Data Processing Addendum

Effective 1 July 2026. This Data Processing Addendum (“DPA”) forms part of the agreement between a sender (“Customer”) and Ciphersec Limited (“Keepable”) under which Keepable provides the digital mailbox service. It sets out how Keepable processes personal data on behalf of Customer in compliance with the Nigeria Data Protection Act 2023 (NDPA) and regulations issued by the Nigeria Data Protection Commission (NDPC).

If you are a sender and you need a counter-signed copy of this DPA on Keepable letterhead, write to dpo@keepable.co.

1. Definitions

Terms not defined here have the meaning given to them in the NDPA. “Personal Data”, “Processing”, “Data Subject”, “Controller”, “Processor”, and “Sub-processor” carry their NDPA meanings. “Customer Data” means personal data that Customer (or its end customers) delivers into a Keepable mailbox or otherwise transmits through the service.

2. Roles

For Customer Data delivered through Keepable to a recipient mailbox, Customer is the Controller and Keepable is the Processor.

For recipient identity data (passkey credentials, NIN hash, email address, phone number, sign-in events, and mailbox configuration), Keepable is an independent Controller with respect to its recipients. That processing is governed by the Privacy Notice, not by this DPA.

3. Scope, subject matter, and duration

Keepable will process Customer Data only to provide the service described in the order form or other written agreement with Customer, to comply with Customer’s documented instructions, and to meet its own legal obligations. Processing continues for the duration of the agreement and, in limited form, for the retention periods set out in section 9.

Subject matter: delivery, storage, indexing, sealing, signing, and downstream display of documents Customer sends to its end customers through Keepable.

Categories of Data Subjects: Customer’s end customers who hold a Keepable mailbox.

Categories of Personal Data: the contents of the documents Customer chooses to send (typically including names, contact details, account numbers, balances, agreements, and statements), plus operational metadata such as delivery timestamps and read/signed events.

4. Customer instructions

Keepable processes Customer Data on Customer’s documented instructions, which include this DPA, the order form, the configuration Customer sets in sender.keepable.co, and any API calls Customer makes. Keepable will tell Customer if, in its opinion, an instruction infringes the NDPA or other applicable law.

5. Confidentiality

Keepable ensures that personnel authorised to process Customer Data are bound by written confidentiality obligations and receive training on data-protection responsibilities.

6. Security measures

Keepable applies the technical and organisational measures described on the Security page, including:

• encryption of Customer Data in transit (TLS 1.2+) and at rest (AWS KMS-managed keys);
• segregation of the recipient, sender, and staff planes at the application, network, and IAM layers;
• a cryptographic document seal: every document delivered to a mailbox is signed with a key issued by AWS Key Management Service and anchored to a tamper-evident audit log;
• S3 Object Lock and KMS encryption on the document store, with daily snapshots;
• passkey-only sign-in for recipients and staff; no SMS one-time passwords;
• restricted, audited staff access on a least-privilege basis;
• continuous logging and an incident response process targeting 72-hour notification (section 10).

Keepable will not materially weaken these measures during the term of the agreement.

7. Sub-processors

Customer authorises Keepable to engage the sub-processors listed below to help deliver the service. Each sub-processor is bound by data-protection terms no less protective than this DPA.

A current sub-processor list is published and maintained on the Security page. Keepable will give Customer at least 30 days’ written notice before adding or replacing a sub-processor that handles Customer Data. If Customer has a reasonable, data-protection-based objection, Customer may terminate the affected portion of the service for convenience within that notice window; otherwise the change is deemed approved.

8. International transfers

Keepable’s primary processing region is AWS af-south-1 in Cape Town, South Africa. Where Customer Data is transferred outside Nigeria, Keepable relies on a transfer mechanism permitted under section 41 of the NDPA, including (in order of priority): an NDPC adequacy decision where one exists for the destination, the contractual safeguards Keepable maintains with each sub-processor, or Customer’s explicit consent. The standard contractual terms Keepable uses with sub-processors are available on request to dpo@keepable.co.

9. Data subject rights

Keepable will assist Customer, taking into account the nature of the processing, to respond to requests from Data Subjects to exercise their NDPA rights (access, correction, deletion, portability, objection, withdrawal of consent). For mailboxes Keepable controls directly, Keepable will respond to Data Subjects through its own DPO process described in the Privacy Notice.

10. Personal-data breach

Keepable will notify Customer of a personal-data breach affecting Customer Data without undue delay, and in any case within 72 hours of becoming aware of it. The notification will include the information Customer needs to meet its own NDPA reporting obligations: a description of the breach, the categories and approximate number of Data Subjects affected, the likely consequences, and the measures Keepable has taken or proposes to take.

11. Audits

Customer may verify Keepable’s compliance with this DPA once per twelve-month period by reviewing the security documentation Keepable makes available, including (when issued) the SOC 2 Type II report covering the Keepable security trust services criteria. Where that documentation does not cover a specific reasonable question, Customer may submit written questions or request an on-site review on at least 30 days’ written notice, at Customer’s cost and subject to a confidentiality agreement.

12. Return and deletion

On termination of the agreement, Keepable will, at Customer’s option, return Customer Data or delete it from active systems within 30 days, except where retention is required by law (for example, evidence in a signed and sealed document or audit-log entries that establish the integrity chain).

13. Liability

Each party’s liability under this DPA is subject to the limitations in the main agreement between the parties.

14. Order of precedence

In the event of any conflict between this DPA and the main agreement, this DPA prevails for matters relating to the processing of Customer Data.

15. Contact

Data protection officer: dpo@keepable.co.

Effective date: 1 July 2026.