Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is entered into by and between Kuza, the provider of the Kuza business platform (the "Processor", also "Kuza", "we", "us" or "our"), and the business using the platform (the "Controller", also "you").

This DPA is an addendum to, and forms part of, the Kuza Terms of Service / Master Subscription Agreement ("Main Agreement") governing your use of the Kuza platform. Where this DPA conflicts with the Main Agreement on the handling of personal data, this DPA applies.

You accept this DPA when you create an account and complete onboarding. We record the date and time of that acceptance against your account.

In this DPA, the following terms have the meanings below:

• "Applicable Data Protection Law" means the Nigeria Data Protection Act (NDPA), the Nigeria Data Protection Regulation (NDPR), and any other data privacy laws, guidelines or directives issued by the Nigeria Data Protection Commission (NDPC).
• "Personal Data", "Data Subject", "Processing", "Controller" and "Processor" have the meanings given to them under the NDPA.
• "Customer Data" means any personal data uploaded, stored or processed by you or your end-users through the Kuza platform.

• 3.1 Roles. With respect to the processing of Customer Data within the Kuza platform, you, the business customer, are the Data Controller and Kuza is the Data Processor.
• 3.2 Purpose of processing. We process Customer Data solely on your behalf and in accordance with your documented instructions, including processing necessary to provide, maintain and improve the platform features described in the Main Agreement.
• 3.3 Compliance with law. Both parties shall comply with all obligations applicable to them under the NDPA.

As the Data Processor, we agree to:

• 4.1 Personnel confidentiality. Ensure that all employees, contractors and personnel authorised to handle Customer Data are bound by strict confidentiality obligations.
• 4.2 Security measures. Implement and maintain appropriate technical and organisational measures designed to protect Customer Data against unauthorised or unlawful processing, accidental loss, destruction, alteration or disclosure.
• 4.3 Data subject rights. Reasonably assist you, through automated platform features or technical support, in responding to requests from Data Subjects exercising their rights under the NDPA, including rights of access, rectification and deletion.
• 4.4 Regulatory audits. Make available to you the information reasonably necessary to demonstrate compliance with this DPA, and allow for or contribute to reasonable privacy reviews or questions about the security posture of the platform.

• 5.1 Appointment of sub-processors. You grant Kuza general authorisation to engage third-party sub-processors to host or support the platform.
• 5.2 Core sub-processors. You acknowledge and approve the use of the following core infrastructure partners:
• Base44 — cloud infrastructure, application hosting and deployment, database hosting, and technical maintenance of the platform.
• Paystack (or its local equivalents) — secure payment processing and financial transaction tokenisation.
• 5.3 Cross-border data transfer. You acknowledge that we use international cloud infrastructure hosted by Base44, and that Customer Data may therefore be stored and processed outside Nigeria. We ensure that such cross-border storage relies on cloud provider regions and contractual safeguards that maintain robust legal, technical and security protections satisfying the adequacy and safeguard requirements recognised under the NDPA.
• 5.4 Flow-down requirements. We shall ensure that any sub-processor we engage is bound by data protection obligations at least as restrictive as those established under this DPA.

• 6.1 Notification timeline. In the event of a confirmed security incident leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of Customer Data, we shall notify you without undue delay, and where feasible within 48 hours of becoming aware of the breach.
• 6.2 Remediation. We shall take immediate and reasonable steps to mitigate the effects of the breach, and cooperate with you to provide the information you need to meet your reporting obligations to the NDPC.

7.1 Deletion or return. Upon termination or expiry of the Main Agreement, we shall, at your choice, delete or return all Customer Data stored within the Kuza database, unless applicable Nigerian laws or regulatory obligations require the continued retention of certain records.

7.2 Export before closure. You may export your records at any time while your account is open. We recommend exporting anything you need to keep before closing your account.