Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Yemoko Terms of Service between Yemoko LLC and the Customer. It applies whenever Yemoko processes personal data on the Customer's behalf.

1. Scope, parties and precedence

1.1 Parties. "Yemoko" means Yemoko LLC, Texas, USA. "Customer" means the business that accepted the Terms of Service.

1.2 Scope. This DPA covers "Customer Personal Data": personal data in the Customer Data defined in the Terms of Service that Yemoko processes to provide the service. Examples are the Customer's clients, vendors, employees and contractors. It does not cover personal data Yemoko processes as a controller for its own purposes (for example users' sign-in details and Yemoko's own billing), which the Privacy Policy covers.

1.3 Definitions. "Data Protection Laws" means every law on personal data that applies to the processing, including the EU and UK GDPR, US state privacy laws, and the African laws named in section 9. "Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings in those laws; "service provider" and "business" have their meanings under US state laws. "Subprocessor" means a third party Yemoko engages to process Customer Personal Data.

1.4 Precedence. If this DPA conflicts with the Terms of Service, this DPA prevails for Customer Personal Data. If the Standard Contractual Clauses apply (section 6), they prevail over both.

2. Roles and the Customer's instructions

2.1 Roles. The Customer is the controller (or, where it acts for its own clients, a processor) of Customer Personal Data. Yemoko is its processor (or subprocessor) and, under US state laws, its service provider.

2.2 Instructions. Yemoko processes Customer Personal Data only on the Customer's documented instructions. These are: the Terms of Service, this DPA, and what the Customer and its users do in the app (for example sending an invoice, running payroll or connecting a payment provider). Yemoko may also process data where the law requires it; it will tell the Customer first unless the law forbids that.

2.3 Unlawful instructions. Yemoko will tell the Customer if, in its opinion, an instruction breaks Data Protection Laws, and may decline to follow it.

2.4 Customer responsibilities. The Customer is responsible for having a lawful basis for the personal data it puts into Yemoko, for giving data subjects the notices the law requires, and for any registrations, declarations or authorizations its local regulator requires (see section 9). The Customer will enter Social Security numbers, tax IDs and bank details only in the fields designed for them.

2.5 No other use. Yemoko will not sell or share Customer Personal Data, use it for its own purposes (including advertising or training AI models), or combine it with data from other sources, except as this DPA allows. De-identified, aggregated statistics that cannot identify anyone are not Customer Personal Data.

3. Yemoko's obligations

3.1 Confidentiality. Only people who need access to provide, secure or support the service may access Customer Personal Data, and each is bound by a duty of confidentiality.

3.2 Security. Yemoko maintains the technical and organizational measures in Annex II. It may update them, but not in a way that lowers the overall level of protection.

3.3 Data subject requests. If a data subject contacts Yemoko about Customer Personal Data, Yemoko will pass the request to the Customer and will not answer it itself unless the Customer asks. The app lets the Customer find, correct, export and delete records. Where that is not enough, Yemoko will provide reasonable help, taking into account the nature of the processing.

3.4 Impact assessments and regulators. Yemoko will give the Customer reasonable information and help for data-protection impact assessments and consultations with regulators about the service.

3.5 Records. Yemoko keeps the records of processing that Data Protection Laws require of a processor and makes them available to regulators on request.

4. Subprocessors

4.1 General authorization. The Customer authorizes Yemoko to use the subprocessors in Annex III and on the public Subprocessor List. Those marked "only when enabled" (Flutterwave, CinetPay, TaxJar, vatlayer) receive Customer Personal Data only after the Customer turns them on.

4.2 Subprocessor terms. Yemoko has a written agreement with each subprocessor that protects Customer Personal Data at least as well as this DPA, and remains responsible to the Customer for each subprocessor's performance.

4.3 New subprocessors. Yemoko will give at least 30 days' notice by email to the company owner, and on the Subprocessor List, before a new subprocessor processes Customer Personal Data. The Customer may object in writing to support@yemoko.com within that period, on reasonable data-protection grounds. If the parties cannot resolve the objection, the Customer may stop using the affected feature or terminate the Terms of Service, and Yemoko will refund any prepaid fees for the unused period after termination. In an emergency (a security incident or a provider shutting down), notice may be shorter, with the reason given.

4.4 Providers the Customer contracts with directly. Stripe, Flutterwave, CinetPay and Plaid also act under their own agreements with the Customer, for example the Stripe Connected Account Agreement or a Flutterwave or CinetPay merchant agreement. For processing under those agreements, the provider is not Yemoko's subprocessor, and the Customer's agreement with the provider governs.

5. Personal data breaches

5.1 Notice. Yemoko will notify the Customer's owner without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

5.2 Content. The notice will describe, as far as then known: what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Yemoko will send further details as it learns them.

5.3 Response. Yemoko will take reasonable steps to contain the breach and limit its effects, and will help the Customer meet its own duties to notify regulators and data subjects. Notifying a breach is not an admission of fault.

6. International transfers

6.1 Where data is processed. Customer Personal Data is stored in the United States (Oregon). Subprocessors may process it in the countries shown in Annex III.

6.2 EEA. For transfers of personal data subject to the EU GDPR to Yemoko, the parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where it is a processor. The following options apply: the docking clause (Clause 7) applies; Clause 9(a) Option 2 (general authorization, with the 30 days' notice in section 4.3); the optional wording in Clause 11 does not apply; Clause 13 follows the Customer's establishment; Clauses 17 and 18 choose the law and courts of Ireland. Annexes I to III of this DPA complete the Clauses' annexes.

6.3 UK and Switzerland. For UK data, the UK International Data Transfer Addendum to the Clauses applies, with the parties' details from this DPA and either party able to end it as the Addendum allows. For Swiss data, the Clauses apply with references to the GDPR read as the Swiss Federal Act on Data Protection and the competent authority being the Federal Data Protection and Information Commissioner.

6.4 Other countries. Where another law restricts transfers (for example in Nigeria, Kenya, South Africa, Ghana, Côte d'Ivoire, Senegal, Cameroon or the Democratic Republic of the Congo), the commitments in this DPA serve as the contractual safeguards that law recognizes. Yemoko will sign any further standard clauses a regulator issues for that purpose, and will give the information the Customer needs to obtain any transfer authorization its regulator requires (section 9).

6.5 Onward transfers. Yemoko transfers Customer Personal Data to subprocessors outside the country of origin only with safeguards equivalent to this section.

7. Audits

7.1 Information. On written request, Yemoko will provide the information reasonably needed to show compliance with this DPA, including written answers to security questionnaires once a year.

7.2 Audits. If that information is not enough, or a regulator requires it, or after a personal data breach, the Customer may audit Yemoko's compliance once a year. The audit needs 30 days' notice, takes place during business hours, is limited to Yemoko's own systems and is performed by the Customer or an independent auditor bound by confidentiality. The Customer bears its own costs. It must not access other customers' data or compromise security.

8. Return and deletion

8.1 During the subscription. The Customer can export its data from the app at any time (Terms of Service 4.5).

8.2 After cancellation. Yemoko keeps a cancelled company's data for 12 months so the Customer can resubscribe or ask for an export. It then deletes the data after 30 days' notice to the owner.

8.3 Deletion on request. The owner may ask Yemoko to delete the company at any time. The data is permanently deleted 30 days later, unless the owner withdraws the request within that period.

8.4 Exceptions. Yemoko may keep Customer Personal Data longer only where the law requires it, and then only for that purpose, keeping it confidential and protected under this DPA. On request, Yemoko will confirm deletion in writing.

9. Region-specific terms

The terms below apply in addition to the rest of this DPA when the named law applies to the processing. Many African laws ask the controller to register, declare its processing or get authorization before transferring data abroad. Those filings are the Customer's; Yemoko will supply what they need: this DPA, its annexes, and the fact that data is hosted in the United States.

10. Liability, term and governing law

10.1 Liability. Each party's liability under this DPA is subject to the limits and exclusions in section 11 of the Terms of Service, except where Data Protection Laws or the Standard Contractual Clauses do not allow a limit (for example a data subject's own rights under Clause 12 of the Clauses).

10.2 Term. This DPA lasts as long as Yemoko processes Customer Personal Data, including during the retention period in section 8.

10.3 Governing law. Texas law governs this DPA, as in the Terms of Service, except that the Standard Contractual Clauses are governed by the law named in section 6.2, and any mandatory local data-protection law applies as section 9 describes.

10.4 Changes. Yemoko may update this DPA to reflect changes in law or in the service, with 30 days' notice for a change that reduces the Customer's protection. The Customer may object as in section 4.3.

Annex I: Details of processing

Annex II: Technical and organizational security measures

Annex III: Subprocessors

The current list, with what each provider receives, is the Subprocessor List. At the date of this DPA: