Data Processing Addendum

For Customer Data submitted by or for a business customer into a Zonalia workspace, the customer ordinarily acts as data controller and Aurum acts as data processor to the extent Aurum processes that personal data on the customer's documented instructions to provide the service. Each party remains independently responsible for processing for which it determines its own purposes and means, including Aurum's account administration, security, fraud prevention, legal compliance, billing and service-management processing where Aurum acts as controller under applicable law.

The agreement, the customer's configuration and authorised use of Zonalia constitute documented instructions to process Customer Data as necessary to host, organise, retrieve, transmit, secure, back up, analyse and otherwise provide the contracted trade-operations functionality. Aurum will not process Customer Data for materially unrelated purposes except where required by law, in which case Aurum will notify the customer before processing unless prohibited from doing so.

The customer is responsible for ensuring that its collection and disclosure of personal data to Zonalia is lawful, fair and transparent; that required notices have been provided; that an appropriate lawful basis exists; that instructions comply with applicable law; and that only data reasonably necessary for the trade workflow is submitted. The customer should avoid uploading sensitive or regulated information that is not required for the service.

Processing may include collection, recording, organisation, storage, retrieval, consultation, use, transmission, alignment, restriction, deletion and other operations required to provide workspace, document, counterparty, task, milestone, exception, supplier-control, shipment, reporting, API, security and support functions. The purpose is to provide and secure Zonalia and the customer's configured trade workflows.

Depending on customer use, Customer Data may include business contact details, names, roles, email addresses, telephone numbers, transaction references, supplier or buyer contacts, logistics and broker contacts, correspondence, notes, documents and other information placed into a trade record. Data subjects may include customer personnel, suppliers, buyers, agents, brokers, forwarders, carrier contacts, professional advisers and other persons involved in a transaction.

Zonalia is not designed as a primary repository for biometric data, payment-card credentials, passwords, government identity databases or other high-risk datasets unless Aurum expressly agrees in writing to support that processing.

Aurum will ensure that persons authorised to process Customer Data are subject to appropriate confidentiality obligations and receive access only to the extent reasonably necessary for their functions.

Aurum will maintain reasonable and appropriate technical and organisational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, authentication, encryption in transit and at rest where supported by the relevant infrastructure, logical tenant isolation, logging, least-privilege practices, dependency and infrastructure security controls, backup or recovery measures appropriate to the service, and procedures for responding to security incidents.

No security measure eliminates all risk, and this DPA does not create a guarantee that a security incident can never occur.

The customer authorises Aurum to engage sub-processors reasonably necessary to provide Zonalia, including cloud hosting, database, storage, authentication, communications, monitoring, payment and other infrastructure providers. Aurum remains responsible for imposing data-protection obligations on sub-processors appropriate to the services they perform.

Where a new sub-processor materially changes the processing of Customer Data, Aurum will provide reasonable notice through the service, this DPA, a sub-processor notice or another appropriate channel. An enterprise customer with a contractual objection right may object on reasonable data-protection grounds within the period stated in its agreement.

Where Customer Data is transferred outside Nigeria or another jurisdiction whose transfer rules apply, Aurum will use a lawful transfer mechanism or other safeguards required by applicable law, taking account of the destination, recipient and nature of processing. Where necessary, Aurum will require appropriate contractual, organisational or technical protections from relevant recipients.

Taking account of the nature of processing, Aurum will provide reasonable assistance to the customer, where technically and legally practicable, to respond to requests by data subjects exercising applicable rights. Where Aurum receives a request relating primarily to Customer Data processed on behalf of a customer, Aurum may direct the requester to that customer unless law requires Aurum to respond directly.

Aurum will notify the affected customer without undue delay after becoming aware of a confirmed personal-data breach involving Customer Data for which Aurum acts as processor, and will provide information reasonably available to assist the customer with its legal assessment and notification obligations. Notification does not constitute an admission of fault or liability.

The customer is responsible for notifications it is required to make as controller, except to the extent applicable law places a direct obligation on Aurum.

Taking account of the nature of processing and information available to Aurum, Aurum will provide reasonable assistance with customer obligations concerning security, breach assessment, data-protection impact assessments and consultations with supervisory authorities where required by applicable law and relevant to Zonalia processing. Assistance beyond ordinary service operation may be subject to reasonable fees where permitted and agreed.

Aurum will make available information reasonably necessary to demonstrate compliance with processor obligations applicable to the service. Where an enterprise customer has a legal right to audit, the parties will first use available certifications, policies, security documentation or remote review where sufficient. Any further audit must be reasonable in scope and frequency, protect other customers and confidential information, avoid unnecessary disruption, and comply with agreed security procedures.

Customer Data is retained for the duration reasonably necessary to provide the service and thereafter according to applicable retention requirements, account settings, backup cycles and legal obligations. On termination or valid request, Aurum will delete or return Customer Data as required by the agreement and applicable law, except where retention is legally required or data remains temporarily in protected backup systems pending ordinary deletion cycles.

Available data-access or deletion requests may be initiated through the data request process.

If Aurum receives a legally binding demand for Customer Data, Aurum may disclose data to the extent required by law. Where legally permitted and reasonably practicable, Aurum will notify the affected customer before disclosure so the customer may seek appropriate protection.

Aurum may generate and use information that has been aggregated or de-identified so that it does not identify a data subject or customer, for security, reliability, analytics and service improvement, subject to applicable law. Aurum will not attempt to re-identify such information except where necessary to test the effectiveness of de-identification or as permitted by law.

Aurum does not sell Customer Data submitted to Zonalia as part of the processor relationship. Customer Data will not be used for third-party advertising or unrelated data brokerage.

This DPA supplements the Terms of Service and any applicable enterprise agreement. If this DPA conflicts with the Terms on processing of Customer Data, this DPA controls to the extent of that conflict. Liability arising under this DPA is subject to the applicable agreement's limitation-of-liability provisions except where applicable law prohibits such limitation.

Privacy or data-processing enquiries may be sent to hello@aurumdigitalconsulting.com. Data-subject requests may also be submitted through the data request page.