Businesses use the Rabbar Africa app to keep records about their customers. These terms explain how we look after that data on each business’s behalf, and what each of us is responsible for.
1.Who these terms are between, and when they apply
These Data Processing Terms are between the business that holds an Rabbar Africa account (“you”) and Rabbar Africa Limited (“Rabbar Africa”, “we”, “us”). They form part of our Terms of Service, and you accept them when you accept those terms.
They apply to the personal data you put into the Rabbar Africa app about other people, mainly your customers (“customer data”). For customer data, you are the controller and we are your processor, as those terms are used in the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission’s General Application and Implementation Directive 2025.
They do not cover data about you and your team as our users, which we handle as controller under our Privacy Policy. Where these terms and the Terms of Service conflict on data protection, these terms prevail.
2.What we process, and why
| Topic | Details |
|---|---|
| Purpose | To provide the Rabbar Africa app to you: storing your records, producing invoices, receipts, statements and inspection reports, reminders, exports, the WhatsApp assistant and AI features. Also to support and secure the service. |
| People concerned | Your customers and their contacts, and any vendors and technicians you record. |
| Types of data | Names, phone numbers, email and postal addresses, company names and job titles, dates of birth if you enter them, invoices, payments and notes. For workshops, also vehicle details (make, model, plate number, VIN), vehicle documents and their scans, job cards, and inspection findings and photos. And anything else you type or upload. |
| Sensitive data | The Rabbar Africa app is not designed for sensitive personal data, such as health, religious or biometric data. Do not enter it unless you have a lawful basis to and it is needed for the work. |
| What we do with it | Store, organise, display, search, back up, transmit, and delete it, as the service requires, and as you instruct. |
| How long | For as long as your account is open, and then as section 10 describes. |
3.Your responsibilities
As controller, you are responsible for:
- having a lawful basis to collect and use customer data;
- telling your customers how you use their data, including that you use Rabbar Africa;
- keeping the data accurate and relevant to the work you do;
- answering your customers’ requests to use their rights, with the tools we provide (section 8); and
- deciding who in your team can see what, using the app’s roles and permissions.
4.We act only on your instructions
We process customer data only to provide the Rabbar Africa app to you. Your instructions are these terms, the Terms of Service, and what you and your team do in the app and the WhatsApp assistant. We do not use customer data for our own purposes, sell it, or use it for advertising.
If the law requires us to process customer data in some other way, we will tell you first, unless the law forbids it. If we believe an instruction of yours breaks data protection law, we will tell you.
5.Who at Rabbar can see customer data
Authorised Rabbar Africa staff can see the records in your workspace and the WhatsApp assistant’s conversation logs. They may use that access only to:
- run, maintain and secure the service;
- investigate errors, misuse or a security incident;
- support you, when you or your team ask for help; and
- meet a legal obligation.
Everyone at Rabbar Africa with this access is bound to keep customer data confidential.
6.Security
We keep technical and organisational measures in place to protect customer data, appropriate to the risk. They include:
- encryption in transit between you and our servers;
- separation of each business’s data, with role-based permissions within a business;
- passwords stored only as one-way hashes;
- daily backups, encrypted before they are stored, and deleted after about 13 months;
- restricted access to our administrative tools, as section 5 describes; and
- a record of every business deletion and customer erasure.
We review these measures as the service changes and as risks change.
7.Sub-processors
You authorise us to use the providers below to help us provide the service. Each is bound by a written agreement to protect the data, on terms no less protective than these, and we remain responsible to you for their work.
| Provider | What it does for us | Where |
|---|---|---|
| Supabase | Hosts our database: all Rabbar Africa account and business records, and WhatsApp assistant activity. | Ireland (EU) |
| Microsoft Azure | Runs the servers that power the Rabbar Africa app and the WhatsApp assistant. | Outside Nigeria |
| Amazon Web Services | Stores our encrypted daily database backups. | Ireland (EU) |
| Vercel | Hosts our website and the Rabbar Africa web app. | United States and global edge network |
| Anthropic | AI that drafts inspection advisories and notes, and reads messages sent to the WhatsApp assistant. | United States |
| Cloudinary | Stores uploaded files: logos, inspection photos, job card attachments, document scans and receipts. | United States |
| Meta (WhatsApp) | Carries messages between you and the WhatsApp assistant. | United States and other countries |
| Resend | Sends our emails: verification codes, password resets, billing notices and statements. | United States |
| Paystack | Processes subscription payments and saved cards, and confirms bank account names. | Nigeria |
| Our business email, and analytics and advertising measurement on our website (not in the Rabbar Africa app). | United States |
Before we add a provider that will process customer data, we will update this list. We will also email account owners at least 14 days before the new provider starts. If you object on reasonable data protection grounds, tell us. If we cannot address your concern, you may close your account.
International transfers. Our database and backups are in Ireland (EU), and several providers are in the United States. We transfer customer data abroad only as sections 41 to 43 of the NDPA allow. We rely mainly on each provider’s data processing agreement.
8.Helping you answer your customers
Your customers have rights under the NDPA, such as to see, correct or erase their data. The Rabbar Africa app lets you meet most requests yourself:
- Access and portability. Export customers, vehicles, invoices, payments, job cards and more from the app.
- Correction. Edit the customer’s record.
- Erasure. Use Erase customer. It deletes the customer’s contact details, vehicles, documents, reminders and files. It removes their name and contact details from job cards and inspections, and keeps invoices and payments as tax law requires. It does not search free-text notes, so check those yourself.
If a customer of yours contacts us directly, we will not answer for you. We will pass the request to you without undue delay. Where you need more help, ask us at info@rabbar.africa and we will help you respond.
9.Personal data breaches
If we become aware of a breach affecting customer data, we will tell you without undue delay, so you can meet your own duty to notify the Nigeria Data Protection Commission within 72 hours. We will tell you what happened, what data and people are affected, the likely consequences, and what we are doing about it. Where we don’t have all of this at first, we will send it as we learn it.
We will take reasonable steps to contain the breach, and help you with any notice you need to give to the Commission or to the people affected.
10.When your account ends
You can export your data at any time before you delete your business. When the owner deletes the business, we delete customer data 14 days later, including its files. The owner can cancel until then. If we close your account, you can ask us for an export within 30 days.
After deletion:
- copies in our encrypted backups are deleted when those backups expire, after about 13 months; and
- we keep a record of what you paid Rabbar Africa for 7 years, as tax law requires. It holds no customer data.
11.Information, assessments and audits
We will give you the information you reasonably need to show you comply with the NDPA as it relates to the Rabbar Africa app. We will also help, where reasonable, with any data protection impact assessment or inquiry from the Nigeria Data Protection Commission.
If that information is not enough, you may audit our compliance with these terms once a year. You must give us reasonable notice, keep what you learn confidential, and bear your own costs. We may ask that an independent auditor carry it out.
12.Liability, changes and disputes
The limits of liability in our Terms of Service apply to these terms, except where the law does not allow them to.
We may update these terms, for example to reflect new guidance from the Commission. We will tell account owners before a material change takes effect. These terms are governed by the laws of the Federal Republic of Nigeria, and disputes are settled as the Terms of Service describe.
13.Contact us
- Data protection questions: info@rabbar.africa
- Phone: +234 916 000 2836
- Post: Rabbar Africa Limited, 49 Akinwunmi Street, Alagomeji, Yaba, Lagos, Nigeria