of Identified Users, Banner Interactions and AI Requests, their team seats and their project quota. Yearly plans are billed annually in advance, but allowances reset monthly. Fees are stated on our pricing page or in your Order Form and are in Nigerian Naira (NGN) unless agreed otherwise.

7.3 How we count usage. Allowances run per calendar month (UTC) and reset on the first day of each month. Your current usage is shown in your billing settings, and our records of usage are the authoritative record, absent manifest error.

(a) Identified Users are counted once per calendar month per organisation, however many times and through however many channels the same person appears. For counting, we use a one-way hash of the identifier you send. End Users who only interact with your cookie banner are not Identified Users. Requests made with sandbox API keys, and requests submitted through the public DSAR web form, are not counted.

(b) Banner Interactions are counted each time a choice is recorded. Requests we identify as coming from automated agents such as bots and crawlers are not counted.

(c) AI Requests are counted once per use of an AI-assisted feature, and only when the feature returns a result.

7.4 Exceeding an allowance. Exceeding an allowance does not stop consent withdrawals or the intake of data subject requests. We aim to notify you as you approach and pass each allowance; a missed or late notice does not change your allowance or your obligations.

(a) Identified Users. Exceeding the allowance does not stop consent recording, consent withdrawal or the intake of data subject requests. If your usage exceeds the allowance in two consecutive calendar months, we may pause the creation of new projects, the addition of team seats and AI Requests until you move to a plan that covers your usage. Sustained excess usage after notice may be treated as a material breach under clause 18.2.

(b) Banner Interactions. When the allowance is reached we continue recording for a grace period of seven (7) days, up to twice the allowance. After that, until the allowance resets, your cookie banner continues to display and to apply each End User's choice, but new choices are not recorded by the Services. You are responsible for any resulting gap in your consent records; upgrading resumes recording.

(c) AI Requests. When the allowance is used up, AI-assisted features are unavailable until it resets or you upgrade.

(d) Fair use. We may apply reasonable rate limits to any part of the Services to protect their availability for all customers.

7.5 Payment. Payments are processed by Paystack. By paying, you accept Paystack's own terms for that transaction. We do not store your full card details.

7.6 Renewal. Subscriptions renew automatically for successive periods of the same length unless either of us gives notice of non-renewal before the end of the then-current period. You may cancel renewal at any time from your billing settings; cancellation takes effect at the end of the paid period.

7.7 Refunds. Fees are non-refundable, except as stated in clause 23 or where Nigerian law expressly requires otherwise.

7.8 Price changes. We may change our Fees on at least thirty (30) days' notice, effective from your next renewal. If you do not accept a price change, you may cancel before it takes effect.

7.9 Taxes. Fees are exclusive of value added tax and any other applicable taxes, levies or withholdings, which you must pay in addition. If you are required by law to withhold any amount, you will gross up the payment so that we receive the amount we would have received had no withholding applied.

7.10 Late payment and suspension. If payment fails or is overdue, we may suspend the Services on notice. Suspension for non-payment does not relieve you of accrued Fees.

8. Acceptable use

You must not, and must not permit any Authorised User or End User to:

(a) use the Services in breach of the NDPA, the Cybercrimes (Prohibition, Prevention, etc.) Act, or any other applicable law or regulation;

(b) upload or process personal data without a valid lawful basis, or in a way you know or ought reasonably to know is unlawful;

(c) use the Services to send unsolicited communications, or to build a marketing list from consent data in a way inconsistent with the consent obtained;

(d) misrepresent consent — including configuring the banner so that it records consent that was not freely given, specific, informed and unambiguous, or so that it suppresses or overrides an End User's refusal or withdrawal;

(e) reverse engineer, decompile or disassemble any part of the Services, except to the extent that restriction is unenforceable under applicable law;

(f) copy, resell, sublicense, white-label or make the Services available to any third party, except as a channel partner under a written partner agreement with us;

(g) circumvent or tamper with usage metering, quotas, rate limits or access controls;

(h) probe, scan or test the vulnerability of the Services, or breach or circumvent any security or authentication measure, other than under a security testing programme we have authorised in writing;

(i) introduce malware, or use the Services to distribute unlawful, defamatory, infringing or harmful content;

(j) place unreasonable load on the Services, including through automated querying beyond documented rate limits;

(k) use the Services, or any output from them, to build or train a competing product, or to benchmark for publication without our written consent.

We may investigate suspected breaches and may suspend access where we reasonably believe a breach creates a risk to the Services, to other customers, to End Users or to us.

9. Cookie scanning and domain authorisation

The cookie scanner visits and analyses web properties you nominate. You may only scan a domain that you own or that you are authorised in writing to scan. You warrant that you hold that right for every domain you submit, and you indemnify us against claims arising from a scan of a domain you were not entitled to submit. We may decline or stop a scan at our discretion.

10. Deployment on your properties

10.1 Your configuration. You are responsible for the content and configuration of your consent notices, cookie categories, banner text, translations, retention settings and privacy notices, and for whether they satisfy your legal obligations. Our defaults, templates, category taxonomies and suggested wording are starting points, not determinations.

10.2 Correct installation. You are responsible for installing the widget or SDK correctly, for wiring your tags and trackers to honour consent signals, and for testing that they do. The Services can record and broadcast a consent decision; they cannot prevent a script on your property from firing if your property is not configured to respect that signal.

10.3 Delivery of the widget. The widget is delivered from a content delivery network. You must not self-host, modify or proxy the widget except as we document, as doing so can break consent capture and our ability to support you.

11. Data protection

11.1 Roles. In respect of consent records and the compliance data you process through your Workspace, you are the controller and Izini is your processor. In respect of your account, billing, support and usage data, Izini is the controller, and our Privacy Policy applies.

11.2 The DPA governs. Our processing on your behalf is governed by the DPA, which sets out the subject matter, duration, nature and purpose of processing, the categories of data and data subjects, our security measures, our obligations on breach notification and assistance, and the terms on which we engage sub-processors. The DPA is incorporated into these Terms.

11.3 Your obligations as controller. You must have a lawful basis for the personal data you process through the Services, provide required notices to data subjects, respond to data subject requests (the Services assist you; they do not discharge the duty), and give us lawful and documented instructions.

11.4 What the consent banner records. The banner identifies a browser by a randomly generated identifier stored on the End User's device; it is not derived from the End User's name, email address or account. With each recorded choice the Services store the consent state, a timestamp, and technical information sent by the browser, including its user-agent string, language and approximate country or region. Identifiers you send through the SDKs, the consent topics API or the DSAR Enterprise Gateway are stored as you send them. You must not configure the Services, or use custom fields, to send directly identifying personal data into consent records unless you have a lawful basis to do so.

11.5 Sub-processors. We use third-party providers to deliver the Services, including providers of database and authentication services, content delivery, AI models, email, error monitoring, cookie scanning, payments, workflow automation and data source integrations. The current list, their locations, and the process for notifying you of changes and for objecting, are set out in the DPA.

11.6 Location of processing. Customer Data is hosted outside Nigeria, and some sub-processors process it in other countries. Transfers are made on the basis set out in the DPA.

11.7 Breach. We will notify you of a personal data breach affecting Customer Data within the period set out in the DPA, and will provide the information you reasonably need to meet your own notification obligations to the Nigeria Data Protection Commission and to data subjects.

12. AI-assisted features

Parts of the Services use large language models provided by a third party to draft, summarise, classify, extract or suggest — for example in the privacy policy generator, the records-of-processing assistant, impact and transfer assessments, processor agreement drafting and compliance guidance.

You acknowledge that:

(a) AI output is generated automatically and can be incomplete, outdated or wrong;

(b) every AI-generated document, register entry, assessment or recommendation must be reviewed by a competent human before you rely on it, publish it, file it or send it to a regulator or data subject;

(c) you remain solely responsible for anything you adopt, publish or submit, whatever its origin;

(d) content you submit to an AI feature is sent to our AI sub-processor to produce the output, and you must not submit any data you are not permitted to disclose to it under the DPA;

(e) output is not unique to you — similar inputs may produce similar output for other customers — and we make no claim that output is original or free of third-party rights.

13. No legal advice, no guarantee of compliance

Izini is a software provider, not a law firm. Nothing in the Services, the documentation, our templates, our guidance text, our AI output, our support responses or our marketing is legal advice, and no lawyer–client relationship arises between us.

Compliance outcomes depend on your own facts, your decisions and how regulators apply the law. We do not warrant that using the Services will make you compliant with the NDPA or any other law, will prevent enforcement action, penalties or fines, or will produce any particular result in an audit, investigation or inspection. You should take your own professional advice from a qualified Nigerian legal practitioner or licensed compliance organisation.

Statutory dates, fee bands, thresholds, citations and filing requirements shown in the Services are provided for convenience and may be incomplete or change. Verify them against the current instruments and the Commission's published guidance before you rely on them.

14. Intellectual property

14.1 Ours. The Services, and all software, code, designs, templates, question banks, taxonomies, documentation, trade marks and know-how in them, are owned by Izini or our licensors. Subject to these Terms and payment of Fees, we grant you a non-exclusive, non-transferable, revocable right to access and use the Services for your internal business purposes during your subscription term, and to use the widget and SDKs on the digital properties you have registered in your Workspace. All rights not expressly granted are reserved.

14.2 Yours. You retain all rights in Customer Data. You grant us a non-exclusive, worldwide licence to host, copy, transmit, display and process Customer Data solely to provide, secure and support the Services, and as otherwise permitted by the DPA.

14.3 Generated documents. Documents the Services generate for you from your inputs — your privacy notice, your records of processing, your assessments, your evidence pack — are yours to use, subject to clause 12 and to our retained rights in the underlying templates and structures.

14.4 Feedback. If you send us suggestions or feedback, we may use them without restriction or payment, and you grant us a perpetual, irrevocable licence to do so.

14.5 Aggregated data. We may compile de-identified, aggregated statistics about use of the Services to operate, secure, improve and report on them. Aggregated data will not identify you, your Authorised Users or any End User, and we will not disclose it in a form that does.

14.6 Your name and logo. We will not use your name or logo publicly without your prior written consent.

15. Confidentiality

Each party may receive non-public information from the other. The receiving party will use it only to perform this agreement, protect it with at least reasonable care, and not disclose it except to personnel and advisers who need it and are bound by equivalent obligations. This does not apply to information that is public through no breach, was already lawfully held, is independently developed, or must be disclosed by law or court order — in which case the receiving party will, where lawful, give prompt notice. These obligations continue for three (3) years after termination, and indefinitely for personal data and trade secrets.

16. Availability, support and maintenance

16.1 Target availability. We aim for 99.5% monthly availability of the dashboard and the consent API, excluding scheduled maintenance, emergency maintenance, and matters outside our control including failures of upstream providers and networks. This is a target, not a warranty, and no service credits are payable unless agreed in a signed service level agreement.

16.2 Maintenance. We will use reasonable efforts to schedule planned maintenance outside West Africa Time business hours and to give advance notice in-product or by email.

16.3 Support. Support is provided by email at [email protected] and via in-product chat, during business hours on business days in Lagos, at the level applicable to your plan. Response times are targets, not guarantees, unless set out in a signed agreement.

17. Security

We maintain technical and organisational measures appropriate to the risk, as described in the DPA. You must configure your own side securely, including enforcing strong authentication for your Authorised Users, promptly removing leavers, and rotating API keys when a holder's access should end.

18. Suspension, termination and what happens to your data

18.1 By you. You may stop using the Services at any time and cancel renewal from your billing settings. Cancellation takes effect at the end of the paid period; Fees already paid are not refunded.

18.2 By us for cause. We may suspend or terminate on notice if you materially breach these Terms and do not cure the breach within fourteen (14) days of written notice, if you fail to pay when due, if you become insolvent or enter liquidation or administration, or if your use creates a legal risk or a risk to the Services, other customers or End Users.

18.3 Immediate suspension. We may suspend without prior notice where necessary to address an active security incident, a legal requirement, or abuse causing harm, and will tell you as soon as we reasonably can.

18.4 Effect of termination. Access ends. Your widget stops serving consent notices, which means the digital properties relying on it will no longer collect or honour consent through Izini. You are responsible for replacing that function. Accrued Fees remain payable.

18.5 Export and deletion. For thirty (30) days after termination you may export Customer Data using the export functions in the Services, or ask us at [email protected] for assistance. After that period we will delete or irreversibly anonymise Customer Data within a further sixty (60) days, except where we must retain it to comply with law, or in routine backups which are overwritten on our normal cycle and remain subject to the DPA until they are. It is your responsibility to export what you need within the export period.

18.6 Survival. Clauses 7 (as to accrued Fees), 8, 11, 12, 13, 14, 15, 18.4–18.6, 19, 20, 21, 24 and 25 survive termination.

19. Warranties and disclaimers

19.1 Mutual. Each party warrants it has the power and authority to enter into this agreement.

19.2 Ours. We warrant that we will provide the Services with reasonable skill and care, and materially as described in our documentation. Your sole remedy for breach of this warranty is for us to use reasonable efforts to correct the non-conformity, or, if we cannot, for you to terminate the affected Services and receive a refund of Fees prepaid for the unused period.

19.3 Disclaimer. Except as expressly stated in these Terms, and to the fullest extent permitted by law, the Services are provided "as is" and "as available", and we exclude all other warranties, conditions and representations, whether express, implied, statutory or otherwise, including any implied warranty of merchantability, satisfactory quality, fitness for a particular purpose, non-infringement, or that the Services will be uninterrupted or error-free, or that defects will be corrected.

19.4 In particular, we do not warrant that the cookie scanner will detect every cookie, tracker or third-party script on a property; that AI output is accurate, current or complete; that consent signals will be honoured by third-party tags you have not configured correctly; that the Services will satisfy any regulator; or that content in the Services reflects the most recent change in law or regulatory guidance.

20. Indemnity

20.1 By you. You will indemnify and hold harmless Izini, its directors, employees and contractors from and against claims, proceedings, losses, damages, fines and reasonable legal costs arising from: your breach of clauses 8 (acceptable use), 9 (scanning authorisation) or 11.3 (your controller obligations); your Customer Data or your configuration of consent notices; a claim by an End User, a data subject, a regulator or a third party relating to your processing of personal data; or your reliance on AI output or generated documents without the review required by clause 12.

20.2 By us. We will defend you against a third-party claim that the Services, as supplied by us and used in accordance with these Terms, infringe that party's intellectual property rights in Nigeria, and will pay damages finally awarded or agreed in settlement. This does not apply to claims arising from Customer Data, your configuration, use in combination with anything we did not supply, or use in breach of these Terms. If the Services are found or are likely to be found infringing, we may at our option procure the right to continue, modify the Services, or terminate the affected part and refund prepaid Fees for the unused period. This clause states our entire liability for infringement claims and is subject to clause 21.

20.3 Conditions. The indemnified party must notify the other promptly, give sole control of the defence and settlement (no settlement admitting liability without consent, not to be unreasonably withheld), and provide reasonable assistance at the indemnifying party's cost.

21. Limitation of liability

21.1 Nothing excluded. Neither party limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot lawfully be limited.

21.2 Excluded losses. Subject to 21.1, neither party is liable for loss of profits, loss of revenue, loss of anticipated savings, loss or corruption of data, loss of business or goodwill, or for any indirect or consequential loss, however arising.

21.3 Regulatory penalties. Subject to 21.1, Izini is not liable for administrative fines, penalties, sanctions or remediation orders imposed on you by the Nigeria Data Protection Commission or any other regulator, except to the extent they are directly caused by our breach of the DPA, and then only within the cap in 21.4.

21.4 Cap. Subject to 21.1 and 21.5, each party's total aggregate liability arising out of or in connection with this agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the total Fees paid by you to Izini in the twelve (12) months immediately preceding the event giving rise to the claim. While you are on a free trial or have paid no Fees, Izini's total aggregate liability is ₦50,000.

21.5 What the cap does not limit. The cap in 21.4 does not limit your obligation to pay Fees, your liability under clause 20.1, or your liability for breach of clauses 8, 9 or 14.

21.6 Allocation of risk. You acknowledge that the Fees reflect the allocation of risk in this clause, and that we would not provide the Services on these Fees without it.

22. Force majeure

Neither party is liable for failure or delay caused by an event beyond its reasonable control, including acts of God, flood, fire, epidemic, war, civil unrest, terrorism, governmental or regulatory action, industrial action, failure of national power or telecommunications infrastructure, failure of the internet, or failure of an upstream cloud or connectivity provider. The affected party will notify the other and use reasonable efforts to mitigate. If the event continues for more than sixty (60) days, either party may terminate on notice without liability. This clause does not excuse your obligation to pay Fees.

23. Changes to these Terms

We may update these Terms. For material changes we will give at least thirty (30) days' notice by email to your account contact or by prominent in-product notice, and we may ask you to accept the updated Terms in the Services. The change takes effect at the end of the notice period or on your next renewal, whichever is later. Non-material changes — corrections, clarifications, changes required by law — may take effect on posting. Continued use after the effective date is acceptance. If you do not accept a material change, you may terminate before it takes effect and we will refund Fees prepaid for the unused period.

The current version is always available at https://app.izini.ng/legal/terms, with its version date at the top.

24. General

24.1 Entire agreement. These Terms, the DPA, the Privacy Policy and any Order Form are the entire agreement between us on their subject matter, and supersede all prior discussions and representations. Neither party relies on any statement not set out in them, save for fraudulent misrepresentation.

24.2 Assignment. You may not assign or transfer this agreement without our written consent, not to be unreasonably withheld. We may assign to an affiliate, or in connection with a merger, reorganisation or sale of substantially all of our assets, on notice to you.

24.3 Subcontracting. We may subcontract performance, but remain responsible for our subcontractors' performance. Engagement of sub-processors is governed by the DPA.

24.4 No partnership. Nothing creates a partnership, joint venture, agency or employment relationship.

24.5 Third parties. No one other than the parties has any right to enforce these Terms.

24.6 Severability. If a provision is held invalid or unenforceable, it is modified to the minimum extent necessary to make it enforceable, or severed, and the rest remains in force.

24.7 Waiver. A failure or delay in enforcing a right is not a waiver of it.

24.8 Notices. Notices to Izini must be sent to [email protected] and, for formal notices, also to our registered office. Notices to you are sent to your account contact email or given in-product, and are deemed received on the next business day after sending.

24.9 Electronic acceptance. Acceptance by ticking a box or clicking to accept is a valid signature and creates a binding agreement. Our electronic record of acceptance, including the version accepted, the date and time, and the account that accepted, is evidence of your acceptance.

24.10 Language. These Terms are in English. Any translation is for convenience; the English version governs.

25. Governing law and disputes

25.1 Governing law. These Terms and any dispute arising out of or in connection with them, including non-contractual disputes, are governed by the laws of the Federal Republic of Nigeria.

25.2 Escalation. Before starting formal proceedings, the parties will attempt in good faith to resolve the dispute by negotiation between senior representatives for thirty (30) days from written notice of the dispute.

25.3 Arbitration. If the dispute is not resolved, it will be finally settled by arbitration under the Arbitration and Mediation Act 2023, before a sole arbitrator appointed by agreement or, failing agreement within fourteen days, by the Lagos Court of Arbitration. The seat is Lagos, Nigeria, and the language is English. The award is final and binding.

25.4 Interim relief and debt recovery. Either party may seek urgent injunctive or other interim relief from the courts of Lagos State or the Federal High Court, and Izini may bring proceedings in those courts to recover unpaid Fees. The parties submit to their jurisdiction for those purposes and for enforcement of an award.

26. Contact

Izini RegTech Ltd (RC-9700347) [registered office address], Lagos, Nigeria

© 2026 Izini RegTech Ltd. All rights reserved.