Data processing agreement

1. Parties and scope

This agreement is between the customer that has accepted the Kedova terms of service (“Customer”, “you”) and Korevra Technologies Limited (RC 9471172) (“Korevra”). It applies to Customer Personal Data: personal data about your audience that you bring into or collect through Kedova, such as your contacts, newsletter subscribers, WhatsApp recipients, followers and people who comment on or message your accounts, and personal data in your documents and client workspaces.

For Customer Personal Data, you are the data controller and Korevra is your data processor. Personal data about your own account users is covered by our privacy policy, where Korevra is the controller.

2. Definitions

“NDPA” means the Nigeria Data Protection Act 2023. “GAID” means the General Application and Implementation Directive 2025 issued by the Nigeria Data Protection Commission (“NDPC”). “Personal data”, “processing”, “data subject”, “data controller”, “data processor” and “personal data breach” have the meanings given in the NDPA. “Sub-processor” means a third party engaged by Korevra to process Customer Personal Data.

3. Processing on your instructions

Korevra will process Customer Personal Data only on your documented instructions, which are: these terms and this agreement; your configuration of Kedova (including channels, contacts, consent records and publishing modes); and your approvals and other actions in the app. If Korevra believes an instruction infringes the NDPA or other law, it will tell you. Korevra may process Customer Personal Data where the law requires it, and will inform you first unless the law forbids it.

4. Your obligations

• You have a lawful basis under the NDPA for the Customer Personal Data you bring into Kedova, and have given data subjects the information the law requires.
• You have consent where it is required, including for marketing by email and WhatsApp, and you record the source and wording of that consent when you import contacts.
• You honour opt-outs and data subject requests, using Kedova’s tools or with our help.
• You do not upload sensitive personal data (such as health, financial or biometric data, or data about children) unless it is necessary and lawful, and you have told us in writing.

5. Our obligations

• Confidentiality. Korevra ensures that people authorised to process Customer Personal Data are bound by confidentiality.
• Security. Korevra implements the technical and organisational measures in Annex B and keeps them appropriate to the risk.
• Assistance. Taking into account the nature of the processing, Korevra helps you respond to data subject requests, carry out data protection impact assessments and consult the NDPC where required.
• Records. Korevra keeps records of its processing activities as a processor.
• Consent ledger. Kedova records proof of consent for subscribers it collects for you (time, source page, consent wording and a hashed IP address) and adds an unsubscribe link to every marketing email.

6. Personal data breaches

Korevra will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Korevra will help you meet your own obligation to notify the NDPC and, where required, data subjects.

7. Sub-processors

You give Korevra general authorisation to engage the sub-processors in Annex C. Korevra will give at least 14 days’ notice, by updating the list on our security page and by email to account owners, before adding or replacing a sub-processor that processes Customer Personal Data. You may object on reasonable data protection grounds; if we cannot resolve the objection, you may terminate the affected service and receive a pro-rata refund of prepaid fees. Korevra imposes data protection obligations on each sub-processor that are no less protective than this agreement and remains responsible for their performance.

8. International transfers

Customer Personal Data is hosted in Google Cloud’s europe-west1 region and may be processed by sub-processors outside Nigeria. Korevra will transfer Customer Personal Data outside Nigeria only on a ground permitted by Part VIII of the NDPA and the GAID, such as adequacy or appropriate safeguards, including contractual clauses.

9. Information and audits

On request, Korevra will make available the information reasonably necessary to demonstrate compliance with this agreement, such as summaries of security controls and third-party certifications of its infrastructure providers. Where that is not sufficient, you may audit Korevra’s compliance once a year, at your cost, with at least 30 days’ notice, during business hours, subject to confidentiality and without access to other customers’ data.

10. Return and deletion

You can export Customer Personal Data from Kedova at any time. When your subscription ends, the data remains readable for 30 days so you can export it, and Korevra then deletes it, except where the law requires it to be kept. Residual copies in rolling backups are overwritten in the normal course.

11. Agencies and their clients

If you are an agency using Kedova for your clients, you may be a processor for your client rather than a controller. In that case you confirm that your client has authorised you to engage Korevra as a sub-processor, and you will flow down terms no less protective than this agreement. Korevra will treat your instructions as your client’s instructions.

12. Liability and order of precedence

Each party’s liability under this agreement is subject to the limitations in the terms of service. If this agreement conflicts with the terms of service on the processing of Customer Personal Data, this agreement prevails.

Annex A — Details of processing

Annex B — Security measures

• Workspace (tenant) isolation enforced on the server for every request.
• Encryption in transit (TLS) and at rest; connected-account tokens sealed with AES-256-GCM under per-workspace keys derived from a master key held in Google Secret Manager; secrets never returned to the browser.
• Role-based access for owners, admins and members; least-privilege access for Korevra staff.
• Audit logging of sensitive actions, including channel connections, publishing-mode changes and contact imports.
• Signed, expiring links for one-tap approvals and unsubscribes.
• Managed infrastructure with automated backups, monitoring and patching provided by Google Cloud.
• Incident response and breach notification procedures (section 6).

Annex C — Sub-processors