Data Processing Agreement

1. Purpose and scope

This Data Processing Agreement ("DPA") sets out how Adtivity Enterprise ("Adtivity", "Processor", "we") processes the personal data of end users on behalf of the customer ("Controller", "you") when you use the Adtivity platform to analyse activity in your own product or service. The terms of this DPA form part of, and are incorporated into, the Terms of Service. In the event of any conflict, this DPA takes precedence with respect to data processing.

"Personal data" means any information that relates to an identified or identifiable natural person, within the meaning of the Nigeria Data Protection Act 2023 (the "NDPA") and, where applicable, the EU or UK General Data Protection Regulation (together with the NDPA, "Applicable Law").

2. The data we process

In operating the Adtivity platform on your behalf, we may process the following categories of data on your end users:

• Pseudonymous user identifiers (a string you choose and supply to the SDK, such as a user ID from your own database)
• Product usage events (pages visited, features used, and the timestamps of those events)
• Revenue and subscription signals (transaction amounts, plan names and status, linked to a user identifier)
• Behavioural attributes you choose to attach to those identifiers

We do not knowingly receive names, email addresses, government IDs or other directly identifying information unless you deliberately send them to us. You are responsible for ensuring that the data you send is appropriate and that you have a valid legal basis for processing it.

3. Your obligations

As the Controller, you are responsible for: ensuring you have a lawful basis to collect and process the end-user data you send to Adtivity; giving appropriate notice to your end users about that processing (for example, in your own privacy policy); responding to any rights requests from your end users; and ensuring that you use the Adtivity platform in accordance with Applicable Law.

4. Our obligations

As your Processor, Adtivity will: process personal data only on your instructions and only to provide the Adtivity service; implement appropriate technical and organisational measures to protect personal data; ensure that persons authorised to process the data are committed to confidentiality; assist you, to a reasonable extent, in responding to rights requests from your end users; delete or return personal data at your request or on termination of the agreement, subject to any legal obligation to retain it; notify you without undue delay if we become aware of a personal data breach affecting your data; and not subcontract any processing to a third party without your knowledge. Our current sub-processors are listed at adtivity.xyz/sub-processors.

5. Sub-processors

You authorise us to engage the sub-processors listed at adtivity.xyz/sub-processors to help provide the service. We will maintain a current list at that URL and will provide notice of any change. If you have a reasonable objection on data-protection grounds to a new sub-processor, please notify us in writing; we will work with you to address the concern.

6. Security

We apply the security measures described in our Privacy Policy to end-user data, including TLS encryption in transit, encryption at rest, access controls, audit logging and regular backups. We review and update these measures as needed to respond to new risks.

7. International transfers

Where our processing involves transferring personal data outside Nigeria or out of the EU/EEA or UK, we rely on legally recognised safeguards, such as the Standard Contractual Clauses issued by the European Commission, together with any supplementary measures required by Applicable Law.

8. Data retention and deletion

We retain end-user event data for the period determined by the customer's plan: 30 days on Free, 12 months on Builder, and 24 months on Pro. After the applicable retention period, we delete or anonymise the data. You may request earlier deletion at any time by contacting us. On termination of your account, we delete end-user data from our active systems within 30 days and from backups within 90 days, unless the law requires us to keep it.

9. Assistance with rights requests

When you or one of your end users exercises a data subject right (such as access, rectification, erasure, or portability), you are primarily responsible for responding. We will provide reasonable assistance, including the ability to export data or delete specific records, through the tools available in the Adtivity dashboard. Requests that require assistance beyond those tools should be sent to adtivityai@gmail.com.

10. Breach notification

If Adtivity becomes aware of a personal data breach affecting your end-user data, we will notify you in writing without undue delay and, in any event, within 72 hours of becoming aware. Our notification will include, to the extent then known, a description of the breach, the categories and approximate number of records affected, the likely consequences, and the measures we have taken or propose to take. You are responsible for any subsequent notification to your end users or supervisory authorities required by Applicable Law.

11. Audits

You may, with reasonable notice and no more than once per calendar year, request an audit of our data processing activities, or require us to make available information necessary to demonstrate compliance with our obligations under this DPA. We may satisfy such a request by providing an up-to-date third-party audit report, where one is available.

12. Governing law

This DPA is governed by the laws of the Federal Republic of Nigeria. The courts of Lagos State have non-exclusive jurisdiction, except to the extent that Applicable Law in your jurisdiction imposes a different requirement.

13. Contact

To raise a question about this DPA, to exercise your rights under it, or to report a concern, contact our compliance lead at adtivityai@gmail.com or in writing to Adtivity Enterprise, 17 Igbobi College Road, Shomolu, Lagos, Nigeria.