Scope and roles
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Appsotech Limited (“Processor”) and the Customer (“Controller”). It applies when Appsotech processes personal data contained in Customer Data on the Customer’s behalf while providing APPSOCOM.
It is designed to meet the requirements of the Nigeria Data Protection Act 2023 (“NDPA”) and, where they apply, the EU General Data Protection Regulation and the UK GDPR (together, “Data Protection Law”). Terms such as “personal data”, “processing”, “controller”, “processor” and “data subject” have the meanings given in Data Protection Law.
Details of processing
| Subject matter | Providing APPSOCOM: email, chat, calls, calendar, tasks, customer support and AI features |
|---|---|
| Duration | The term of the agreement, plus the deletion period in section 9 |
| Nature and purpose | Hosting, storing, transmitting, displaying, transcribing, summarising and generating content at the Customer’s and its Users’ direction |
| Data subjects | The Customer’s Users; people who correspond with them by email, chat or calls; the Customer’s own customers and website visitors who use its support channels |
| Personal data | Names, contact details, account details, message and email content, attachments, call audio and recordings, voice transcripts, calendar and task details, support conversations, device and log data |
| Special categories | Not required by the service. The Customer decides whether any is included in its content |
Processing on instructions
Appsotech processes personal data only on the Customer’s documented instructions, which are the agreement, this DPA, and the Customer’s and its Users’ use and configuration of APPSOCOM, unless the law requires otherwise, in which case we will tell the Customer first where the law allows. We will tell the Customer if we believe an instruction breaks Data Protection Law. We do not sell Customer personal data or use it to train AI models.
Confidentiality
Everyone at Appsotech who can access Customer personal data is bound by confidentiality obligations and has access only as needed to provide, support and secure APPSOCOM.
Security
Appsotech maintains technical and organisational measures appropriate to the risk, including:
- encryption in transit (TLS) for all connections to APPSOCOM;
- encryption of stored mail passwords and sign-in tokens with AES-256-GCM, and encryption at rest of stored files;
- workspace isolation, role-based access within workspaces, and invitation-only sign-up;
- limited, logged administrative access to production systems;
- rate limiting and abuse protection on public endpoints, including the chat widget;
- backups and recovery procedures for databases.
Sub-processors
The Customer authorises Appsotech to use the sub-processors below. Appsotech has a written agreement with each that imposes data protection obligations no less protective than this DPA, and remains responsible for their performance.
| Sub-processor | Purpose |
|---|---|
| Our cloud server host | Application servers and databases |
| Cloudflare, Inc. (R2) | File and recording storage |
| Anthropic, PBC | AI language models for summaries, drafts, assistant and support answers |
| Deepgram, Inc. | Speech-to-text |
| Cartesia AI, Inc. or ElevenLabs, Inc. | Text-to-speech |
| LiveKit, Inc. | Real-time voice and video calls |
| Google LLC (Firebase Cloud Messaging) and Apple Inc. (APNs) | Push notifications that ring devices |
We will give the Customer at least 30 days’ notice of a new sub-processor by email or in the app. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may end the affected service and receive a refund of prepaid fees for it.
Mail providers the Customer’s Users choose to link (such as Google or Microsoft) act for the Customer or the User, not as Appsotech’s sub-processors.
International transfers
Some sub-processors process personal data outside Nigeria, including in the United States and the European Union. Appsotech will make such transfers only with a lawful basis under Data Protection Law, such as appropriate contractual safeguards, including the EU Standard Contractual Clauses where the GDPR applies.
Assistance and data subject requests
Taking into account the nature of the processing, Appsotech will help the Customer respond to requests from data subjects to exercise their rights, and with security, breach notification, data protection impact assessments and consultations with regulators. If we receive a request directly from a data subject about Customer Data, we will pass it to the Customer and not respond ourselves except to say so.
Personal data breaches
Appsotech will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will describe the breach, the data and data subjects likely affected, the likely consequences and the measures taken or proposed, with further detail as it becomes available.
Return and deletion
When the agreement ends, the Customer may export its data for 30 days. Appsotech will then delete Customer personal data, including from backups within their normal rotation cycle, unless the law requires us to keep it.
Audits
Appsotech will make available the information reasonably needed to show compliance with this DPA, and will allow audits by the Customer or an auditor it appoints, at the Customer’s cost, on at least 30 days’ notice, no more than once a year unless a regulator requires it or after a breach, and subject to confidentiality.
General
If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA wins. The liability limits in the Terms of Service apply to this DPA to the extent Data Protection Law allows. Contact for data protection matters: [email protected].