DPA

This Data Processing Agreement (“DPA”) forms part of the Flisters Terms of Service between Inventivelabs LTD (RC 9758742), the “Processor”, and the customer responsible for the personal data processed through its Flisters workspace, the “Controller”. It applies where we process that data on the customer’s behalf. INVENTIVELABS LTD — NDPC registration ID: NDPC/DCP/14152

“Personal data”, “controller”, “processor”, and “personal data breach” have the meanings given by applicable data-protection law, including the Nigeria Data Protection Act 2023. Where a customer itself acts for another controller, it must be authorized to give us the instructions and permissions in this DPA.

Our independent processing of account administration, Flisters subscription billing, security, and legal records is described in the Privacy Policy. A party’s actual role depends on the processing, not solely on its label in this agreement.

• Subject and purpose: delivering the customer’s property-management workspace, tenancy administration, communication, documents, maintenance, invoices, payment records, and reports.
• Operations: collecting, organizing, storing, retrieving, updating, transmitting to authorized recipients, generating requested output, and returning or deleting records.
• People concerned: tenants, prospective tenants invited by the customer, landlords, managers, emergency contacts, and other people whose details are lawfully included in the records.
• Data categories: identity and contact details, property and tenancy details, lease terms, financial and payment records, communications, maintenance descriptions and attachments, and documents or signing records supplied through the service.
• Duration: the period in which we provide the relevant service, followed by return, deletion, or limited retention as described below.

The service is not intended as a repository for unnecessary sensitive personal data or children’s records. The Controller must identify additional safeguards before supplying information that requires special protection.

The agreement, selected features, workspace settings, and authorized requests constitute the Controller’s documented instructions. We process the relevant data only on those instructions unless a legal obligation requires otherwise. We will inform the Controller of that requirement where the law permits and notify it if we consider an instruction to infringe applicable data-protection law.

The Controller determines lawful purposes and legal bases, provides required notices, obtains required permissions, maintains accurate data, and assigns appropriate access. It must consider whether enabled AI reminders, document sharing, exports, and communications are appropriate for the people and information involved.

We will not use processor-held tenancy data for unrelated advertising or make it generally available to other Inventivelabs brands merely because of shared ownership.

We will limit access to authorized personnel and providers who need it for their role and are subject to appropriate confidentiality duties. We will maintain technical and organizational measures proportionate to the nature of the data and the risks of the processing.

Application safeguards include password hashing, authenticated access, and role and ownership checks. Operational measures must also address secure configuration, access management, incident response, retention, and recovery. Specific requirements beyond the standard service should be documented in a written agreement; this DPA does not claim a particular certification or guarantee that a breach can never occur.

The Controller is responsible for its users, credentials, device security, and handling of downloaded or independently shared records.

The Controller gives general authorization for providers needed to deliver its selected services, subject to appropriate data-protection obligations and oversight. We remain responsible for a subprocessor’s performance of the data-protection obligations we delegate to it.

• Hosting and database providers operate the application and store its records.
• AWS S3 supports uploaded file storage and Resend supports email delivery.
• Google Gemini and OpenAI support AI features when enabled or requested.
• Stripe supports payments and subscription billing; OPay supports manager-connected online invoice payments; Google supports optional sign-in. These providers may act independently for some processing, rather than solely as our subprocessors.

The providers used depend on the deployed service and selected features. Contact us for the current relevant provider and transfer information. We will provide advance notice of intended additions or replacements of subprocessors, allowing a reasonable opportunity to raise substantiated data-protection objections before the change. We will work to resolve an objection or discuss an appropriate alternative or termination of the affected service.

Providers may process data outside Nigeria. We will make transfers only under an applicable lawful transfer basis and required safeguards, and require equivalent safeguards for relevant onward processing. We will provide information reasonably needed for the Controller to assess those safeguards. This agreement does not represent that all records are hosted in Nigeria or in a particular named region.

Taking account of the nature of processing and information available to us, we will reasonably assist the Controller with data-subject requests, security obligations, impact assessments, and required regulator consultations. If we receive a request concerning data held solely on the Controller’s instructions, we will direct it to the Controller or act under its authorized instructions unless the law requires another response.

We will notify the Controller without undue delay after becoming aware of a personal data breach affecting its data. We will provide available information about the incident, affected data, likely consequences, and response measures, and supplement it as investigation progresses. The Controller remains responsible for its own notifications; our assistance must not prevent either party from meeting its legal duties.

On the end of the affected service, the Controller may request return or deletion of processor-held personal data. We will agree a practical method and timeframe, taking account of the request, available export formats, and applicable law. The Controller should preserve necessary records before ending access.

Data that must be retained by law or for a valid legal hold will be restricted to that purpose. Residual backup copies remain protected and are removed through the applicable backup lifecycle. The parties will address any retention exception in the response to the request. Cancelling billing or marking a tenant as vacated is not itself an instruction to erase the tenancy ledger.

We will make available information reasonably needed to demonstrate our compliance with this DPA and cooperate with required audits or inspections. Arrangements should protect security, confidentiality, and other customers’ data while allowing meaningful assessment. Any practical arrangements must not undermine a regulator’s lawful powers.

This DPA takes priority over inconsistent service terms about processing on the Controller’s behalf. Changes affecting that processing will be communicated appropriately and must preserve applicable statutory protections. Other service matters remain governed by the Terms or a separately signed agreement.

Contact Inventivelabs LTD (RC 9758742) at privacy@flisters.com for personal-data requests or legal@flisters.com for legal matters. You can also use our contact form. Identify Flisters and the issue or right you want to raise. For privacy requests, include the email address associated with your account or tenancy so we can locate the relevant records. Do not include passwords or full payment-card details.

We may request proportionate information to verify your identity or authority before disclosing or changing personal data. We respond within the period required by applicable law and explain any lawful refusal, extension, or information we must retain.