Data Processing Agreement

Purpose and how this agreement applies

This Data Processing Agreement (“DPA”) sets out how Okwe Import Export Solutions (“Okwe”, the “Processor”) handles personal data on behalf of a customer (the “Customer”, the “Controller”) when delivering research, sourcing, deal support or logistics services under a written service agreement (the “Agreement”).

The DPA is incorporated into the Agreement by reference when the Agreement says so, or when the Customer and Okwe sign a copy of it. If this DPA conflicts with the Agreement on the handling of personal data, this DPA prevails. It is written to meet the requirements of the Nigeria Data Protection Act 2023 (the “NDPA”) and its implementing framework.

Roles

For personal data the Customer gives Okwe to carry out the service, the Customer is the Controller and Okwe is the Processor. Where Okwe decides for itself how to use personal data, for example in keeping its own customer records or meeting its own legal duties, Okwe acts as a Controller and its Privacy Policy applies instead.

What is processed

Subject matter and duration: the personal data the Customer provides, or that Okwe collects at the Customer’s instruction, in connection with the service, for the term of the Agreement and any retention period in §·09.

Nature and purpose of processing, by service:

• Know (research and sourcing): identifying and checking potential suppliers, buyers and markets named or described by the Customer.
• Connect (deals and paperwork): introducing the Customer to counterparties, exchanging messages and documents, and preparing trade paperwork.
• Move (shipping and delivery): booking freight, handling clearance, warehousing and delivery, and sharing shipment updates.

Categories of data subjects: the Customer’s staff and representatives; the staff and representatives of the Customer’s existing or prospective suppliers, buyers and partners; consignees and other people named on trade and shipping documents.

Categories of personal data: names, job titles, employers, business contact details, correspondence, and the details that appear on commercial, customs and shipping documents. Okwe does not need, and the Customer agrees not to send, sensitive personal data as defined by the NDPA unless the parties agree additional safeguards in writing.

Okwe’s obligations as Processor

Okwe will:

• Process personal data only on the Customer’s documented instructions, which include the Agreement and this DPA, unless Nigerian law requires otherwise, in which case Okwe will tell the Customer first where the law allows.
• Make sure the people who handle the data are bound by confidentiality and have been told how to handle it.
• Apply appropriate technical and organisational security measures, taking into account the nature of the data and the risks, including access controls, encrypted transmission and secure storage.
• Tell the Customer without undue delay, and in any event within 72 hours of becoming aware, of a personal data breach affecting the Customer’s data, and give the information the Customer needs to meet its own NDPA notification duties.
• Help the Customer respond to data-subject requests (access, correction, deletion, objection and portability) and, where needed, with data protection impact assessments and consultations with the Nigeria Data Protection Commission.
• Keep a record of the processing it carries out for the Customer and make the information needed to demonstrate compliance with this DPA available on request.
• Tell the Customer promptly if, in Okwe’s view, an instruction infringes the NDPA.

Sub-processors

The Customer authorises Okwe to use sub-processors to deliver the service. At the effective date these are: Google (forms, email and document storage), Meta Platforms (WhatsApp messaging), Okwe’s website and email hosting providers, and the freight carriers, clearing agents, warehouses and insurers engaged for a specific shipment. Okwe will tell the Customer before adding a new category of sub-processor and will give the Customer a reasonable opportunity to object. Okwe remains responsible for its sub-processors’ handling of the data and will bind them to data-protection terms no less protective than this DPA.

Trade counterparties

Introducing the Customer to a buyer or supplier necessarily involves sharing the Customer’s business contact details with that counterparty, and vice versa. Each counterparty then handles that information as its own Controller. Okwe will share only what is needed to make the introduction or to perform the trade, and will not pass on the Customer’s details to counterparties the Customer has not asked to be introduced to.

International transfers

Cross-border trade means that counterparties, carriers and some providers are outside Nigeria. Okwe will transfer personal data outside Nigeria only where the transfer is necessary for the service, and only to recipients that offer an adequate level of protection or under appropriate safeguards as the NDPA allows, or where the Customer has given a specific instruction for a particular shipment or introduction.

The Customer’s obligations

The Customer confirms that it has a lawful basis for giving the personal data to Okwe, that it has given the data subjects the notices the NDPA requires, that its instructions are lawful, and that it will not send Okwe more personal data than the service needs. The Customer is responsible for responding to data subjects, with Okwe’s assistance as described above.

Return and deletion

When the Agreement ends, or earlier at the Customer’s written request, Okwe will return or delete the Customer’s personal data, at the Customer’s choice, except for copies Okwe must keep under Nigerian customs, tax, anti-money-laundering or other law, which Okwe will keep only for as long as that law requires and only for that purpose.

Audit

On reasonable written notice, no more than once a year unless a regulator requires it or a breach has occurred, the Customer or an independent auditor bound by confidentiality may review Okwe’s compliance with this DPA. Okwe may satisfy the request by providing documentation, completed questionnaires or recent third-party reports before an on-site audit is considered.

Liability and term

Each party’s liability under this DPA is subject to the limits and exclusions in the Agreement, except that nothing limits liability to data subjects or regulators where the NDPA does not permit it. This DPA lasts as long as Okwe holds personal data for the Customer.

Contact and changes

Notices under this DPA go to hello@okwe.com for Okwe and to the Customer’s address in the Agreement. Okwe may update this standard DPA for future engagements; the version incorporated into an Agreement stays in force for that Agreement unless both parties agree a change in writing.