Status: Draft 0.1 — 5 October 2026. Counsel review is outstanding. This is a template, not an executed agreement. Fill the bracketed fields per tenant. Do not store signed copies that contain identity documents in git.
This Data Processing Agreement ("DPA") is between:
- Controller: [Tenant legal name], [RC or BN number], [address] ("Tenant")
- Processor: ISP550, RC number to be inserted after CAC registration
It is incorporated into the Terms of Service. If the two conflict on processing of subscriber data, this DPA prevails.
1. Subject matter
ISP550 processes subscriber personal data so the Tenant can onboard routers, authenticate sessions, sell vouchers, bill PPPoE users, take payments, and send service messages.
Duration. For the tenant subscription, plus the deletion window in section 8.
Nature and purpose. Hosting, storage, transmission to payment and SMS providers on the Tenant's instruction, session accounting, and support.
Data subjects. The Tenant's hotspot and PPPoE subscribers, and voucher holders.
Categories. Identity and contact data, service and device data, payment references (no card numbers), consent records, and support messages.
Special categories. Not required for the service. The Tenant shall not submit them.
2. Instructions
ISP550 processes subscriber data only on documented instructions from the Tenant, including the product configuration the Tenant saves in the dashboard, plus instructions required by Nigerian law. If a law binding on ISP550 requires further processing, ISP550 tells the Tenant unless the law forbids that notice.
3. Controller duties
The Tenant will:
- Rely on a valid NDPA lawful basis and record consent where consent is the basis (version, time, and source).
- Keep its NCC authorisations in force and use the network lawfully.
- Limit staff access, and use reveal of masked phone numbers only for a real support reason.
- Forward data-subject requests that ISP550 must action.
4. Processor duties
ISP550 will:
- Limit access to people who need it, under confidentiality.
- Apply the security measures in section 6.
- Assist the Tenant with access, rectification, erasure, objection, and portability requests, and with breach notices.
- Tell the Tenant without undue delay after becoming aware of a personal-data breach.
- Delete or return subscriber data at the end of the service, subject to section 8.
- Make available the information needed to show compliance, including the RoPA entries that cover this processing.
5. Sub-processors
ISP550 may use the sub-processors listed in the privacy policy. Adding or replacing a sub-processor that handles subscriber data requires notice to the Tenant's account email before the change, unless the change is urgent to contain a security incident. The Tenant may object on reasonable data-protection grounds. Sub-processors are bound by written terms no weaker than this DPA on confidentiality, security, and deletion.
Current intended regions: Paystack and Termii in Nigeria; Railway and Hetzner in the EU; Cloudflare and Sentry as configured in tia-eu-hosting.md.
6. Security
Measures matching the product design:
- Tenant isolation in Postgres with row-level security forced on tenant-owned tables.
- Encryption in transit (TLS) and field encryption for subscriber phone numbers and router secrets (AES-256-GCM, key version in the ciphertext).
- Card data never touches ISP550 systems.
- Role-based masking of phone numbers, with an access log on reveal.
- Webhook signatures checked before a payment is fulfilled.
- Secrets stored in the host's secret manager, not in git.
7. International transfers
Where subscriber data is stored in the EU, ISP550 relies on the transfer basis recorded in tia-eu-hosting.md (NDPA sections 41 to 43). The Tenant authorises that transfer for the purpose of receiving the service.
8. Return and deletion
Within 30 days after the tenant account closes, ISP550 deletes subscriber personal data from production systems, or returns it if the Tenant asks before closure. Backups expire on their normal cycle. ISP550 may retain records it must keep as controller or under tax law (platform invoices, security audit of ISP550's own systems). Webhook payloads follow the 180-day purge.
9. Audit
Once per year, or after a confirmed breach affecting the Tenant, the Tenant may ask for the latest DPCO report or a written security summary. On-site audits are limited to what is reasonable for a multi-tenant service and must not expose another tenant's data.
10. Liability
Counsel will align this clause with the Terms of Service before either document is published.
Signatures
| Tenant | ISP550 | |
|---|---|---|
| Name | ||
| Title | ||
| Date | ||
| Signature |
Acceptance inside the product (checkbox, version, time, user id) is a valid signature for this template once counsel confirms that method.