Sonnywebs International
Website: www.sonnywebs.com.ng
Email: info@sonnywebs.com.ng
Phone: +2349031120248
Effective Date: 4th March, 2026
1. PARTIES
This Data Processing Agreement (“Agreement” or “DPA”) is entered into between:
Sonnywebs International
(“Processor”)
AND
[Client Name]
(“Controller”)
This Agreement forms part of and is subject to the main Service Agreement between the Parties.
2. PURPOSE
This DPA governs the processing of Personal Data by Sonnywebs International on behalf of the Client in connection with services such as:
- Website Design & Development
- E-Commerce Development
- SEO & Digital Marketing
- CRM Integration
- Hosting & Maintenance
- AI Chatbot Integration
- Data Management Services
This Agreement ensures compliance with:
- General Data Protection Regulation (GDPR)
- UK GDPR (where applicable)
- Nigeria Data Protection Regulation (NDPR)
- Other applicable data protection laws
3. DEFINITIONS
For the purposes of this Agreement:
- Controller: The entity that determines the purposes and means of processing Personal Data.
- Processor: The entity that processes Personal Data on behalf of the Controller.
- Personal Data: Any information relating to an identified or identifiable natural person.
- Data Subject: The individual whose Personal Data is processed.
- Processing: Any operation performed on Personal Data (collection, storage, use, transfer, deletion, etc.).
4. SCOPE OF PROCESSING
4.1 Nature of Processing
Processing may include:
- Collection
- Storage
- Structuring
- Hosting
- Analysis
- Transmission
- Deletion
4.2 Categories of Data Subjects
- Website visitors
- Customers
- Employees (if applicable)
- Subscribers
- Business contacts
4.3 Categories of Personal Data
- Name
- Email address
- Phone number
- Billing information
- IP address
- Device data
- User activity data
5. PROCESSOR OBLIGATIONS
Sonnywebs International agrees to:
5.1 Process Data Only on Documented Instructions
Personal Data shall only be processed according to the Controller’s written instructions.
5.2 Confidentiality
Ensure that persons authorized to process Personal Data are bound by confidentiality obligations.
5.3 Security Measures (GDPR Article 32 Compliance)
Implement appropriate technical and organizational measures including:
- SSL encryption
- Secure hosting infrastructure
- Access control systems
- Password protection
- Firewalls and system updates
- Backup and recovery systems
5.4 Sub-Processors
The Processor may engage sub-processors (e.g., hosting providers, payment processors, analytics services).
The Processor shall:
- Ensure sub-processors are contractually bound to data protection obligations
- Remain responsible for sub-processor compliance
Upon request, the Controller may receive a list of sub-processors.
6. INTERNATIONAL DATA TRANSFERS
If Personal Data is transferred outside the EEA or UK, the Processor shall ensure appropriate safeguards, such as:
- Standard Contractual Clauses (SCCs)
- Data Processing Agreements
- Secure transfer protocols
7. ASSISTANCE TO CONTROLLER
The Processor shall assist the Controller in:
- Responding to Data Subject requests (access, deletion, rectification, portability)
- Conducting Data Protection Impact Assessments (DPIA)
- Meeting regulatory compliance obligations
- Managing data breach notifications
8. DATA BREACH NOTIFICATION
In the event of a Personal Data breach, the Processor shall:
- Notify the Controller without undue delay
- Provide relevant details about the nature of the breach
- Assist in mitigation efforts
- Support required regulatory reporting
9. DATA RETENTION & DELETION
Upon termination of services, the Processor shall:
- Return Personal Data to the Controller OR
- Securely delete all Personal Data
Deletion shall occur unless retention is required by law.
10. AUDIT RIGHTS
The Controller may request reasonable documentation to verify compliance with this Agreement.
Formal audits must:
- Be conducted with reasonable notice
- Not disrupt business operations
- Be limited to once per year unless required by law
11. LIABILITY
Each Party’s liability under this Agreement shall be subject to the limitations outlined in the primary Service Agreement.
12. GOVERNING LAW
This Agreement shall be governed by:
- The laws applicable under the main Service Agreement, and
- Applicable international data protection regulations (GDPR, NDPR, etc.)
13. TERM
This DPA remains in effect for the duration of the Service Agreement and until all Personal Data is returned or deleted.
14. SIGNATURES
For the Controller:
Name: ___________________________
Title: ___________________________
Signature: ________________________
Date: ____________________________
For Sonnywebs International (Processor):
Name: ___________________________
Title: ___________________________
Signature: ________________________
Date: ____________________________