Data Processing Agreement
How Aspian Alliance processes personal data on your behalf when we govern your changes and, where you choose sovereign cells, host your applications, under the Nigeria Data Protection Act 2023, UK GDPR and EU GDPR.
Roles
You are the controller of personal data in your change records, in the systems we connect to, and in any applications we host for you. Aspian Alliance Ltd (RC 9444573) is your processor. Where you are yourself a processor for someone else, we are your sub-processor and these terms pass through.
What we process
| Item | Detail |
|---|---|
| Subject matter | Governing changes to your software: reading deploy events, repository and pipeline metadata, recording approvals and evidence, and producing audit exports. Where you choose sovereign cells or the Aspian service, also hosting, building, running, backing up, monitoring and exporting your applications and their data |
| Duration | The life of your agreement, plus 30 days for export |
| Data subjects | Whoever your applications hold data about: for example your staff, customers, students or patients |
| Categories of data | For change control: names, work emails and identifiers of your people, suppliers and agent keys, and commit and deploy metadata. For hosted applications: whatever they store. Special-category data belongs on Regulated or above |
| Instructions | Your agreement, your workspace settings and your approved plans are your documented instructions |
Where data is stored
- Change records and the audit chain are stored in the region you choose. For hosted applications, databases, volumes, backups, logs, build artefacts and audit records stay in the cell you choose: Lagos, Abuja, London, the EU or your premises.
- Each cell keeps serving and backing up when our central control plane is unreachable.
- Your Trust Page shows the stores the platform observes and where each one sits, with the time each fact was observed.
- Moving data between countries is an irreversible action: it always needs a passkey approval, and two people on Business and above.
Processing outside your country
Some providers process data outside the cell. Each is named, with its country, on the sub-processor list. For organisations in Nigeria, WhatsApp and email messages carry only a reference code and a secure link; the details open after sign-in and stay in the cell.
Our commitments
- Process personal data only on your documented instructions, unless the law requires otherwise, in which case we tell you first where the law allows.
- Make sure everyone with access is bound by confidentiality, and that our operators act through named runbooks and narrow grants.
- Keep the security measures described on Security: sandboxed runtimes, tenant isolation with row-level security, write-only secrets, signed images, passkey approvals and a signed, hash-chained audit trail.
- Tell you without undue delay, and within 48 hours, after we become aware of a personal data breach affecting your data, with what we know and what we are doing.
- Help you answer data subject requests and carry out impact assessments.
- Give you notice before adding or replacing a sub-processor (see below).
- At the end, return your data through an export and then delete it, unless the law requires us to keep it.
Sub-processors
You authorise the sub-processors on the list. We give 30 days’ notice by email before a new one starts processing your data, and you can object. If we cannot address a reasonable objection, you can end the affected service without penalty.
Transfers
- Nigeria (NDPA 2023): transfers out of Nigeria rely on an adequacy decision of the Nigeria Data Protection Commission or another basis the Act allows, such as appropriate safeguards or contractual clauses.
- United Kingdom (UK GDPR): transfers rely on UK adequacy regulations or the International Data Transfer Addendum to the EU standard contractual clauses.
- European Union (EU GDPR): transfers rely on an adequacy decision or the 2021 standard contractual clauses.
Audits
Your Trust Page and evidence packs are the first route: they show signed, platform-computed evidence you can check without asking us. On Regulated and Sovereign, you or an auditor you appoint can also audit us once a year on reasonable notice. An evidence pack maps platform records to a framework; it does not replace an assessment, and we do not claim compliance on your behalf.