Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the QApoint Terms of Service ("Agreement") between QApoint Technologies Ltd ("QApoint", "we", "Processor") and the entity using QApoint's services ("Customer", "Controller").

This DPA reflects the requirements of the Nigeria Data Protection Regulation (NDPR) 2019, issued by the National Information Technology Development Agency (NITDA), and the Nigeria Data Protection Act (NDPA) 2023, as well as GDPR-equivalent safeguards for Customers with international obligations.

Where this DPA conflicts with the Agreement, this DPA governs in respect of data protection matters.

• "Personal Data" — any information relating to an identified or identifiable natural person, as defined under NDPR Article 1.3(xxx).
• "Processing" — any operation performed on Personal Data, whether automated or not.
• "Sub-processor" — any third party engaged by QApoint to process Personal Data on the Customer's behalf.
• "Data Subject" — a natural person whose Personal Data is processed under this DPA (e.g., event participants, team members).
• "Services" — the QApoint real-time Q&A platform and all related features accessed by the Customer.

QApoint will assist the Customer in responding to Data Subject requests under NDPR, including:

• Right of access — export of all data held for a Data Subject on request
• Right to erasure — deletion of a participant's questions and data via the Customer admin panel or a written request to QApoint
• Right to correction — amendment of inaccurate personal data
• Right to data portability — export in machine-readable format (CSV, JSON)

Requests should be submitted by the Customer to privacy@qapoint.com. QApoint will respond within 30 days.

Customer data is stored in the region selected during onboarding. QApoint currently offers:

• Nigeria (default) — data stored in AWS af-south-1 (Cape Town) or equivalent African region
• Europe — data stored in AWS eu-west-1 (Ireland)
• United States — data stored in AWS us-east-1 (Virginia)

Where data is transferred outside Nigeria, QApoint relies on Standard Contractual Clauses (SCCs) or equivalent mechanisms as permitted under NDPR Article 2.12 and the NDPA 2023.

QApoint will notify the Customer without undue delay, and in any event within 72 hoursof becoming aware of a personal data breach likely to result in a risk to the rights and freedoms of Data Subjects. Notification will be sent to the Customer's registered email address and will include:

• Nature of the breach and categories of data affected
• Approximate number of Data Subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

The Customer is responsible for notifying NITDA and affected Data Subjects as required under NDPR Section 2.8.

QApoint will make available all information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits conducted by the Customer or a mandated auditor. Audits require at least 14 days' written notice and must be conducted during normal business hours without unreasonably disrupting QApoint's operations.

Each party's liability under this DPA is subject to the limitations set out in the Agreement. QApoint's total liability for claims under this DPA shall not exceed the fees paid by the Customer in the 12 months preceding the claim.

This DPA is governed by the laws of the Federal Republic of Nigeria. Any disputes shall be submitted to the exclusive jurisdiction of the Nigerian courts. For Customers operating under GDPR, this DPA shall also be interpreted in accordance with GDPR requirements.

Enterprise Customers requiring a signed, countersigned DPA should contact legal@qapoint.com. QApoint will provide a signed PDF within 3 business days.

For all other Customers, use of the QApoint Services constitutes acceptance of this DPA as part of the Agreement, as permitted under NDPR and standard SaaS practice.