Data Processing Agreement

This agreement forms part of the Terms of Service between Binatec Agency ("KlasPoint", the processor) and each centre using KlasPoint (the controller). It applies to personal data about the centre's students, staff and enquirers that KlasPoint processes to provide the service ("centre data"). It is written to meet the requirements of the Nigeria Data Protection Act 2023.

1. What we process

• Subject matter: providing the KlasPoint service to the centre.
• Duration: while the centre uses KlasPoint, and until centre data is deleted under section 8.
• People concerned: the centre's students, staff, and people who contact the centre through its KlasPoint website.
• Data concerned: names, email addresses, phone numbers, enrolment and payment records, attendance, learning progress, exam, quiz and assignment results, WhatsApp messages with the assistant, device records, and content the centre uploads.
• Purpose: hosting the centre's portal, running classes and assessments, collecting fees, the AI assistant, and support.

2. Our commitments as processor

• We process centre data only on the centre's documented instructions — which include using the features the centre turns on — unless the law requires otherwise, in which case we will tell the centre where the law allows.
• Everyone at KlasPoint with access to centre data is bound by confidentiality.
• We keep each centre's data separated from other centres' at the database level, and protect it with role-based access, encrypted connections and the measures described on our Security page.
• We do not use centre data for our own marketing, and we do not sell it.

3. Sub-processors

The centre authorises us to use these sub-processors, each bound by data-protection terms at least as protective as this agreement:

• Supabase — database, authentication and file storage.
• Flutterwave — payment processing and settlement.
• Anthropic — AI model for the assistant, copilot and question generation.
• Meta (WhatsApp Business Platform) — WhatsApp message delivery.
• Google — sign-in with Google, and advertising on free lecturer accounts only.
• Our cloud hosting provider — application servers.

We will update this list before adding a new sub-processor, so a centre can object; if we cannot address a reasonable objection, the centre may stop using the affected feature or close its account.

4. International transfers

Some sub-processors process data outside Nigeria. We rely on the transfer safeguards the Nigeria Data Protection Act 2023 permits, including contractual protections.

5. Helping the centre meet its obligations

• If we receive a request from a student or staff member about centre data, we will pass it to the centre and help it respond, taking into account the tools KlasPoint provides.
• We will provide reasonable information the centre needs for data protection impact assessments or questions from the Nigeria Data Protection Commission.

6. Personal data breaches

If we become aware of a breach affecting centre data, we will notify the centre without undue delay, with the information we have about what happened, the data affected and the steps we are taking, so the centre can meet its own notification duties.

7. Information and audits

On reasonable request, we will provide information showing how we comply with this agreement. Where that is not enough, we will cooperate with a reasonable audit, at the centre's cost, with reasonable notice and under confidentiality.

8. Return and deletion

When a centre closes its account, it can first export its records. We then delete centre data from our live systems, except where the law requires us to keep it — for example payment records — and remove it from backups as they expire.

9. Contact

Data protection questions: Binatec Agency, Lagos, Nigeria. Email: hello@klaspoint.com.