Data Processing Agreement

Parties

Data Controller

Bodiop Ltd
Owner: Jean Bosco Ndayishimiye
Registered with the Rwanda Development Board
Address: Kigali, Rwanda (virtual operation)
Email: privacy@bodiop.rw  ·  WhatsApp: +250 781 408 443

Data Processor

Each vendor / service provider that processes personal data on behalf of Bodiop Ltd, including: n8n, OpenAI, Twilio, Hetzner, Google Sheets / Airtable, MTN MoMo, and Airtel Money.

1. Purpose and Scope

The Processor will process Personal Data on behalf of the Controller in order to provide the following services:

• n8n — automation of opportunity alert workflows
• OpenAI — AI-powered scam filtering, personalization and enrichment
• Twilio — WhatsApp message delivery
• Hetzner Cloud — secure hosting and data storage
• MTN MoMo / Airtel Money — payment processing
• Google Sheets / Airtable — database management

2. Obligations of the Processor

The Processor agrees to:

• Process Personal Data only on documented instructions from the Controller
• Ensure all authorized persons are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures including encryption, access control, regular audits, and pseudonymization where possible
• Not engage any sub-processor without prior written consent of the Controller
• Assist the Controller in responding to Data Subject requests within 7 days
• Notify the Controller within 48 hours of becoming aware of any Personal Data Breach
• Delete or return all Personal Data after end of services, unless required by law
• Allow for annual audits at the Controller's request

3. Obligations of the Controller

Bodiop Ltd shall provide clear processing instructions, ensure a lawful basis exists before transferring data, and remain responsible for the lawfulness of the processing.

4. International Transfers

Where a Processor is located outside Rwanda (e.g. OpenAI in the USA, Hetzner in Germany), appropriate safeguards are in place including Standard Contractual Clauses approved by the NCSA, adequacy decisions, or other measures recognised under the DPP Law.

5. Duration and Termination

This DPA remains in effect for as long as the Processor processes Personal Data on behalf of Bodiop Ltd, and for 2 years thereafter for audit purposes. In case of breach, Bodiop Ltd may terminate the main service agreement with immediate effect.

6. Governing Law

This DPA is governed by the laws of the Republic of Rwanda. Any disputes shall be submitted to the courts of Kigali.