Data Processing Agreement

Roles

The customer is the controller of personal data collected from its end users through the 1Sygnal SDKs and dashboard. 1Sygnal is the processor and processes that data only to provide the service and on the customer's documented instructions, which are these terms and the customer's use of the service.

Details of processing

• Data subjects: the customer's end users, survey respondents and team members.
• Data: anonymous and identified user IDs, user attributes, device, app, network and screen information, tracked events, and survey responses.
• Purpose and duration: providing targeted surveys, analytics, webhooks and AI features, for as long as the customer uses the service.

Our obligations

• Keep personal data confidential and limit access to people who need it.
• Apply appropriate technical and organisational security measures, including encryption in transit and access controls.
• Help the customer respond to data subject requests and to carry out its own compliance obligations, taking into account the nature of the processing.
• Notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with details of its nature, the data subjects affected and the steps taken to limit it.
• After the service ends, delete or return the customer's personal data, as the customer chooses, within 30 days, except where the law requires us to keep it. Copies in backups are overwritten within 12 months of deletion.
• Make available information reasonably needed to show compliance with this agreement.

Customer obligations

The customer is responsible for having a lawful basis, and any required consent, to collect and process end-user data through the SDKs, and for telling its end users about that processing in its own privacy policy. 1Sygnal provides settings such as consentRequired and per-survey consent screens to help.

Subprocessors

The customer authorises us to use the subprocessors below. We bind each to data protection terms no less protective than these, and we remain responsible for them. We will tell customers before adding or replacing a subprocessor, and a customer can object on reasonable data protection grounds.

• Cloudflare: Hosting, content delivery, DNS, security and object storage.
• Resend: Transactional email delivery.
• Stripe, Paystack and Bachs: Payment processing, depending on plan and region.
• AI provider (OpenAI-compatible): Generating surveys and analysing free-text responses; the provider does not train on this data.
• Sentry and New Relic: Error and performance monitoring, where enabled.

International transfers

Our primary database is hosted in Europe, and we operate from Nigeria. Where personal data is transferred across borders, we rely on appropriate safeguards required by applicable law, such as standard contractual clauses.

Contact

Gamang Labs Ltd, 2 Igbobi College Access Road, Shomolu, Lagos, Nigeria. [email protected]