Data Processing Agreement

Table of Contents

1. 1. Definitions
2. 2. Subject Matter and Purpose
3. 3. Categories of Data and Data Subjects
4. 4. Controller Obligations
5. 5. Processor Obligations
6. 6. Sub-Processors
7. 7. Data Subject Rights
8. 8. Security Measures
9. 9. Data Breach Notification
10. 10. International Data Transfers
11. 11. Data Retention and Deletion
12. 12. Confidentiality
13. 13. Liability and Indemnification
14. 14. Audit Rights
15. 15. Term and Termination
16. 16. Governing Law and Dispute Resolution
17. 17. Amendments
18. 18. General

1. Definitions

In this Agreement, the following terms shall have the meanings ascribed to them below:

• 1.1 "Personal Data" — any information relating to an identified or identifiable natural person ("Data Subject") as defined under the Nigeria Data Protection Act 2023 ("NDPA").
• 1.2 "Processing" — any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• 1.3 "Data Subject" — the identified or identifiable natural person to whom Personal Data relates, including students, parents, guardians, and staff.
• 1.4 "Nexus Platform" — the Nexus School OS software platform, APIs, and associated infrastructure operated by Nexus Infrastructure Ltd., including all cloud-connected services.
• 1.5 "Cloud Vault" — the suite of cloud-hosted services forming the Nexus Platform backend, comprising Nexus Pulse Cloud, Delta Sync, Intent Engine, Guardian Shield, and Fee Recovery Pulse.
• 1.6 "Sub-Processor" — any third-party processor engaged by Nexus to assist in Processing Personal Data on behalf of the Controller.
• 1.7 "NDPA" — the Nigeria Data Protection Act 2023 and any subsidiary legislation, regulations, or guidance issued thereunder.
• 1.8 "NDPC" — the Nigeria Data Protection Commission, the supervisory authority established under the NDPA.
• 1.9 "Data Breach" — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed on the Nexus Platform.

2. Subject Matter and Purpose

2.1 This DPA governs the Processing of Personal Data by Nexus on behalf of the Controller in the course of providing the following cloud services:

• (a) Nexus Pulse Cloud — real-time cloud synchronisation of school records;
• (b) Delta Sync — incremental data replication and offline reconciliation;
• (c) Intent Engine — AI-driven report comment generation and academic analytics;
• (d) Guardian Shield — security monitoring, threat detection, and access control;
• (e) Fee Recovery Pulse — automated payment reminders and fee status tracking via WhatsApp.

2.2 Processing of Personal Data under this DPA is necessary for the performance of the Nexus School OS service agreement between Nexus and the Controller, as well as for the provision of the services described in clause 2.1.

2.3 The legal basis for Processing is:

• (a) NDPA s.25(1)(b) — Processing necessary for the performance of a contract to which the Data Subject is a party or in order to take steps at the request of the Data Subject prior to entering into a contract; and
• (b) NDPA s.25(1)(f) — Processing necessary for the purposes of the legitimate interests pursued by the Controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject.

3. Categories of Data and Data Subjects

3.1 Data Subjects. The categories of Data Subjects whose Personal Data is Processed under this DPA are:

• (a) Students enrolled at the Controller's institution;
• (b) Parents and/or guardians of enrolled students; and
• (c) School administrative and teaching staff.

3.2 Personal Data categories Processed:

• Student Data: full name, class/arm assignment, date of birth, gender, admission number, attendance records, published academic results, and fee payment status.
• Parent/Guardian Data: full name, WhatsApp phone number, relationship to student, and WhatsApp conversation history relating to fee reminders and school communications.
• Staff Data: full name, role/designation, and the principal's phone number for administrative communications.

3.3 Special Category Data. Nexus does not Process health, biometric, religious, political, genetic, or any other special category data as defined under NDPA s.30. The Controller warrants that no special category data will be submitted to the Nexus Platform without prior written agreement and a separate lawful basis assessment.

4. Controller Obligations

The Controller agrees and warrants that it shall:

• 4.1 Collect and submit Personal Data to the Nexus Platform only in accordance with a lawful basis under the NDPA, ensuring that all required notices, consents, or other legal grounds are in place prior to Processing.
• 4.2 Obtain and maintain all necessary consents from Data Subjects (or their legal guardians where applicable) for the Processing activities described in this DPA, including WhatsApp communications and cloud synchronisation.
• 4.3 Ensure that any school board, proprietor, or institutional authority with oversight of the institution has authorised the Controller's execution of this DPA.
• 4.4 Maintain a Record of Processing Activities ("ROPA") as required by the NDPA and make it available to the NDPC or Nexus upon request.
• 4.5 Appoint a Data Protection Officer ("DPO") or a designated data protection contact where required under the NDPA, and notify Nexus of such appointment and any subsequent changes.
• 4.6 Promptly notify Nexus of any actual or suspected Data Breaches originating from the Controller's systems, devices, or credentials, and cooperate with Nexus in any investigation or remediation.
• 4.7 Not instruct Nexus to Process Personal Data in any manner that is unlawful, contrary to the NDPA, or that would cause Nexus to violate any applicable law or regulation.
• 4.8 Ensure that all staff and personnel who have access to the Nexus Platform receive adequate data protection training and are bound by appropriate obligations of confidentiality.

5. Processor Obligations

Nexus, acting as Processor, shall:

• 5.1 Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by Nigerian law.
• 5.2 Process Personal Data solely for the purpose of delivering the services described in this DPA and the Service Agreement, and not for any independent commercial purpose of Nexus.
• 5.3 Ensure that all Nexus personnel authorised to Process Personal Data are subject to enforceable obligations of confidentiality and receive appropriate data protection training.
• 5.4 Implement and maintain appropriate technical and organisational security measures as set out in Section 8 of this DPA.
• 5.5 Not engage any Sub-Processor without the general or specific written consent of the Controller, and impose on each Sub-Processor data protection obligations equivalent to those in this DPA.
• 5.6 Upon termination or expiry of the Service Agreement, at the Controller's election, securely return or permanently delete all Personal Data, subject to clause 11.4.
• 5.7 Make available to the Controller all information necessary to demonstrate compliance with this DPA and cooperate with and contribute to audits conducted by the Controller or a mandated third party, subject to Section 14.
• 5.8 Immediately inform the Controller if, in Nexus's opinion, any instruction from the Controller infringes the NDPA or any other applicable data protection law, without prejudice to any obligation to carry out such instruction pending clarification.

6. Sub-Processors

6.1 By entering into this DPA, the Controller grants Nexus general written consent to engage the Sub-Processors listed in clause 6.2, subject to the conditions of this Section.

6.2 Approved Sub-Processors:

• (a) DigitalOcean LLC — cloud hosting and virtual private server infrastructure (registered in the United States of America);
• (b) Vercel Inc. — serverless and edge computing functions for the platform frontend (registered in the United States of America);
• (c) Meta Platforms Inc. / WhatsApp — message delivery infrastructure for parental communications and fee reminders (registered in the United States of America);
• (d) Neon Tech Inc. — managed PostgreSQL database hosting service (registered in the United States of America);
• (e) Paystack (Stripe) — payment processing and transaction management (incorporated in Nigeria and South Africa).

6.3 In relation to each Sub-Processor, Nexus shall:

• (a) Provide the Controller with at least 14 days' prior written notice of any intended addition or replacement of a Sub-Processor;
• (b) Impose data protection obligations on each Sub-Processor equivalent to those imposed on Nexus under this DPA; and
• (c) Remain fully liable to the Controller for the performance of each Sub-Processor's obligations under this DPA.

6.4 The Controller may object to a new or replacement Sub-Processor by providing written notice within 14 days of Nexus's notification. If the parties cannot resolve the objection within 14 days of the Controller's objection, either party may terminate the Service Agreement on 30 days' written notice.

7. Data Subject Rights

7.1 Nexus shall, taking into account the nature of the Processing and to the extent reasonably practicable, assist the Controller in fulfilling its obligations to respond to Data Subject requests exercising rights under the NDPA, including:

• (a) Right of access — NDPA s.34;
• (b) Right to correction — NDPA s.35;
• (c) Right to deletion/erasure — NDPA s.36;
• (d) Right to restriction of Processing — NDPA s.37;
• (e) Right to data portability — NDPA s.38; and
• (f) Right to object — NDPA s.39.

7.2 Where a Data Subject makes a request directly to Nexus, Nexus shall redirect such request to the Controller without undue delay and shall not respond to the Data Subject directly unless authorised by the Controller or required to do so by law.

7.3 The Controller is solely responsible for responding to Data Subject requests within the one-month period prescribed by the NDPA, extendable by up to a further two months where necessary having regard to the complexity and number of requests.

8. Security Measures

8.1 Technical and Organisational Measures. Nexus implements the following security measures to protect Personal Data:

• (a) Encryption in transit: All data transmitted between the Nexus Platform and external systems is encrypted using TLS 1.2 or TLS 1.3;
• (b) Encryption at rest: All Personal Data stored on Nexus infrastructure is encrypted using AES-256;
• (c) Access control: Role-based access control (RBAC) and SSH key-only authentication are enforced; password-based server access is disabled;
• (d) Network security: A deny-all inbound firewall policy is applied to all production servers, with only required service ports explicitly permitted;
• (e) API authentication: Constant-time authentication algorithms with 40-byte high-entropy secret keys are used to prevent timing attacks;
• (f) Monitoring and logging: Structured logging via pino and continuous uptime monitoring are in place to detect and respond to anomalous activity;
• (g) Backup and recovery: Weekly encrypted database snapshots are retained for a rolling 28-day period, enabling point-in-time recovery;
• (h) Patch management: Automatic security updates (unattended-upgrades), routine npm audit checks, and dependency version pinning are applied to minimise vulnerability exposure;
• (i) Infrastructure certification: Nexus utilises DigitalOcean data centres holding SOC 2 Type II certification, providing independently verified operational security controls.

8.2 The Controller is solely responsible for the physical and logical security of school devices, local area networks, and the confidentiality of Nexus Platform application credentials (usernames, passwords, API keys) used by school staff.

9. Data Breach Notification

9.1 Without undue delay, and in any event within 72 hours of becoming aware of a Data Breach affecting Personal Data Processed on behalf of the Controller, Nexus shall notify the Controller of the breach.

9.2 The breach notification shall, to the extent then known and available, include the following information:

• (a) The nature of the Data Breach, including where possible the categories and approximate number of Data Subjects and Personal Data records concerned;
• (b) The name and contact details of the Nexus DPO or other relevant contact point from whom further information may be obtained;
• (c) The likely consequences of the Data Breach; and
• (d) The measures taken or proposed to be taken by Nexus to address the Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

9.3 The Controller is solely responsible for notifying the NDPC and affected Data Subjects of any Data Breach in accordance with NDPA ss.40–42, and Nexus shall provide reasonable assistance to the Controller in discharging these obligations.

10. International Data Transfers

10.1 The Controller acknowledges and accepts that certain Sub-Processors listed in clause 6.2 are incorporated and operate outside the Federal Republic of Nigeria, and that the use of such Sub-Processors involves the international transfer of Personal Data.

10.2 All international transfers of Personal Data are conducted in compliance with Chapter 5 of the NDPA, using one or more of the following safeguards:

• (a) An adequacy decision issued by the NDPC confirming that the destination country provides adequate protection;
• (b) Standard contractual clauses approved by the NDPC; or
• (c) A derogation applicable under NDPA s.44, including where the transfer is necessary for the performance of the Service Agreement between the Controller and Nexus.

10.3 Nexus shall make documentation evidencing the applicable transfer mechanism available to the Controller upon written request.

11. Data Retention and Deletion

11.1 Nexus shall retain Personal Data only for as long as is necessary for the purposes of providing the services under the Service Agreement, or as required by applicable Nigerian law.

11.2 Standard Retention Periods:

• (a) Active school data (student records, results, attendance): retained for the duration of the active subscription;
• (b) WhatsApp conversation logs: retained for a rolling 12-month period;
• (c) Backup snapshots: retained for a rolling 28-day period; and
• (d) System access logs: retained for a rolling 90-day period.

11.3 Upon termination or expiry of the Service Agreement, the Controller shall within 30 days elect in writing either:

• (a) The return of all Personal Data in a machine-readable format; or
• (b) The permanent deletion of all Personal Data, with Nexus providing written confirmation of deletion within 30 days of the Controller's election.

11.4 Nexus may retain Personal Data beyond the periods in clause 11.2 where, and to the extent that, retention is required by applicable Nigerian law, regulation, or court order, provided that Nexus notifies the Controller of such requirement in writing.

12. Confidentiality

Each party shall keep confidential all Personal Data and any other information received from the other party in connection with this DPA ("Confidential Information") and shall not disclose such Confidential Information to any third party without the prior written consent of the disclosing party, except to the extent required by law, regulation, or a binding order of a competent court or regulatory authority. Each party shall ensure that access to Confidential Information is restricted to those of its personnel and sub-contractors who need to know such information for the purposes of this DPA and the Service Agreement. Each such person shall be subject to obligations of confidentiality no less stringent than those in this clause. The obligations of confidentiality in this Section 12 shall survive termination or expiry of this DPA for a period of five (5) years.

13. Liability and Indemnification

13.1 Each party acknowledges that the liability provisions of the NDPA apply to both the Controller and Nexus in respect of their respective roles in Processing Personal Data. Nothing in this DPA limits either party's liability to Data Subjects or the NDPC under mandatory applicable law.

13.2 Nexus shall not be liable for any loss or damage arising from:

• (a) The Controller's own unlawful instructions or failure to comply with its obligations as Controller under the NDPA or this DPA;
• (b) Failures of the Controller's own systems, devices, networks, or credentials; or
• (c) Acts or omissions of third parties entirely outside Nexus's reasonable control, including failures by Sub-Processors caused by the Controller's own actions.

13.3 The Controller shall indemnify and hold harmless Nexus and its officers, employees, and agents against any claims, fines, penalties, damages, or costs (including reasonable legal fees) arising from: (a) the Controller's breach of its obligations under this DPA; (b) the Controller's own Processing activities conducted outside the scope of this DPA; or (c) any instruction given by the Controller that causes Nexus to infringe applicable data protection law.

13.4 Nexus's aggregate liability to the Controller under or in connection with this DPA (excluding liability for death or personal injury caused by negligence, and fraud or fraudulent misrepresentation) shall not exceed the total fees paid by the Controller to Nexus in the 12 months immediately preceding the event giving rise to the claim.

14. Audit Rights

14.1 The Controller may audit Nexus's compliance with this DPA no more than once per calendar year, upon at least 14 days' prior written notice to Nexus, specifying the proposed scope, timing, and duration of the audit.

14.2 Nexus may satisfy an audit request by providing the Controller with relevant documentation, current certifications, attestations, third-party audit reports (such as SOC 2 Type II reports), or equivalent compliance evidence rather than permitting physical on-site inspection, at Nexus's reasonable discretion.

14.3 All reasonable costs and expenses incurred by both parties in connection with any audit shall be borne by the Controller, unless the audit reveals a material breach of this DPA by Nexus, in which case Nexus shall bear its own reasonable costs.

15. Term and Termination

15.1 This DPA shall take effect on the date the Controller first activates any cloud-connected feature of the Nexus Platform and shall remain in force, coterminous with the Service Agreement, unless earlier terminated in accordance with this Section.

15.2 Either party may terminate this DPA:

• (a) For any reason, upon 30 days' written notice to the other party; or
• (b) With immediate effect, if the other party commits a material breach of this DPA and fails to remedy that breach within 14 days of receiving written notice specifying the breach in reasonable detail.

15.3 Survival. The termination or expiry of this DPA shall not affect any rights or obligations that have accrued before termination. The obligations in Sections 11 (Data Retention and Deletion), 12 (Confidentiality), 13 (Liability and Indemnification), and 16 (Governing Law) shall survive termination or expiry of this DPA.

16. Governing Law and Dispute Resolution

16.1 This DPA and any non-contractual obligations arising out of or in connection with it shall be governed by, and construed in accordance with, the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023.

16.2 In the event of any dispute, claim, or difference arising out of or in connection with this DPA, the parties shall first attempt to resolve the matter amicably through good-faith negotiations between senior representatives of both parties, within a period of 30 days from the date on which the dispute is notified in writing.

16.3 If the dispute is not resolved through negotiation within the period specified in clause 16.2, the dispute shall be finally resolved by binding arbitration conducted in accordance with the Arbitration and Mediation Act 2023 of Nigeria. The seat of arbitration shall be Lagos, Nigeria, and proceedings shall be conducted in the English language.

16.4 Nothing in this Section 16 shall prevent either party from seeking urgent or emergency injunctive relief from a court of competent jurisdiction where necessary to prevent irreparable harm pending the resolution of a dispute by arbitration.

17. Amendments

Nexus reserves the right to amend this DPA from time to time to reflect changes in applicable law, regulatory guidance, or operational practice. Nexus shall provide the Controller with at least 30 days' prior written notice of any material amendment via the email address registered to the Controller's account. The Controller's continued use of the Nexus Platform after the expiry of the notice period shall constitute the Controller's acceptance of the amended DPA. If the Controller does not accept a proposed amendment, the Controller may terminate the Service Agreement and this DPA by providing written notice before the amendment takes effect, without penalty.

18. General

• 18.1 Entire Agreement. This DPA, together with the Service Agreement and any schedules or annexures thereto, constitutes the entire agreement between the parties with respect to the Processing of Personal Data and supersedes all prior representations, understandings, negotiations, or agreements, whether oral or written, relating to the same subject matter.
• 18.2 Severability. If any provision of this DPA is found by a court or arbitral tribunal of competent jurisdiction to be invalid, illegal, or unenforceable, that provision shall be deemed modified to the minimum extent necessary to make it valid, legal, and enforceable, and the remaining provisions of this DPA shall continue in full force and effect.
• 18.3 No Waiver. A failure or delay by either party to exercise any right or remedy provided under this DPA or by law shall not constitute a waiver of that or any other right or remedy. No single or partial exercise of such right or remedy shall prevent or restrict the further exercise of that or any other right or remedy.
• 18.4 Notices. All notices, requests, consents, claims, demands, waivers, and other communications under this DPA shall be in writing and delivered by email to the addresses specified in the Service Agreement or as otherwise notified in writing. Notices shall be deemed given upon transmission, provided no automated bounce or delivery-failure notification is received by the sender within 24 hours.