Data processing agreement

Effective: 14 October 2026

This Data Processing Agreement forms part of the Terms of Service between The Owl Company Limited ("Processor", "we") and the business using Adello ("Controller", "you"). It applies to personal data within Customer Data that we process for you ("Personal Data"). Words defined in the Terms have the same meaning here. If this Data Processing Agreement conflicts with the Terms on data protection, this Data Processing Agreement prevails.

Contents

1. Roles
2. Details of the processing
3. Our instructions
4. Confidentiality
5. Security
6. Sub-processors
7. Helping you
8. Personal data breaches
9. Deletion and return
10. International transfers
11. Audits
12. Liability

1. Roles

You are the controller of Personal Data and decide why and how it is used. We are your processor and process Personal Data only on your behalf. You are responsible for having a lawful basis for the Personal Data you put into Adello and for giving any notices and obtaining any consents required, including to Your Clients.

2. Details of the processing

• Subject matter and purpose: providing the Service: storing, organising, displaying, generating, sending and backing up Customer Data, and supporting and securing the Service.
• Duration: while you use the Service, plus the deletion periods in section 9.
• Data subjects: Your Clients and their contacts, your Authorised Users, and other individuals whose data you put into the Service.
• Types of data: names, business names, email addresses, phone numbers, postal addresses, tax or registration numbers, bank details, transaction and document details, signatures and messages.
• Special categories: none are intended. You must not put sensitive personal data into the Service unless it is necessary and lawful.

3. Our instructions

We process Personal Data only on your documented instructions, which are these Terms, this Data Processing Agreement and your use and configuration of the Service, unless the law requires otherwise; in that case we will tell you first where the law allows. We will tell you if we believe an instruction breaks data protection law.

4. Confidentiality

We ensure that anyone we authorise to process Personal Data is bound by confidentiality and accesses it only as needed to provide, support or secure the Service.

5. Security

We maintain appropriate technical and organisational measures, including encryption in transit, logical separation of each business's data with database access rules, restricted and logged administrative access protected by two-step verification, regular backups, and processes to detect and respond to incidents. We may update these measures provided overall protection is not reduced.

6. Sub-processors

You authorise us to use the sub-processors listed on our sub-processors page. We bind each one to data protection terms that offer at least the same level of protection as this Data Processing Agreement and remain responsible for their performance. We will update that page before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us within 14 days; if we cannot address the objection, you may stop using the affected part of the Service or close your account.

7. Helping you

Taking into account the nature of the processing, we will help you respond to requests from data subjects (most of which you can handle yourself in the Service), and provide reasonable assistance with security, breach notifications, impact assessments and consultations with regulators. If a data subject contacts us directly about Personal Data, we will refer them to you.

8. Personal data breaches

We will notify you without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting your Personal Data, with the information reasonably available to help you meet your obligations. Notifying you is not an admission of fault.

9. Deletion and return

You can export Customer Data at any time during your subscription. After your account is closed, we delete Personal Data within a reasonable period (normally 90 days), and from backups as they expire, unless the law requires us to keep it.

10. International transfers

Personal Data is stored mainly in the European Union (Ireland) and may be processed by sub-processors in other countries. We transfer Personal Data out of Nigeria only with safeguards permitted by the Nigeria Data Protection Act 2023 and, where applicable, the General Data Protection Regulation, such as standard contractual clauses.

11. Audits

We will make available information reasonably necessary to show compliance with this Data Processing Agreement, such as answers to security questionnaires and summaries of our measures. Any further audit must be agreed in advance, be reasonable in scope and frequency, protect the confidentiality of other customers and our systems, and be at your cost.

12. Liability

Each party's liability under this Data Processing Agreement is subject to the limitations and exclusions in the Terms.