Data Processing Agreement

Last updated Nov 4, 2026 · Version 1

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Customer", the controller) and PFC Tek (the "Processor"). It applies whenever we process personal data on your behalf while providing pfcloud, for example personal data inside databases we back up or files we copy during a site move.

1. Scope

We process Customer personal data only to provide the Service: running scripts you ask for, making and storing backups, copying sites between your servers, and showing logs and reports. The data subjects and categories of data are those in your applications, which you decide.

2. Instructions

We process Customer personal data only on your documented instructions, which are these Terms, your settings and the actions you take in the Service, unless the law requires otherwise (in which case we will tell you first where allowed).

3. Confidentiality

Everyone at PFC Tek who can access Customer personal data is bound by confidentiality. Staff access is limited to what is needed for support and is recorded.

4. Security

We apply the measures in our Security Policy, including encryption of backups and secrets at rest, encrypted transfers, access controls, two-factor authentication for staff and a tamper-evident audit log.

5. Sub-processors

You authorise us to use sub-processors for hosting, storage, email delivery and payments. We bind them to data protection terms at least as protective as this DPA and remain responsible for them. We will give notice of new sub-processors, and you may object on reasonable grounds.

6. Assistance

We will help you, taking into account the nature of the processing, to answer data subject requests, and with security, breach notification and data protection impact assessments.

7. Personal data breaches

We will notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer personal data, with the information you need to meet your own obligations.

8. International transfers

Where Customer personal data is transferred outside Nigeria or the EEA, we use safeguards recognised by the applicable law.

9. Deletion and return

When you delete backups, sites or your account, we delete the Customer personal data we hold for them, after the recovery window described in our Privacy Policy, unless the law requires us to keep it. You can download your backups before deleting them.

10. Audits

We will make available the information reasonably needed to show we comply with this DPA. Requests: myforge@steadyridedrivingschool.com.