Data processing agreement

1. About this summary

Our customers use Vintage People to run payroll, HR and employee self-service. To do that, we process personal data about their employees on their behalf.

Each customer's signed data processing agreement (DPA) forms part of its customer agreement. This page is a summary. If it differs from the signed DPA, the signed DPA applies. To request a copy, email privacy@vintageerp.com.

Vintage ERP is in early access. Data processing terms for Vintage ERP are agreed with each early access customer.

2. Roles

• The customer is the data controller. It decides why and how its employees' personal data is processed. It is responsible for having a lawful basis and for telling its employees how their data is used.
• Vintage Solutions is the data processor. We process the data only to provide the service and only on the customer's instructions.
• Where a customer runs Vintage People on its own servers (an on-premise deployment), the customer runs the system and holds the data. We process that data only if the customer gives us access, for example for support.

3. Subject matter, nature and duration

• Subject matter: providing Vintage People, including payroll, HR and employee self-service, with the hosting, support, backups and security that go with it.
• Nature of the processing: collecting, storing, organising, calculating, displaying, exporting and deleting data as the customer and its users direct through the app.
• Duration: for the term of the customer agreement, and after that until the data is returned or deleted as described below.

4. Data subjects and personal data

Data subjects

• the customer's employees and former employees
• other people the customer pays or manages through the app, such as contractors
• the customer's authorised users of the app
• other people whose details the customer chooses to record, such as emergency contacts

Categories of personal data

• identity and contact details, such as name, date of birth, address, phone number and email
• employment details, such as job title, department, grade, and start and leaving dates
• pay data, such as salary, allowances, deductions, tax and payslips
• statutory identifiers, such as tax identification number, pension PIN and NHF number
• bank account details for salary payments
• leave requests and other self-service records
• user account and activity data, including audit log entries

The customer decides what it records. If it records sensitive personal data, such as health information, it must have a lawful basis to do so under the NDPA.

5. Our obligations as processor

In line with section 29 of the Nigeria Data Protection Act 2023 (NDPA), we:

• process the personal data only on the customer's documented instructions, as set out in the customer agreement, the DPA and the customer's use and settings of the app, and tell the customer if we believe an instruction breaks the NDPA
• make sure everyone we allow to process the data is bound by a duty of confidentiality
• apply the security measures described below
• use sub-processors only as described below
• help the customer respond to requests from data subjects
• help the customer with data protection impact assessments and any consultation with the Nigeria Data Protection Commission (NDPC), where they relate to our processing
• notify the customer of a personal data breach without undue delay
• return or delete the data at the end of the service
• make available the information needed to show we meet these obligations, and allow audits

We do not sell customer personal data or use it for our own marketing.

6. Security measures

• Tenant isolation: each customer company's data is held in its own separate database schema.
• Field-level encryption: sensitive fields, such as statutory identifiers and bank details, are encrypted with AES-256-GCM envelope encryption. The master key is kept outside the database.
• Encrypted connections: the app is served over HTTPS.
• Access control: access is based on each user's role, so users see only what their role allows. Customers can switch on two-factor sign-in and single sign-on (SSO).
• Audit log: changes and sensitive actions are recorded in a hash-chained audit log, so an altered entry can be detected.
• Backups: daily backups are kept for 30 days and a monthly archive is kept for seven years. We test restoring from backup every month.
• NDPA console: the app has tools for subject requests, consent records, retention rules, the record of processing activities and a breach register with a 72-hour clock.
• Data export: customers can export their data at any time.

7. Sub-processors

We use our cloud hosting provider, and the email, SMS and payment-payout providers a customer chooses to connect. The current list of sub-processors is available on request from privacy@vintageerp.com.

We give customers notice before we add or replace a sub-processor, so that they can object. Each sub-processor is bound by data protection terms that protect the data at least as well as the DPA, and we remain responsible to the customer for the sub-processor's work.

8. Subject requests and impact assessments

Customers can handle most requests themselves in the app. The NDPA console records subject requests, and data can be viewed, corrected and exported.

If an employee contacts us directly about data we hold for a customer, we pass the request to the customer and do not answer it ourselves unless the customer asks us to.

We give reasonable help with data protection impact assessments, using information about how the app works and how we protect data.

9. Personal data breaches

If we become aware of a personal data breach affecting a customer's data, we tell the customer without undue delay. We share what we know about the breach, the data and people affected, the likely consequences and the steps taken, and we add more as we learn it.

This lets the customer, as controller, meet its duty under the NDPA to notify the NDPC within 72 hours of becoming aware of a breach that is likely to put people's rights at risk, and to inform the people affected where needed. The breach register in the NDPA console tracks the 72-hour clock.

10. End of the service

Customers can export their data at any time while their agreement is active. When the agreement ends, we return the data in a usable format if the customer asks, and then delete it from our live systems within the period set in the signed DPA, unless the law requires us to keep it.

Copies in backups are deleted as each backup reaches the end of its retention period. Until then they remain protected by the same security measures and are not used for any other purpose.

11. Information and audits

We provide the information a customer reasonably needs to show that the processing meets the NDPA. We allow audits by the customer, or by an auditor it appoints, with reasonable notice and on the terms set in the signed DPA.

12. International transfers

Our cloud hosting provider and the providers a customer connects may store or process data outside Nigeria. Where personal data is transferred outside Nigeria, we rely on an adequacy decision or another lawful transfer basis under Part VIII of the NDPA, with appropriate safeguards in our contracts with sub-processors.

Customers with an on-premise deployment decide where their data is held.

13. Customer responsibilities

As controller, the customer:

• has a lawful basis for the processing and gives its employees a privacy notice
• makes sure its instructions to us are lawful
• keeps user access up to date, including removing users who leave
• sets retention rules that fit its legal duties
• notifies the NDPC and the people affected by a breach where the law requires

14. Contact

To request the signed DPA or the list of sub-processors, or for help with a data protection matter, email privacy@vintageerp.com. Customers can also reach our support team at support@vintageerp.com.