Data Protection Addendum (GDPR & NDPA Compliance) – Viapa AI

Effective Date: September 15th, 2025

DATA PROCESSING ADDENDUM (DPA)

This Data Processing Addendum (“DPA”) forms part of the agreement between Viapa (“Viapa,” “Processor,” “we,” “us”) and the customer or partner (“Customer,” “Controller”) and applies where Viapa processes Personal Data on behalf of the Customer.

This DPA is effective as of the date the underlying agreement takes effect.

1. Definitions

Unless otherwise defined in this DPA, terms used herein have the meanings given to them under:

• General Data Protection Regulation (GDPR)

• Nigeria Data Protection Act / NDPR

Key definitions:

• “Personal Data” means any information relating to an identified or identifiable individual.

• “Processing” means any operation performed on Personal Data.

• “Controller” means the entity that determines the purposes and means of Processing.

• “Processor” means the entity that Processes Personal Data on behalf of the Controller.

2. Roles of the Parties

• The Customer is the Data Controller.

• Viapa acts as a Data Processor when processing Personal Data on the Customer’s behalf.

Viapa does not determine the purposes for which Customer Personal Data is processed.

3. Scope and Purpose of Processing

3.1 Subject Matter

The subject matter of processing includes providing Viapa’s services, including:

• Platform access and user authentication

• AI-assisted interactions and workflows

• Payment initiation and transaction orchestration

• Customer support and service monitoring

3.2 Duration

Processing will continue for the duration of the underlying agreement unless otherwise required by law.

3.3 Nature of Processing

Processing activities may include:

• Collection

• Storage

• Transmission

• Analysis

• Retrieval

• Deletion

4. Types of Personal Data & Data Subjects

4.1 Types of Personal Data

Depending on Customer usage, this may include:

• Name

• Email address

• Phone number

• User identifiers

• Device and usage data

• Transaction references and metadata

Important: Viapa does not store cardholder data or customer funds.

4.2 Categories of Data Subjects

• End users

• Customers’ employees, members, or clients

• Authorized platform users

5. Processor Obligations (Viapa)

Viapa agrees to:

1. Process Personal Data only on documented instructions from the Customer

2. Ensure persons authorized to process Personal Data are bound by confidentiality

3. Implement appropriate technical and organizational security measures

4. Assist the Customer in responding to data subject requests

5. Assist with DPIAs and regulatory consultations where required

6. Notify the Customer of any Personal Data Breach without undue delay

7. Delete or return Personal Data upon termination of services, unless legally required to retain it

6. Security Measures

Viapa implements security measures aligned with industry standards, including:

• Encryption in transit and at rest

• Access controls and least-privilege access

• Multi-factor authentication for privileged access

• Logging and monitoring

• Secure development practices

• Incident response procedures

These measures are designed to meet the requirements of GDPR Article 32 and NDPR.

7. Sub-processors

7.1 Use of Sub-processors

Viapa may engage sub-processors to support service delivery (e.g., cloud hosting, infrastructure, communications).

7.2 Conditions

• Sub-processors are subject to contractual obligations no less protective than this DPA

• Viapa remains responsible for sub-processor compliance

A list of sub-processors may be provided upon request.

8. International Data Transfers

Where Personal Data is transferred outside the Customer’s jurisdiction:

• Appropriate safeguards are applied (e.g., contractual protections)

• Transfers comply with applicable data protection laws

9. Data Subject Rights

Viapa will, to the extent legally permitted:

• Promptly notify the Customer of any data subject request

• Assist the Customer in fulfilling access, correction, deletion, restriction, and portability requests

Viapa will not respond directly to data subjects unless instructed by the Customer or required by law.

10. Personal Data Breach Notification

Viapa will notify the Customer without undue delay after becoming aware of a Personal Data Breach and provide:

• Description of the incident

• Categories and approximate number of affected data subjects

• Mitigation steps taken or proposed

11. Audits & Compliance

Viapa will:

• Maintain documentation demonstrating compliance with this DPA

• Make relevant information available for audits upon reasonable request

• Cooperate with regulatory authorities where required

12. Deletion or Return of Data

Upon termination of services:

• Personal Data will be deleted or returned to the Customer

• Unless retention is required by applicable law

13. Liability

Liability under this DPA is subject to the limitations set forth in the underlying agreement, except where prohibited by law.

14. Governing Law

This DPA shall be governed by:

• The governing law specified in the underlying agreement, or

• Applicable data protection law where required

15. Order of Precedence

In the event of conflict:

1. This DPA

2. The underlying agreement

3. Any other related documents

16. Contact

For data protection inquiries:

Viapa – Privacy & Data Protection Office

📧 Email: privacy@viapaai.com