Data Processing Agreement
Version 2026-11 · Prepared 13 November 2026
This agreement is between the Controller and the Processor named above, and forms part of the i-Swipe HR Suite terms of service.
1What is processed
Personal data of the Controller’s employees, candidates and contacts that the Controller puts into i-Swipe HR Suite: identity and contact details, employment records, attendance and leave, pay and bank details, performance records and documents. Special categories (for example health information in sick notes) only where the Controller chooses to record them.
2Purpose and instructions
The Processor processes the data only to provide i-Swipe HR Suite as configured by the Controller, and only on the Controller’s documented instructions (the settings and actions taken in the app count as instructions). The Processor will tell the Controller if an instruction appears to break the Nigeria Data Protection Act 2023 (NDPA) or other applicable law.
3Confidentiality and security
People at the Processor who can access the data are bound by confidentiality and access it only to provide support or keep the service running; that access is logged. The Processor keeps the technical and organisational measures described at /trust, including separation of each customer’s data, encryption in transit, hashed passwords, two-step sign-in, role-based access and audit logs.
4Sub-processors
The Controller authorises the sub-processors listed below. The Processor will give at least 30 days’ notice of new sub-processors, during which the Controller may object; the Processor stays responsible for its sub-processors.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hosting provider (your i-Swipe server) | Runs the app and stores the database and files | Where the server is located |
| Email delivery (SMTP provider) | Sends sign-in codes, payslip and approval emails | Varies by provider |
| Paystack | Card and bank payments for your subscription (no employee data) | Nigeria |
| Anthropic | AI HR assistant and AI writing help, only when your company switches them on. Not used to train AI models. | United States |
| Africa’s Talking | USSD self-service sessions, only for staff who link their phone | Kenya / Nigeria |
| proxycheck.io | Checks whether a clock-in comes from a VPN, proxy or data-centre network. Receives only the internet address of the clock-in; answers kept 7 days. | United Kingdom |
5Transfers outside Nigeria
Where a sub-processor is outside Nigeria, the transfer relies on an adequacy decision or appropriate safeguards under Part VIII of the NDPA, such as standard contractual clauses.
6Data subjects’ rights
The app lets staff access, correct, download and ask to erase their data, and lets the Controller track each request. The Processor will help with any request it receives and pass it to the Controller without delay.
7Personal data breaches
The Processor will notify the Controller without undue delay and in any case within 48 hours of becoming aware of a breach affecting the Controller’s data, with the information the Controller needs to notify the Nigeria Data Protection Commission within 72 hours where required.
8Audits
The Processor will make available the information needed to show compliance with this agreement and allow reasonable audits, at most once a year with 30 days’ notice, unless a breach or regulator requires otherwise.
9End of service
The Controller can export its data at any time. Within 90 days after the subscription ends the Processor deletes the Controller’s data, except where the law requires it to be kept, in which case it stays protected and is used for no other purpose.
10Contact
Privacy questions: [email protected].