Data Processing Agreement (DPA)

1. Scope, Parties & Legal Framework

This DPA establishes the binding contractual framework mandated by Section 31 of the NDPA 2023. Collekt Technologies Ltd serves as the Data Controller determining the purposes and means of processing user information. External service providers that store, transmit, verify, or compute user data act strictly as Data Processors bound by these terms.

2. Processing Instructions & Restrictions

Every Data Processor engaging with Collekt undertakes and covenants that it shall:

• Process personal and corporate data strictly in accordance with documented instructions from Collekt Technologies Ltd.
• Never utilize, monetize, sell, or disclose personal data for the Processor's independent commercial purposes, behavioral marketing, or public AI model training.
• Ensure all personnel authorized to access data are bound by statutory or contractual obligations of strict confidentiality.
• Notify Collekt immediately if any processing instruction infringes upon the NDPA 2023 or other applicable commercial privacy laws.

3. Mandatory Technical & Organizational Security Measures

Pursuant to Section 39 of the NDPA, every Processor must maintain active defense-in-depth safeguards, including:

• Cryptographic Standards: TLS 1.3 encryption for data in transit; AES-256 encryption for data at rest.
• Multi-Tenant Isolation: Logical and architectural separation preventing cross-customer data leakage.
• Access Controls: Enforced Least Privilege, Role-Based Access Control (RBAC), and hardware-backed Multi-Factor Authentication (MFA) for administrative tooling.
• Vulnerability Management: Continuous network monitoring, automated patch deployment, and annual independent penetration tests.

4. Schedule of Authorised Sub-Processors

The following schedule itemizes the authorized cloud hosts, payment rails, banking partners, and verification service providers approved for the Collekt Pilot Programme:

5. Database & Cloud Storage: Supabase Inc.

Supabase acts as Collekt's core persistence layer. Under this DPA, Supabase enforces:

• Automated daily encrypted database backups stored across fault-tolerant availability zones.
• PostgreSQL Row-Level Security (RLS) guaranteeing that direct client database queries are checked against authentic user session tokens.
• Pre-signed URLs with strict 5-minute expiries for private KYC document inspection by authorized compliance personnel.

6. Payment Rails & Virtual Banking: Paystack & Korapay

Paystack Payments Limited and Korapay Technologies Limited operate as licensed payment processors under Central Bank of Nigeria regulations. Specific covenants include:

• Dedicated Virtual Account (DVA) Security: Virtual NUBAN accounts are assigned on a 1-to-1 basis linked to the user's verified identity, preventing account hijacking.
• Cryptographic Webhook Signatures: All payment event notifications dispatched to Collekt must bear valid HMAC-SHA512 signatures calculated against the official secret key. Replay windows exceeding five (5) minutes are automatically rejected.
• Strict Name-Matching: All wallet disbursements are routed through the NIBSS Instant Payments (NIP) validation protocol to confirm the beneficiary name matches the registered profile.

7. Identity Verification Partners (NIMC, CAC, NIBSS, COREN)

Identity verification partners validate high-integrity credentials to establish Shield Verification:

• Tokenization: Gateways must return validation tokens and status flags (e.g. VERIFIED_COREN_MEMBER) rather than transmitting excessive personal records.
• Zero Retention of Raw Biometrics: Raw fingerprint or facial biometric data queried during NIN authentication must never be cached or repurposed by the aggregator.

8. AI Cloud Infrastructure: Google Gemini API

Collekt utilizes enterprise Google Cloud Gemini API endpoints to power Kolly AI. Contractual covenants require:

• No Model Training: Prompt data, engineering drawings, project briefs, and candidate bids submitted to the API are excluded from training public models.
• In-Memory Processing: Processing occurs in volatile memory without secondary disk persistence by the AI provider.

9. 24-Hour Breach Notification Obligation

In the event of any confirmed or reasonably suspected data breach, unauthorized access, or systems compromise affecting Collekt data, the Processor must notify Collekt's Compliance & Data Protection Office in writing at compliance@collektng.com within twenty-four (24) hours of becoming aware. The notice must detail the nature of the incident, categories of data affected, and immediate containment measures executed.

10. Data Return, Deletion & Audit Rights

Upon termination of services or written request by Collekt Technologies Ltd:

• The Processor must securely crypto-shred or return all personal data within thirty (30) calendar days, providing a formal Certificate of Destruction.
• Processors must permit Collekt, its accredited DPCO auditors, or the Nigeria Data Protection Commission (NDPC) to inspect security controls and verify contractual compliance upon reasonable advance notice.