# Data Processing Agreement (template)

**Version 0.1 (template, not yet signed). Last updated 31 October 2026.**

This Data Processing Agreement ("DPA") forms part of the agreement under which Harmonics Technology Ltd
("Harmonics", "Processor") provides Rodeo (rodeo.so, the Rodeo desktop and mobile apps, and the Rodeo API)
to the customer named below ("Customer", "Controller").

To execute it, fill in the bracketed fields, sign, and send a copy to hello@rodeo.so. Harmonics will
countersign. If anything here conflicts with the main agreement on the processing of personal data, this
DPA prevails.

| | |
|---|---|
| Customer legal name | [ ] |
| Customer address | [ ] |
| Rodeo workspace ID(s) | [ ] |
| Customer privacy contact | [ ] |
| Effective date | [ ] |

---

## 1. Definitions

- **Applicable Data Protection Law** means the Nigeria Data Protection Act 2023 ("NDPA") and its regulations
  and, where they apply to the Customer, the EU GDPR and the UK GDPR.
- **Customer Personal Data** means personal data in content the Customer and its users put into Rodeo
  (pages, databases, comments, files) and in the Customer's workspace membership data.
- **Data Subject**, **Personal Data Breach**, **Processing**, **Controller** and **Processor** have the meanings
  given in the Applicable Data Protection Law.
- **Sub-processor** means a third party that Harmonics engages to process Customer Personal Data.

## 2. Roles and scope

2.1 For Customer Personal Data, the Customer is the controller and Harmonics is the processor. For Rodeo
account data (users' names, email addresses and sign-in records), Harmonics acts as an independent
controller, as described in the Rodeo privacy policy (rodeo.so/privacy).

2.2 Harmonics processes Customer Personal Data only to provide, secure and support Rodeo for the
Customer, and only on the Customer's documented instructions. The agreement, this DPA and the Customer's
use of Rodeo's features are those instructions. Harmonics will tell the Customer if it believes an
instruction breaks the Applicable Data Protection Law.

2.3 Details of the processing:

| | |
|---|---|
| Subject matter | Hosting and operating a collaborative workspace |
| Duration | The term of the agreement, plus the deletion period in section 9 |
| Nature and purpose | Storing, syncing, displaying, searching, sharing and backing up workspace content; optional AI features the Customer's users choose to use; sending notifications the users ask for |
| Types of personal data | Whatever the Customer's users put into the workspace; names and email addresses of workspace members and guests |
| Categories of data subjects | The Customer's staff, contractors and guests, and people mentioned in workspace content |
| Special categories | None intended. The Customer should not store sensitive personal data unless it has assessed that this is appropriate |

## 3. Confidentiality

Harmonics ensures that anyone it authorises to process Customer Personal Data is bound by confidentiality.
Harmonics staff do not read workspace content except to resolve a problem the Customer has reported, to
investigate abuse or a security incident, or when the law requires it.

## 4. Security

4.1 Harmonics maintains technical and organisational measures appropriate to the risk. They are described
at rodeo.so/trust and include:

- workspace isolation enforced on every request, with role-based access (owner, admin, member, guest),
  members-only private spaces, and per-page sharing at view, comment or edit level;
- HTTPS for the website and for the apps' connections to the API;
- passwordless sign-in (Google, Apple or a single-use email link), short-lived access tokens, and rotating
  single-use refresh tokens; sign-in links, refresh tokens and API tokens are stored only as hashes;
- uploaded files stored under random, unguessable keys;
- payment card data handled by Paystack, never by Rodeo.

4.2 Harmonics may update these measures as long as the overall level of protection does not decrease.

## 5. Sub-processors

5.1 The Customer authorises Harmonics to use the Sub-processors listed at rodeo.so/trust. At the effective
date these are:

| Sub-processor | Purpose |
|---|---|
| Microsoft Azure | Hosting the API and real-time collaboration service, the database, AI features, and email delivery |
| Cloudflare (R2) | Storing uploaded files |
| Netlify | Serving the rodeo.so website and web app (static files) |
| Paystack | Payment processing |
| Expo, Apple, Google | Delivering push notifications to the mobile apps |
| Tavily | Web search, only when an AI feature needs one |
| Google, Apple | Sign-in, when a user chooses it |

5.2 Harmonics imposes data protection terms on each Sub-processor that protect Customer Personal Data
to the standard of this DPA, and remains responsible for their performance.

5.3 Harmonics will give the Customer at least 30 days' notice of a new Sub-processor by updating
rodeo.so/trust and emailing the Customer's privacy contact. The Customer may object on reasonable data
protection grounds within that period. If the parties cannot resolve the objection, the Customer may
terminate the affected service and receive a pro-rata refund of prepaid fees.

## 6. International transfers

Rodeo's infrastructure is hosted outside Nigeria. Where Customer Personal Data is transferred out of Nigeria
(or out of the EU or UK), Harmonics relies on a transfer mechanism permitted by the Applicable Data
Protection Law, such as adequacy, standard contractual clauses or another appropriate safeguard under
Part VIII of the NDPA.

## 7. Data subject requests and assistance

7.1 Rodeo lets the Customer access, correct, export (pages as Markdown or HTML) and delete content
directly. If Harmonics receives a request from a Data Subject about Customer Personal Data, it will pass
the request to the Customer and not respond itself, unless the law requires otherwise.

7.2 Harmonics will reasonably assist the Customer with data protection impact assessments and with
consultations with the Nigeria Data Protection Commission or another supervisory authority, taking into
account the nature of the processing and the information available to Harmonics.

## 8. Personal Data Breaches

Harmonics will notify the Customer without undue delay, and in any case within 48 hours, after becoming
aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe what happened,
the data and Data Subjects likely affected, the likely consequences, and the measures taken or proposed.
Harmonics will give the Customer the information it reasonably needs to meet its own obligation to notify
the Nigeria Data Protection Commission within 72 hours under section 40 of the NDPA.

## 9. Deletion and return

Before the agreement ends, the Customer can export its content. Within 30 days of the Customer's written
request at the end of the agreement, Harmonics will permanently delete the Customer's workspaces and their
files. (When a workspace owner deletes their Rodeo account, workspaces only they own are archived and
permanently deleted, with their files, 30 days later.) Data in backups is overwritten on the backup
provider's normal schedule. Harmonics may keep data the law requires it to keep, protected
under this DPA for as long as it is kept.

## 10. Audits

On request, and no more than once a year unless a supervisory authority requires it or after a Personal
Data Breach, Harmonics will answer the Customer's reasonable written security questionnaire and provide
the information needed to show compliance with this DPA.

## 11. Liability and term

Each party's liability under this DPA is subject to the limits in the agreement. This DPA lasts as long as
Harmonics processes Customer Personal Data.

---

| Customer | Harmonics Technology Ltd |
|---|---|
| Name: | Name: |
| Title: | Title: |
| Signature: | Signature: |
| Date: | Date: |

*This template is provided for convenience and is not legal advice. Have it reviewed by counsel before signing.*