1. Roles
The tenant organisation is the Controller (or a processor acting for a higher-level controller). Careerlinkk Digital Ventures Ltd (RC 9652318) is the Processor for Vendor Content and related onboarding data. Defined terms follow the Nigeria Data Protection Act 2023 (NDPA).
2. Subject matter & duration
Processing covers vendor invitation, document storage, OCR/AI extraction, sanctions screening, risk scoring, approvals, notifications, and audit logging for the term of the subscription and any post-termination retention window set by contract or law.
3. Nature & purpose
Processing is limited to providing VerityChain, securing it, and complying with law. The Processor will not process Personal Data for its own marketing of unrelated products.
4. Types of data & data subjects
May include names, business contact details, identifiers in trade documents, labour certification attributes, and screening-related entity information regarding vendors, their personnel, and customer compliance staff.
5. Processor obligations
- Process only on documented Controller instructions (including configuration in-product).
- Ensure persons authorised to process are bound by confidentiality.
- Implement appropriate technical and organisational security measures.
- Assist with data subject requests, DPIAs, and breach notices where reasonable.
- Delete or return Personal Data after end of services, subject to lawful retention.
- Make available information necessary to demonstrate NDPA compliance and allow audits with reasonable notice.
6. Sub-processors
Controller authorises Careerlinkk Digital Ventures Ltd to engage sub-processors for hosting, storage, email delivery, AI/OCR providers, and payment providers under written contracts imposing equivalent data protection obligations. A current core list is available on request to info@careerlinkk.com.
7. International transfers
Transfers outside Nigeria will use NDPA-appropriate safeguards and, where contracted, respect agreed data residency regions.
8. Breach notification
After becoming aware of a personal data breach affecting Controller Personal Data, Careerlinkk Digital Ventures Ltd will notify the Controller without undue delay.
9. DPCO cooperation
Where either party engages a licensed Data Protection Compliance Organisation (DPCO), both parties will cooperate in good faith for assessments related to this processing activity.
10. Precedence
If there is a conflict between this DPA and other product terms regarding data protection, this DPA prevails. Enterprise MSAs may incorporate stricter schedules for that customer.