Data processing agreement

1. What this covers

This agreement applies where Nikcano Global Services processes personal data on your behalf. It forms part of our terms of service and takes effect when you open an account. Where it conflicts with the terms of service on a data protection question, this document wins.

You are the controller. We are your processor. This is not the same relationship as the one described in our privacy notice, which covers the data we hold about you as our customer and where we decide things for ourselves.

2. What we process, and for whom

Subject matter. Running point of sale, stock, anti-theft monitoring and the staff playbook for your business.

Duration. For as long as your account is open, and then through the deletion window in section 9.

Categories of person. Your staff, and your customers where their details are taken for a receipt, a credit account or a debt record.

Categories of data. Staff names, phone numbers, usernames and hashed PINs; webcam snapshots taken on risky checkout actions and during shifts, where switched on; sales, stock movements, counts and cash records written into the signed ledger; customer names and phone numbers where recorded; and recipe and procedure content, including quantities on recipes you have not marked secret.

Special category data. finpo is not built for it and you should not enter it through the service. If your use will involve health data, biometric data, or anything else in a special category, agree it with us in writing first.

3. What we will and will not do

• We process personal data only on your documented instructions. Using the product is an instruction: adding a member of staff, turning on webcam snapshots and choosing an industry template each tell us to process data in a particular way.
• We do not use your staff or customer data for our own purposes, we do not sell it, and we do not use it to train models.
• If we believe an instruction breaks data protection law, we will tell you rather than quietly carry it out.
• Everyone at finpo with access is bound by confidentiality, and access is limited to those who need it to run and support the service.

4. Security

These are the measures actually in place, not a list of intentions:

• Passwords, temporary staff passwords and PINs are hashed with argon2id at the parameters OWASP recommends.
• Ledger events are cryptographically signed and chained, and the database enforces that one cannot be altered or deleted once written.
• Recipe quantities and cost prices are stripped from a response on our server before it reaches anyone without the specific right to see them.
• Data in transit is protected with TLS.
• Workspaces are isolated from each other. A request that does not belong to a workspace is refused rather than filtered.
• Public endpoints are rate limited per visitor and per workspace, so one caller cannot exhaust your credits or degrade the service.
• Significant actions are recorded in an audit log with the actor, the change, the IP address and the browser.
• Support access by finpo staff into your workspace is recorded as staff access in that log and shown in your interface for as long as it lasts.

Recipe quantities are encrypted at the column level with AES-256-GCM, under a key per recipe, wrapped by a key per customer, wrapped by a master key held outside the database. Deleting a customer destroys the customer key, rendering that customer’s encrypted data unrecoverable including in backups taken before the deletion.

Stated plainly so you can assess it: apart from those quantities, the ledger’s tamper evidence and the cost redaction described above, staff and customer records are protected by access control rather than by column-level encryption at rest. If your engagement needs field-level encryption beyond this, raise it with us before you rely on it.

5. Sub-processors

You authorise these. Each is used for the purpose given and nothing else.

• Flutterwave. Payments. Your billing data, not your staff or customers’.
• Our email provider. Delivery of alerts, sign-in codes and the emails a shop chooses to send to its own customers.
• Our hosting and object storage providers. Holding the database and uploaded files, including snapshots.
• Our email provider. Transactional email.
• OpenRouter, and the model providers it routes to, only while your AI add-on is switched on. Answering a question you or your staff ask, using playbook content you have separately marked shareable. A recipe marked secret can never be marked shareable. Nothing reaches this sub-processor while the add-on is off, which it is by default.

We will give you at least 30 days notice before adding or replacing a sub-processor. If you object on reasonable data protection grounds within that time and we cannot resolve it, you may terminate the affected part of the service and we will refund the unused part of what you have paid. We remain responsible to you for what our sub-processors do.

6. International transfers

The database and uploaded files are held on servers we operate, primarily in Nigeria. Several of the sub-processors above operate outside Nigeria, so taking a payment involves a transfer abroad, and we rely on the transfer mechanisms in our agreements with them. Under the Nigeria Data Protection Act you remain responsible for satisfying yourself that those transfers are adequate for your own purposes. Ask us at support@nikcano.com if you need the specifics for an assessment.

7. Helping you meet your obligations

• Requests from individuals. Where a member of staff or a customer asks you for their data, we will help you locate and produce it within a reasonable time. If a request comes to us directly we will not act on it, we will pass it to you.
• Impact assessments. We will give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator.
• Audits. We will answer reasonable questions in writing about how we process your data, once a year, or more often after a breach.

8. Breaches

If we become aware of a breach affecting your data we will tell you without undue delay and in any case within 48 hours, with what we know about what happened, who is affected, the likely consequences and what we are doing. We will keep you updated as we learn more. Notifying your regulator and the people affected is yours to do, because you are the controller, and we will support it.

9. Deletion and return

Ask us for an export of your business’s data at any time while your account is open. When you close a business it is marked for deletion immediately and permanently erased 30 days later. That window is deliberate: it is the undo for a business closed by mistake.

After it runs, the data is gone and we cannot recover it, other than anything we are required by law to keep, such as financial records.

10. Liability

The limits in section 11 of the terms of service apply to this agreement too, other than where the law does not permit them to.

Contact

Nikcano Global Services, trading as finpo. Email support@nikcano.com for anything in this agreement.