Data Processing Agreement
The standard terms on which Pynpoint processes personal data on behalf of its clients.
Effective 25 October 2026
About this agreement
This Data Processing Agreement ("DPA") forms part of, and is subject to, the service agreement between Pynpoint Nig Ltd and the Client under which Pynpoint provides address and premises verification services (the "Service Agreement"). Where this DPA conflicts with the Service Agreement on the subject of personal data, this DPA prevails.
It is entered into between Pynpoint Nig Ltd, a company incorporated in Nigeria with registration number RC 9791266 and registered office at 151 Lola Holloway Street, Omole Phase 1, Ikeja, Lagos State, Nigeria ("Pynpoint", the "Processor"), and the Client (the "Controller") identified in the Service Agreement.
This page sets out the standard form of the DPA. Client-specific particulars and signatures are completed when it is executed as part of a Service Agreement.
1. Definitions
"NDPA" means the Nigeria Data Protection Act 2023 and any subsidiary legislation, regulation, directive or guidance issued under it, including that issued by the Nigeria Data Protection Commission.
"Data Subject", "Personal Data", "Data Controller", "Data Processor", "Processing" and "Personal Data Breach" have the meanings given to them in the NDPA.
"Services" means the verification services provided by Pynpoint under the Service Agreement.
"Sub-processor" means any third party engaged by Pynpoint to process Personal Data on the Client's behalf in connection with the Services.
2. Roles of the parties
In relation to Personal Data processed for the purpose of carrying out a verification requested by the Client, the Client is the Data Controller and Pynpoint is the Data Processor.
Pynpoint acts as an independent Data Controller in relation to the following, and this DPA does not apply to them except where expressly stated:
- its own record of verified addresses, maintained to avoid unnecessary repeat visits and to detect patterns indicating fraud;
- detection and prevention of fraud, including falsified field submissions;
- the defence or pursuit of legal claims arising from work carried out;
- compliance with its own legal and regulatory obligations; and
- Personal Data relating to its own personnel, field agents and their guarantors.
Pynpoint's processing as a Controller is governed by its published privacy policy. Nothing in this DPA makes the Client a Controller in respect of that processing, and nothing in it makes Pynpoint a Controller in respect of the Client's own purposes.
3. The Client's obligations
The Client warrants and undertakes that:
- it has a lawful basis under the NDPA for the collection of the Personal Data it submits and for having it verified by Pynpoint;
- it has provided each Data Subject with the information required by the NDPA, including that physical address verification may be carried out and that a third party may attend the premises;
- its instructions to Pynpoint will not put Pynpoint in breach of the NDPA;
- the Personal Data it submits is accurate to the best of its knowledge and is limited to what is necessary for the verification requested; and
- it will not submit special categories of Personal Data, or Personal Data relating to a person under 18, except where unavoidably contained in a household occupancy confirmation.
The Client acknowledges that where it instructs Pynpoint to carry out a verification without the Data Subject being contacted beforehand, the Client remains responsible for having informed the Data Subject that address verification may be undertaken.
4. Pynpoint's obligations as Processor
Pynpoint shall:
- process Personal Data only on the Client's documented instructions, which are the Service Agreement, this DPA, and any instruction given through the client portal or in writing, unless required to do otherwise by law, in which case it will inform the Client before processing unless the law prohibits it;
- inform the Client without delay if, in its opinion, an instruction infringes the NDPA;
- ensure that every person authorised to process the Personal Data, including its field agents, is bound by an obligation of confidentiality and has received appropriate training;
- implement and maintain the technical and organisational measures set out in Annex B;
- not disclose Personal Data to any third party except as permitted by this DPA, required by law, or instructed by the Client;
- assist the Client, taking into account the nature of the processing, in responding to Data Subject requests and in meeting its obligations in relation to security, breach notification and data protection impact assessments; and
- make available to the Client the information reasonably necessary to demonstrate compliance with this DPA.
5. Field visits
The Client acknowledges that performance of the Services requires a Pynpoint field agent to attend the premises, to record its position and the accuracy of the recording device, to photograph the exterior of the premises, and where necessary to obtain confirmation of occupancy from a person present.
Pynpoint confirms that its field agents are instructed to identify themselves, to photograph the exterior only and never the interior of a dwelling, not to photograph individuals, and not to be given or to seek the Data Subject's telephone number. Where contact with the Data Subject is necessary and the Client permits it, the call is placed by a Pynpoint coordinator.
Pynpoint is the Controller in respect of the identity of, and statements given by, any third party who corroborates occupancy, and processes that data on the basis of its legitimate interest and the Client's in preventing financial fraud.
6. Sub-processors
The Client provides general authorisation for Pynpoint to engage Sub-processors. The Sub-processors engaged at the date of this DPA are listed in Annex C.
Pynpoint shall:
- impose on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA;
- remain fully liable to the Client for the performance of each Sub-processor's obligations; and
- give the Client at least 30 days' notice before adding or replacing a Sub-processor, during which the Client may object on reasonable data protection grounds. Where the parties cannot resolve an objection, the Client may terminate the affected Services on written notice without penalty.
7. International transfers
Certain Sub-processors operate infrastructure outside Nigeria. Pynpoint shall transfer Personal Data outside Nigeria only where a transfer mechanism permitted by the NDPA is in place. The mechanism relied upon for each Sub-processor is stated in Annex C.
Where no adequacy determination has been made by the Nigeria Data Protection Commission in respect of the recipient country, Pynpoint relies on binding contractual terms with the Sub-processor affording a level of protection consistent with the NDPA, by way of that Sub-processor's data processing addendum and the standard contractual clauses incorporated into it.
8. Data Subject rights
Pynpoint shall not respond directly to a request from a Data Subject relating to Personal Data processed on the Client's behalf, except to confirm that the request has been received and to direct the Data Subject to the Client. Pynpoint shall notify the Client of any such request within 5 business days and shall provide reasonable assistance in responding to it.
Where a Data Subject asserts that a verification outcome is inaccurate, Pynpoint shall re-examine the sealed report and its underlying evidence. Any correction to an issued report requires one person to request the change and a second to approve it, and the change and its reason are recorded in the audit trail. Pynpoint shall notify the Client of any correction made.
9. Personal Data Breach
Pynpoint shall notify the Client without undue delay, and in any event within 24 hours, of becoming aware of a Personal Data Breach affecting Personal Data processed on the Client's behalf. The notification shall describe, so far as known at the time:
- the nature of the breach and the categories and approximate number of Data Subjects and records affected;
- the likely consequences;
- the measures taken or proposed to address it and to mitigate its effects; and
- the name and contact details of the point of contact for further information.
Pynpoint shall not make any public statement or notify the Nigeria Data Protection Commission in relation to a breach affecting the Client's Personal Data without first consulting the Client, unless required by law to do so.
10. Audit
Pynpoint shall, on reasonable written notice and no more than once in any twelve-month period unless a Personal Data Breach has occurred, make available to the Client or an independent auditor appointed by the Client the information and access reasonably necessary to verify compliance with this DPA.
An audit shall be conducted during business hours, shall not unreasonably disrupt Pynpoint's operations, shall be subject to confidentiality obligations, and shall not extend to any data relating to another client of Pynpoint. The Client bears its own costs and the reasonable costs of Pynpoint's assistance.
11. Retention, return and deletion
On termination of the Service Agreement, Pynpoint shall, at the Client's election, return or delete the Personal Data processed on the Client's behalf, except to the extent that it is required to retain a copy:
- to comply with a legal or regulatory obligation, including anti-money-laundering record-keeping requirements;
- to defend or pursue a legal claim arising from work carried out; or
- as part of the audit trail attached to a report already issued, which cannot be altered.
Personal Data retained under this section remains subject to the confidentiality and security obligations of this DPA for as long as it is held.
12. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Service Agreement. Nothing in this DPA limits either party's liability to a Data Subject or to the Nigeria Data Protection Commission.
13. Term, variation and governing law
This DPA takes effect on the date stated in the Service Agreement and continues for as long as Pynpoint processes Personal Data on the Client's behalf. It may be varied only in writing signed by both parties, save that Pynpoint may update Annex C in accordance with section 6.
This DPA is governed by the laws of the Federal Republic of Nigeria, and the courts of Lagos State shall have exclusive jurisdiction.
Annex A. Particulars of processing
| Item | Detail |
|---|---|
| Subject matter | Verification of physical residential addresses and business premises in Nigeria. |
| Duration | The term of the Service Agreement, plus any retention period under section 11. |
| Nature and purpose | Screening a submitted address; dispatching a field agent; attending the premises; capturing photographic and location evidence; obtaining confirmation of occupancy; quality assurance review; producing and delivering a sealed report; and where instructed, periodic re-verification. |
| Types of Personal Data | Name; residential or business address; local government area; landmark; telephone number where the Client provides one; coordinates and device accuracy readings at the premises; photographs of the exterior of the premises; observations recorded by the field agent; the name given for the occupant; the identity of and statement given by any corroborating third party; and the verification outcome. |
| Categories of Data Subject | The Client's customers, applicants, merchants or employees whose addresses are submitted for verification; occupants of the premises visited; and third parties who corroborate occupancy. |
| Special categories | None requested or required. The Client undertakes not to submit special category data. |
Annex B. Technical and organisational measures
| Area | Measures |
|---|---|
| Access control | Role-based access on a least-privilege basis. Separate roles for administration, coordination and quality assurance. Two-factor authentication available on client portal accounts. Credentials and access keys stored only in hashed form. |
| Audit logging | Append-only audit trail recording every access to and change in a record, with the identity of the person and the time. |
| Evidence integrity | Photographic evidence must be captured within the Pynpoint Agent App at the location, with position and device accuracy recorded at the moment of capture. Uploads from a device gallery are rejected. Location evidence is independently corroborated before review. |
| Report integrity | Each completed report is sealed with a cryptographic hash over the underlying record, so that any later alteration is detectable. Corrections to an issued report require one person to request and a second to approve, and are recorded in the audit trail. |
| Separation of duties | No field agent may approve their own submission. Every submission is reviewed by a quality assurance reviewer before any report is released. |
| Minimisation in the field | Field agents are shown only the requesting organisation, the subject's name and the address. They are not given the Data Subject's telephone number. |
| Personnel | Field agents are identity-checked, have their own home address verified, have their bank account name resolved against their identity records, and have a guarantor contacted before activation. All personnel and agents are bound by confidentiality obligations and receive data protection training. |
| Transmission and storage | Data in transit is protected by encryption. Hosting, storage and backup are provided by the Sub-processors listed in Annex C. |
| Field devices | Field agents access Personal Data through the Pynpoint Agent App on their own devices and are shown only the requesting organisation, the subject's name and the address. Where no network connection is available, a completed submission is held on the device until it can be transmitted, and agents are contractually required to transmit it as soon as a connection is available and in any event the same day, to keep the device locked, to report a lost or stolen device immediately, and not to copy, screenshot, forward or store job information outside the Agent App. Access is revoked on suspension or termination. |
| Incident response | Defined procedure for identifying, escalating, containing and notifying a Personal Data Breach, with the notification obligation in section 9. |
Annex C. Approved Sub-processors
| Purpose | Sub-processor | Location | Transfer safeguard |
|---|---|---|---|
| Application hosting and database | Render, Inc. | United States, region selected at deployment | Data processing addendum with standard contractual clauses |
| Network, security and content delivery | Cloudflare, Inc. | Global edge network, United States | Data processing addendum with standard contractual clauses |
| Mapping and geocoding | Google LLC (Google Maps Platform) | Global, United States | Data processing addendum with standard contractual clauses |
| Transactional email delivery | Mailtrap (Railsware Products Studio) | Confirm region on account | Data processing addendum with standard contractual clauses |
| Payment processing and agent disbursement | Paystack Payments Limited | Nigeria | No transfer outside Nigeria |