SHUP8

Data Processing Terms

Version 1.0 · Last updated 2026-11-04 · SHUP8 Technologies (RC 8792739), Ikeja, Lagos, Nigeria (“SHUP8”, “we”, “us”)

These terms apply when SHUP8 Technologies (“Processor”) processes personal data of a merchant’s customers on behalf of the merchant (“Controller”) through SHUP8. They form part of the Terms & Conditions.

1. Scope

The Processor handles customer names, contact details, delivery addresses, order history and messages that the Controller stores in SHUP8, for the sole purpose of operating the Controller’s shop. The duration is the life of the Controller’s account plus the export period.

2. Controller’s duties

The Controller decides the purposes of processing, has a lawful basis and a privacy notice for its customers, and gives only lawful instructions. The Controller is responsible for responding to its customers’ rights requests, using the tools in the admin panel.

3. Processor’s duties

  • Process data only on the Controller’s documented instructions, including those given through the admin panel, unless the law requires otherwise.
  • Ensure staff with access are bound by confidentiality.
  • Apply appropriate security measures (encryption in transit, access control, backups, monitoring).
  • Assist the Controller with rights requests, security and breach obligations, to the extent reasonably possible.
  • Notify the Controller without undue delay after confirming a personal data breach affecting its data.
  • Delete or return the data at the end of the Service, as described in the Terms.
  • Make available information reasonably needed to show compliance.

4. Sub-processors

The Controller gives general authorisation for the Processor to use sub-processors such as hosting, email/SMS and payment providers. The Processor binds them to equivalent obligations and remains responsible for them. A current list is available on request at [email protected], and we will tell you of material changes.

5. International transfers

Where sub-processors are outside Nigeria, the Processor will use transfer safeguards recognised by the NDPA.

6. Liability

Liability under these terms is subject to the limits in section 15 of the Terms & Conditions.