Data Processing Addendum

This addendum addresses an arrangement in which a written agreement identifies Debelu as a processor of personal data for a customer or partner acting as controller. It does not make every buyer, seller or website visitor a business controller, and it does not replace the Privacy Policy for Debelu’s own marketplace processing.

The parties should identify the covered service and processing details in their agreement. A marketplace account alone is not evidence of a separately agreed processor arrangement. Contact legal@debelu.com to discuss the applicable terms.

The controller determines the purposes and means of the covered processing and is responsible for a lawful basis, required notices and instructions. Debelu acts on those instructions only for processing covered by the arrangement.

Where Debelu independently determines a purpose—such as its own account security, payment records or handling a legal obligation—the relevant role must be assessed separately. A label in a contract does not change the actual function of a party.

Instructions should describe the service, permitted operations, purposes, duration and people whose information is involved. The controller should not direct processing that is unlawful or unrelated to the agreed service.

Debelu should notify the controller if an instruction appears to breach applicable data-protection requirements and seek clarification. A legally required processing or disclosure must be handled under the law, with notice where permitted, rather than presented as an unrestricted instruction.

The processing details should specify relevant categories: for example, account/contact information, store or order records, communications and evidence needed for the covered support task. Special-category or highly sensitive information should not be included by default.

Identify whether the people are customers, users, staff or another group, and why each category is necessary. The agreement should not assume unrestricted access to identity documents, financial credentials or every marketplace record.

Access to covered information should be limited to people and services that need it for an authorized task. Persons acting under a party’s authority must be subject to appropriate confidentiality duties and instructions.

A controller should also secure its own credentials and users’ access. Sending instructions is not permission to share account secrets or expose another customer’s data in an attachment.

The parties must use measures appropriate to the nature of the data, the service and the risks. Relevant measures can include access controls, secure authentication, controlled disclosure, operational monitoring and recovery arrangements.

A particular certification, audit result, encryption specification or fixed recovery time is not created by this addendum. Any specific security commitment must be accurately described in the agreed service documentation.

The agreed arrangement should identify which service providers are authorized for covered processing, the work they do and the protections that apply. See service-provider information for feature purposes and role distinctions.

Any change, notice or objection procedure must follow the applicable agreement and law. The parties should address how a proposed provider change is communicated and considered. A payment provider’s independent legal obligations remain separate from processing under the controller’s instructions.

The parties should cooperate so requests for access, correction, deletion or another applicable right reach the responsible controller and are handled lawfully. The processor’s assistance must reflect the information and service it actually controls.

Requests can require proportionate identity checks or protection of another person’s information. Where necessary, the parties should also assist with risk assessments and regulatory enquiries relating to the covered processing.

A party that identifies a relevant personal-data breach must assess it, take appropriate steps and provide the information needed by the responsible party to meet applicable notification duties. Facts may become available in stages and should not be concealed because a review is incomplete.

The applicable law governs notification obligations and timing. This addendum does not promise a separate incident-response SLA or excuse a legal notification requirement. Contact security@debelu.com for a security concern without sending credentials.

An instruction involving processing outside Nigeria requires appropriate lawful safeguards and a record of the relevant basis. Provider location and international access should be addressed for the actual service, not assumed from the provider’s name.

The parties should identify any required transfer instrument or other permitted mechanism. This addendum does not certify every country, claim that all data remains in Nigeria or Europe, or itself supply an executed transfer agreement.

The agreement should define when covered processing ends and how data is returned or deleted, subject to applicable legal retention. The controller should distinguish information covered by its instructions from records Debelu must maintain for its independent obligations.

Backups, shared records and external providers can need separate handling. A deletion instruction should not be represented as complete physical erasure where that cannot be verified; the responsible party should explain any retained category and reason.

The parties should make relevant information available to demonstrate the covered obligations and agree a proportionate review method. A review must protect other people’s data, security-sensitive information and services outside the agreement.

A request to inspect compliance is not permission for unauthorized system access. Any operational audit arrangements, costs or specific evidence commitments should be addressed in the written agreement rather than assumed from this page.

Nigerian data-protection requirements apply where relevant, including the NDP Act. If another legal regime applies to a particular arrangement, the parties should identify and address its requirements in their agreement.

Mandatory law prevails over inconsistent instructions. The addendum is read with the service agreement, Terms and any applicable Vendor Agreement. For processor arrangements or contractual questions, write to legal@debelu.com.