1. 1. Scope and roles
This Addendum forms part of the Master Services Agreement between the Client and Petrazim Solutions Ltd. The Client is the Controller of Authorised User personal data. We are the Processor and act only on the Client's documented instructions, which are the Agreement itself and any written direction given through an administrator account.
It applies wherever we process personal data protected by the Nigeria Data Protection Act 2023, the UK GDPR, or the EU GDPR.
2. 2. Subject matter of processing
- Purpose: delivering hosted capability training, progress reporting, facilitator sessions and certification to the Client's people.
- Duration: the term of the Agreement, plus the retention windows in our Privacy Policy.
- Data subjects: the Client's employees, contractors and nominated staff administrators.
- Categories of data: identity and contact details, employment and organisation reference, learning progress and assessment results, session attendance, billing reference, technical and log data.
- No special-category data, financial account data or government identifiers are requested by the platform, and they must not be entered into free-text fields.
3. 3. Our obligations
- Process personal data only for the purposes above and never for our own unrelated purposes.
- Apply the technical and organisational measures set out in our Information Security Policy, including row-level access control, encryption in transit and at rest, least-privilege staff access and role-based portal permissions that flow downward only.
- Bind every person with access to confidentiality obligations.
- Assist the Client with data-subject requests, impact assessments and regulator enquiries, at no charge for reasonable volumes.
- Delete or return personal data at the Client's choice within thirty days of the Agreement ending, unless retention is legally required.
4. 4. Sub-processors
The Client authorises the use of sub-processors for cloud hosting and database services, transactional email delivery, payment processing, calendar and video meeting hosting, meeting-notes generation, AI language and speech services, and community messaging. Each is bound by written terms no less protective than this Addendum, and we remain responsible for their performance.
We give the Client at least thirty days' notice before adding or replacing a sub-processor. The Client may object on reasonable data-protection grounds; if we cannot offer an alternative, the Client may terminate the affected service without penalty for the unused period.
5. 5. International transfers
Transfers outside Nigeria, the UK or the EEA rely on an adequacy decision where one exists, and otherwise on the relevant standard contractual clauses or the UK International Data Transfer Addendum, supported by a transfer risk assessment we make available on request.
6. 6. Security incidents
We notify the Client without undue delay, and in any event within seventy-two hours of becoming aware of a personal data breach affecting its data. The notice describes what happened, the categories and approximate number of records involved, likely consequences, and the containment and remediation steps taken. We do not notify the Client's regulators or data subjects on its behalf unless asked in writing.
7. 7. Audit and evidence
On reasonable written notice, and no more than once a year unless a regulator or a breach requires otherwise, we provide written responses to a security questionnaire and evidence of our controls. On-site or third-party audits are arranged by agreement, during business hours, without disrupting other clients' data.
8. 8. Liability
Liability under this Addendum is subject to the limitations in the Master Services Agreement, except where applicable data-protection law does not permit that limitation.
9. Contact
Write to petrazim.solutions@gmail.com for anything in this document. We answer during Nigerian business hours, Monday to Friday.