Skip to content

Data Processing Agreement

Effective 22 October 2026 · Version 1.0 (beta)

Draft for legal review. Prepared against the Nigeria Data Protection Act 2023 and the NDPC General Application and Implementation Directive 2025. Bracketed items must be completed, and the text reviewed by Nigerian counsel and Hali's DPO, before publishing. Remove this box when approved.

This agreement forms part of the Terms of Use between the Agency (controller) and PrivexLabs Limited, the company that builds and owns Hali (“Hali”, processor). It applies to personal data about the Agency's clients, prospects and contacts that Hali processes for the Agency (“Client Data”), as required by NDPA section 29.

1. Processing details

Subject matterProviding the Hali service
DurationThe term of the Terms of Use, plus the deletion period
Nature and purposeHosting, storing, displaying, sending notifications about, and securing Client Data for scope, review, approval and billing records
Data subjectsThe Agency's clients, prospects and their staff
Data typesNames, emails, company, enquiry answers, files, feedback, decisions and verification events, IP and device data in security logs
Sensitive dataNot intended. The Agency will not instruct Hali to process it without a written addendum

2. Hali's obligations

  1. Process Client Data only on the Agency's documented instructions (these terms and the Agency's use of product features), unless the law requires otherwise; in that case Hali will tell the Agency where lawful.
  2. Ensure staff with access are bound by confidentiality.
  3. Implement appropriate technical and organisational measures (section 5).
  4. Engage sub-processors only as set out in section 4.
  5. Assist the Agency with data-subject requests, data protection impact assessments and NDPC consultations, as far as reasonably possible.
  6. Notify the Agency without undue delay, and within 48 hours, after becoming aware of a breach affecting Client Data, so that the Agency can meet its 72-hour duty to notify the NDPC.
  7. At the end of the service, delete Client Data within 30 days, or return it via export on request, unless the law requires it to be kept.
  8. Make available the information needed to demonstrate compliance, and allow reasonable audits (once a year, with 30 days' notice, or after a breach).

3. The Agency's obligations

The Agency has a lawful basis for the Client Data, gives its clients a privacy notice that mentions Hali, and configures retention and access appropriately.

4. Sub-processors

The Agency authorises the sub-processors below. Hali will give 30 days' notice of any new sub-processor; the Agency may object on reasonable data protection grounds. Hali remains responsible for its sub-processors. Providers for file storage, transactional email and error monitoring will be added to this list, with that notice, before they process Client Data.

Sub-processorPurposeLocation
Vercel Inc.Application hostingOutside Nigeria
NeonDatabase hostingOutside Nigeria
Canva (only if a member connects it)Design export and linksOutside Nigeria

5. Security measures

Encryption in transit and at rest; tenant isolation in the application and the database; role-based access; email verification for consequential decisions; malware scanning; encrypted integration tokens; audit logging; backups with tested restores; vulnerability management; staff training.

6. International transfers

Transfers of Client Data outside Nigeria take place only under NDPA Part VIII, with the safeguards recorded by Hali and available to the Agency on request.

7. Liability and precedence

Liability is as set out in the Terms of Use. If this agreement conflicts with the Terms on data protection, this agreement prevails.