NDPA modules · Who touches your data
Nine suppliers. Nineteen other companies came with them.
Your processors have processors. Nine of those nineteen arrived without you being told, and four more changed in February on a list nobody countersigned. Only six of the nine hold a processing agreement that is still in force.
Tier one · nine suppliers you chose
- Amazon Web ServicesArticle 28 signed
- ZendeskArticle 28 signed
- Intuit MailchimpArticle 28 signed
- Twilio SegmentTheir terms only
- Kuda Collections LtdNothing on file
- Verifyme NigeriaArticle 28 signed
- PaystackArticle 28 signed
- SentryArticle 28 signed
- Lagos Data CentreAgreement lapsed
Tier two · nineteen sub-processors, mostly unnamed to you
- Amazon Web Services EMEA: Changed, not countersigned
- Amazon Web Services EMEA: Changed, not countersigned
- Amazon Web Services EMEA: Changed, not countersigned
- Amazon Web Services EMEA: Changed, not countersigned
- Zendesk: Accepted
- Zendesk: Accepted
- Intuit Mailchimp: Never told
- Intuit Mailchimp: Never told
- Intuit Mailchimp: Never told
- Twilio Segment: Never told
- Twilio Segment: Never told
- Twilio Segment: Never told
- Twilio Segment: Never told
- Twilio Segment: Never told
- Twilio Segment: Never told
- Verifyme Nigeria: Accepted
- Paystack: Accepted
- Paystack: Accepted
- Functional Software (Sentry): Accepted
- Accepted
- Changed, not countersigned
- Never told
The nine, and what stands behind each
Their standard terms are not Article 28 terms
Clicking accept on a sign-up flow gives you a commercial contract, not a processing agreement. Six of these nine hold a real Article 28 agreement. One has their standard terms, one has nothing, one lapsed in 2023 — and two have nobody’s name against them at all.
| Processor | Agreement | Last reviewed | Owner |
|---|---|---|---|
| Amazon Web Services EMEAHosts the core database and backups | Article 28 | Feb 2026 | Segun Okoro |
| ZendeskSupport tickets, and whatever customers paste into them | Article 28 | Jan 2026 | Ngozi Eze |
| Intuit MailchimpSends marketing email to lapsed customers | Article 28 | Never | Blessing Uche |
| Twilio SegmentCollects agent app events and forwards them onward | Their terms only | Never | Unassigned |
| Kuda Collections LtdChases overdue loans by phone and SMS | Nothing on file | Never | Unassigned |
| Verifyme NigeriaChecks BVN and NIN at sign-up | Article 28 | Mar 2026 | Tunde Adeyemi |
| PaystackTakes card payments on the website | Article 28 | Jun 2026 | Segun Okoro |
| Functional Software (Sentry)Collects crash reports from the apps | Article 28 | May 2026 | Segun Okoro |
| Lagos Data Centre ServicesShreds paper records collected from branches | Lapsed 2023 | Never | Adaeze Nwosu |
PRO-005 · Kuda Collections
There is no access to revoke, because you never gave any
Every month a spreadsheet of names, phone numbers and outstanding balances goes to a collections agency. No contract, no integration, no log of what they kept — and nothing you could switch off tomorrow if you wanted to.
This is the arrangement that never appears in a vendor review, because it does not look like a vendor. It looks like an email.
What leaves, every month
- Full names
- 1,204
- Phone numbers
- 1,204
- Outstanding balances
- 1,204
- Sent by
- Email attachment
No way to recall it, no record of deletion
Which is why an access request cannot be answered in full, and why an erasure request cannot be honoured at all.
Six things the agreement has to say
A processor that decides anything is not a processor
The distinction is not paperwork. If your supplier decides what to do with the data rather than following your instructions, they are a controller too — and they answer for it directly, alongside you.
Paystack is genuinely both, for different parts of what it does. Asiri records that rather than flattening it, because assuming otherwise puts a liability in the wrong place.
They act only on your instructions
And nothing else. The moment they decide a purpose of their own, the agreement no longer describes what is happening.
Named security measures
Not “appropriate measures” — the actual ones, specific enough that failing to have them is a breach of contract.
No sub-processor without your agreement
Which is the clause the tier-two wall above is testing. Nine of those nineteen arrived without it being honoured.
They help you answer people
Access, correction and erasure requests reach them too. A processor who takes weeks to answer you is the reason you answered the person late, and undue delay is measured against you.
They tell you about a breach, fast
Your seventy-two hours start when they discover it, not when they get around to mentioning it. The contract has to say hours, not “promptly”.
Deletion or return at the end
Stated, dated and evidenced. “We will delete it in due course” leaves you holding a copy you cannot account for.
Ask your two largest suppliers who they use
Then compare the answer with what you accepted. Asiri watches each published sub-processor list and tells you when it changes, which is the only way a chain this long stays honest.