Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") forms part of the agreement between a subscribing university or polytechnic (the "Data Controller") and Alphastrive Company Limited, operator of the EduSeat platform (the "Data Processor"), governing the processing of personal data in connection with EduSeat.

2. Scope

This DPA covers the processing of personal data belonging to the Data Controller's students and staff — including names, matric or staff numbers, email addresses, attendance records, location data captured at check-in, and passport photographs — for the purpose of digital attendance management.

3. Processor Obligations

Alphastrive, as Data Processor, agrees to:

• Process personal data only on the documented instructions of the Data Controller, and as necessary to provide the EduSeat service.
• Maintain appropriate technical and organizational security measures to protect personal data.
• Notify the Data Controller of any personal data breach without undue delay, and in any event within 72 hours of becoming aware of it.
• Delete or return all personal data to the Data Controller upon termination of the subscription agreement, except where retention is required by law.

4. Sub-Processors

The Data Controller authorizes EduSeat to engage the following sub-processors:

• Supabase — database hosting and authentication.
• Resend — transactional email delivery.
• Cloudflare — DNS and email routing.
• Sentry — server-side error monitoring.

Each sub-processor is bound by data protection obligations consistent with this DPA.

5. Data Subject Rights

Where a student or staff member exercises their rights of access, correction, or deletion, Alphastrive will provide reasonable assistance to the Data Controller in fulfilling that request, to the extent this is within Alphastrive's control as a processor.

6. Security Measures

• TLS encryption of data in transit.
• Row Level Security (RLS) policies enforcing per-role, per-university data isolation.
• Secure, encrypted storage of authentication credentials and tokens.
• Rate limiting on all public API endpoints to mitigate abuse.

To report a suspected security vulnerability or incident, contact support@eduseat.ng.

7. Data Transfer

Personal data processed through EduSeat is stored in Supabase's EU region infrastructure. Alphastrive will not transfer personal data to a jurisdiction lacking adequate data protection safeguards without the Data Controller's consent.

8. NDPR Compliance

Both parties agree to comply with their respective obligations under the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act 2023 in relation to personal data processed under this DPA.

9. Term

This DPA remains in effect for the duration of the Data Controller's subscription agreement with EduSeat, and terminates automatically upon termination of that agreement.

10. Contact Us

For questions about this DPA, contact contact@eduseat.ng. For technical or security matters, contact support@eduseat.ng.