Data Processing Addendum

Effective September 1, 2026

1. Parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service or Order Form (the "Agreement") between Lopterra Services Limited, operating as Presyvo ("Processor," "we," "us"), and the customer entity that subscribes to the Presyvo platform ("Controller," "you," "Customer").

Where the Agreement and this DPA conflict on matters of data protection, this DPA prevails.

2. Definitions

Terms not defined here have the meanings given in Nigeria's data protection law and, where applicable, the EU/UK GDPR and South Africa's POPIA.

"Personal Data," "Processing," "Data Subject," "Controller," and "Processor" carry their meanings under those laws.

"Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller, including hosting providers, email delivery vendors, and payment gateways.

"Customer Personal Data" means Personal Data uploaded to, generated by, or processed within the Presyvo platform under the Controller's account.

3. Subject Matter and Duration of Processing

Subject matter: provision of the Presyvo attendance-tracking platform as described in the Agreement.

Duration: for the term of the Agreement, plus the retention period described in Section 7 of Presyvo's Privacy Policy, after which Customer Personal Data is deleted unless retention is required by law.

4. Nature and Purpose of Processing

Nature: storage, hosting, computation, transmission, and presentation of Customer Personal Data through the Presyvo application and APIs.

Purpose: to deliver the contracted service, including geofenced clock-in/out verification, attendance record-keeping, member and role management, and reporting.

5. Categories of Data Subjects

• Customer's employees and workers added to the Presyvo platform
• Customer's account administrators, managers, and other authorized users

6. Categories of Personal Data

• Identity and contact data: full name, email address, and/or phone number
• Employment data: role/permission tier, work site assignment, reporting structure
• Attendance data: clock-in/clock-out timestamps, GPS coordinates captured at the moment of clock-in, corrections made by a manager or admin
• Account and usage data: login credentials (hashed), device type, app version, basic usage events
• Billing data: organization name, country, and billing status. Full card details are processed directly by Paystack and never reach Presyvo's servers.

Presyvo does not intentionally collect special-category or sensitive personal data (health data, biometric identifiers, national ID numbers) as part of the attendance-tracking service.

7. Sub-processors

The Controller authorizes the Processor to engage the following Sub-processors to deliver the service:

The Processor will notify the Controller of any intended addition or replacement of a Sub-processor that processes Customer Personal Data, giving the Controller a reasonable opportunity to object on data-protection grounds. The Processor remains responsible for the acts and omissions of its Sub-processors as if they were its own.

8. Security Measures

Access control

Visibility into attendance data is scoped by role: Employees see only their own records, Managers see their assigned team, and Admins/Super Admins see organization-wide data. Presyvo staff cannot view individual attendance records without a legitimate operational reason, such as a support request.

Encryption

Connections between the Presyvo app and its servers are encrypted in transit. Card payment details are never stored on Presyvo's own infrastructure, being handled entirely by Paystack.

Location data handling

Location is accessed only at the moment of clock-in or clock-out, never continuously or in the background, and is used solely to verify presence within a configured work site.

9. Data Subject Rights

The Processor will assist the Controller in fulfilling Data Subject requests, including rights of access, rectification, erasure, restriction, and objection, as described in Section 8 of Presyvo's Privacy Policy.

Where a Data Subject contacts the Processor directly with a request relating to Customer Personal Data, the Processor will forward the request to the Controller, unless legally required to respond directly.

10. International Transfers

Where Personal Data is transferred outside the country in which it was originally collected, for example through Sub-processors operating in other regions, the Processor relies on those Sub-processors' own contractual safeguards and, where required by applicable law, mechanisms such as Standard Contractual Clauses.

11. Breach Notification

The Processor will notify the Controller without undue delay after becoming aware of a Personal Data breach affecting Customer Personal Data, describing the nature of the breach, the categories and approximate number of affected Data Subjects, and the measures taken or proposed in response.

Notification to a regulator or to Data Subjects remains the Controller's responsibility, unless otherwise agreed in writing.

12. Audits

The Processor will make available to the Controller information reasonably necessary to demonstrate compliance with this DPA. On-site or third-party audits may be requested on reasonable notice, subject to confidentiality safeguards, at the Controller's expense.

13. Term and Termination

This DPA remains in force for the duration of the Agreement. On termination, the Processor will delete Customer Personal Data in line with the retention terms in Section 7 of the Privacy Policy, unless a longer retention period is required by applicable law.

14. Governing Law

This DPA is governed by the laws of the Federal Republic of Nigeria, without prejudice to the rights of data subjects under GDPR or POPIA where those laws apply concurrently to the processing in question.

Request a signed copy

Contact

Email: info@presyvo.com
Business name: Lopterra Services Limited
Address: 23 Tokunbo Alli Street, Ikeja, Lagos, Nigeria