Data processing agreement

The customer (the workspace owner) is the controller of personal data collected through its workspace, including data about its website visitors and team members ("Customer Personal Data"). Padorix is the processor and processes Customer Personal Data only to provide the service.

This DPA applies to processing under the Nigeria Data Protection Act 2023 (NDPA) and, where the customer or its visitors are subject to them, the EU and UK GDPR and comparable laws (together, "Data Protection Law").

• Subject matter: provision of live chat, visitor and page analytics, team collaboration, notifications and related features.
• Duration: for the term of the customer's use of the service, plus the deletion periods in section 10.
• Nature and purpose: collection, storage, organization, display, real-time transmission, analysis, export, backup and deletion of data, solely to provide, secure and support the service.
• Data subjects: the customer's website visitors; the customer's team members and administrators; people who submit inquiries through the widget.
• Categories of data: names and email addresses provided in chat or inquiries; message content, images and attachments; ratings and feedback; IP address and derived approximate location; device, browser, operating system and referrer; pages viewed, time on page, scroll depth and clicks; visitor and conversation identifiers; team member names, emails and activity logs.
• Special categories: none intended. The customer must not use the service to collect special-category data unless permitted by law and agreed with Padorix in writing.

Padorix processes Customer Personal Data only on the customer's documented instructions, which are: these terms and this DPA, the customer's configuration of its workspace (widget settings, tracking exclusions, team access), and actions the customer takes in the dashboard (including exports and deletions). Padorix will inform the customer if it believes an instruction infringes Data Protection Law, and may then suspend that processing.

Padorix may also process data where required by law, in which case it will inform the customer before processing unless the law prohibits it.

Padorix ensures that anyone authorized to process Customer Personal Data is bound by confidentiality obligations, receives appropriate security training, and accesses data only as necessary for their role (for example to resolve a support request the customer raised or to investigate a security incident).

• Encryption in transit (TLS) for all dashboard, API, widget and real-time traffic; encrypted backups.
• Tenant isolation enforced server-side: every chat action, data read and real-time subscription is authorized against the workspace the caller belongs to; visitors can only access their own conversation.
• Authentication: Argon2-hashed passwords, HTTP-only secure session cookies, signed per-session CSRF tokens, origin allow-listing for dashboard sessions, and short-lived login tokens.
• Abuse prevention: rate limits on login, verification-code and sign-up endpoints, and automatic account lockout after repeated failed logins under a policy managed by Padorix administrators.
• Least-privilege access, separation of production secrets from source code, security headers, and request-size and upload limits.
• Audit logging of sensitive actions, including exports, deletions, administrator changes and account locks.
• Monitoring through health checks, error logging and alerting; documented incident response.
• Padorix may update these measures provided the overall level of protection is not reduced.

The customer authorizes Padorix to engage sub-processors. Padorix imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance. Padorix will give at least 30 days' notice of a new sub-processor by updating this page and notifying account owners; the customer may object on reasonable data protection grounds, and if the parties cannot resolve the objection the customer may terminate the affected service with a pro-rata refund.

• Cloud hosting provider (application servers and MySQL database) — hosting and storage of all service data.
• Cloudinary — storage and delivery of images and files uploaded in chat and workspace logos.
• Google Firebase Cloud Messaging — delivery of push notifications to team members' devices (notification text and workspace identifiers).
• Resend and Padorix's SMTP mail provider — delivery of transactional emails (verification codes, invitations, notices).
• Google (Gemini API) — generation of AI-assisted responses, only for workspaces where AI features are enabled.
• Geolocation lookups use a database hosted on Padorix's own servers; IP addresses are not shared with the database vendor.

Some sub-processors process data outside Nigeria (including the United States and the European Union). Padorix will transfer Customer Personal Data internationally only with a lawful transfer mechanism under Data Protection Law, such as adequacy decisions, standard contractual clauses or other safeguards recognized by the Nigeria Data Protection Commission, and will make relevant information available on request.

The dashboard lets the customer locate, export (as JSON) and delete all data held about a visitor by email address or visitor ID, export an entire workspace, and delete workspaces and accounts. If Padorix receives a request directly from a data subject about Customer Personal Data, it will forward the request to the customer without undue delay and will not respond itself except to confirm the referral. Padorix will provide reasonable additional assistance where the customer cannot fulfil a request with the self-service tools.

Padorix will notify the customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed. Padorix will update the customer as more information becomes available and cooperate to help the customer meet its own notification obligations, including the 72-hour notification to the regulator where required.

• During the term, the customer can export or delete Customer Personal Data at any time using the dashboard.
• Deleted workspaces, accounts and visitor records are removed from the service immediately, kept in a recoverable state for a recovery window (currently 30 days) to allow accidental deletions to be reversed, and then permanently erased.
• On termination, Padorix deletes Customer Personal Data following the same process. Residual copies in encrypted backups are overwritten in the normal backup rotation and are not restored except for disaster recovery.
• Padorix may retain data where required by law, in which case this DPA continues to protect it.

Padorix will make available information reasonably necessary to demonstrate compliance with this DPA, including a description of its security measures, sub-processor list and, when available, independent assessment reports. Where this is not sufficient, the customer may conduct an audit, at its own cost, once per year with at least 30 days' notice, during business hours, subject to confidentiality and without access to other customers' data. Padorix keeps records of processing activities as required by Data Protection Law.

Padorix will provide reasonable information to help the customer carry out a data protection impact assessment or prior consultation with a regulator, to the extent the customer does not otherwise have access to that information.

• Have a lawful basis for the processing and provide visitors with the required notices, including that Padorix is used for chat and analytics.
• Obtain any consent required for tracking and cookies on the customer's website before the widget collects analytics data.
• Configure the workspace (tracking exclusions, team access) in line with its obligations, and keep team access limited to those who need it.
• Ensure its instructions comply with Data Protection Law.

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not allow them. This DPA remains in force for as long as Padorix processes Customer Personal Data.

Data protection contact for customers, sub-processor notifications and breach communications: farmsaccorp@gmail.com.