Data Processing Terms

These Data Processing Terms form part of our Business Terms at https://sabireal.com/legal/business-terms. They apply when we process personal data on behalf of a manufacturer ("you") under the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission's General Application and Implementation Directive (GAID) 2025.

SabiReal is a brand of Worllet Limited, a company registered in Nigeria.

RC number: 7014396.

Address: Port Harcourt, Nigeria.

In these terms, "controller", "processor", "data subject" and "personal data breach" have the meanings given in the NDPA.

You are the controller and we are your processor for:

• warranty registrations and claims that consumers make for your products, which we display your terms for, collect and pass to you;
• Consumer Connect audiences: the WhatsApp numbers and opt-ins of consumers who chose to hear from your brand, and the messages you send them;
• stockist contacts you upload or confirm, such as a shop's name, address and contact person.

You are responsible for having a lawful basis for this processing, for your warranty and campaign terms, and for telling consumers how you use their data.

We decide how personal data is used, and our Privacy Policy at https://sabireal.com/privacy applies, for:

• checks of product codes, including approximate location and the keyed hash used to count repeat checks;
• reports consumers send us about where they bought a product, and any contact details they give us;
• our check line on WhatsApp;
• business accounts, company verification, representative verification, factory inspections, payments and support.

You do not receive reporters' contact details, and market insights show you only aggregated locations with small numbers suppressed, never who checked.

We process personal data for you only to provide the services you turned on, as these terms and your settings describe, and on your other documented instructions. If we think an instruction breaks the NDPA, we tell you and do not follow it until it is resolved.

We do not sell this personal data or use it for our own purposes, except where the law requires it.

Only our staff who need the data to run the service can access it, and they are bound by confidentiality.

We protect the data with technical and organisational measures suited to the risk. These include access controls by role, encrypted connections, keyed hashes in place of raw identifiers where we can, audit records of sensitive and staff actions, and two-person approval for high-risk changes.

We use these service providers to run our services. You authorise us to use them for the processing in these terms:

• Supabase: database, sign-in and file storage;
• Cloudflare: hosting, security, analytics and bot checks;
• Dojah: CAC, NIN and selfie verification;
• Paystack: payments;
• Termii: SMS;
• Resend: email;
• Meta: WhatsApp Business;
• PostHog: product analytics in our staff and business apps;
• Sentry: error reports.

We bind each provider to data protection obligations that protect the data at least as well as these terms. We remain responsible to you for their work. We tell you before we add or replace a provider, and you may object on reasonable data protection grounds by emailing support@sabireal.com with "Sub-processor objection" in the subject line.

If a consumer asks us to access, correct, delete or stop processing data we hold for you, we pass the request to you promptly and do not answer it ourselves unless you ask us to.

We help you respond, for example by finding, exporting or deleting the data. A consumer can stop Consumer Connect messages at any time by replying STOP, and we act on that straight away.

If we become aware of a personal data breach affecting data we process for you, we tell you without undue delay. We give you what we know about the breach, the data and people affected, its likely effects and what we are doing about it, and we update you as we learn more.

The NDPA requires a controller to notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a breach that is likely to put people's rights and freedoms at risk. We give you the information and help you need to meet that duty, and to tell the people affected where the law requires it.

While you use the services, we keep data we process for you for these periods:

• warranty registrations and claims: 365 days after the cover ends;
• a warranty claimant's contact: 730 days after the claim is resolved.

Consumer Connect opt-ins and stockist contacts are kept while the service is on. When you turn a service off or your account closes, we delete the personal data we process for you under that service, or return it to you first if you ask, unless the law requires us to keep it. We keep a record of a consumer's opt-out so that they are not messaged again.

On reasonable notice, we give you the information you need to show that we meet these terms. If that is not enough, you or an independent auditor you appoint may audit our processing, at your cost, during business hours, no more than once a year unless a regulator requires it or a breach has occurred, and subject to confidentiality. An audit must not put other customers' data or our security at risk.

Some of our providers process data outside Nigeria. When they do, we rely on the safeguards the NDPA allows, such as an adequacy decision, contractual clauses, or consent where needed.

For anything about these terms or data we process for you, email support@sabireal.com with "Data processing" in the subject line.