Xonbay Data Processing Agreement

Xonbay is a product of Dimarak Limited. This Data Processing Agreement applies between Dimarak Limited, as the operator of Xonbay, and the business that uses Xonbay to process customer or staff personal data on its behalf. Xonbay operates from Achimota, Accra, Ghana. This Agreement supplements the Terms of Service for that processing. The business is identified by its account details and authorised representatives. References to Xonbay’s obligations under this Agreement mean the obligations of Dimarak Limited as the service operator.

The business decides why it collects customer and staff data and how it uses it; Xonbay processes that data to provide the workspace features the business requests. Xonbay separately determines the purposes of platform account management, security, fraud prevention, its own support and marketplace operations. This Agreement does not make those separate activities processing solely on the business’s instructions.

Read the Privacy Policy for Xonbay’s separate handling of platform personal information.

Learn about Dimarak Limited at www.dimarak.com. For matters relating to Xonbay, use the Xonbay contact details in this document.

Business / controller

The business that determines the purposes and use of personal data it submits to the service.

Xonbay / processor

Dimarak Limited, as the operator of its Xonbay product, when handling personal data solely on the business’s documented instructions to provide the service.

Customer Data

Personal information about customers, contacts, staff or other people submitted by or for the business and processed on its behalf.

Subprocessor

A service provider engaged to process Customer Data for Xonbay in delivering the business’s requested service.

Applicable law

Data-protection law applicable to the processing, including Ghana’s Data Protection Act, 2012 (Act 843), and other laws where they apply.

The Agreement, account configuration and authorised use of service features document the business’s instructions. These include uploading files, inviting a team member, publishing a storefront, sending a campaign, sharing a file and deleting content. Xonbay processes Customer Data for those instructions unless applicable law requires otherwise. Where permitted, we inform the business of a conflicting legal requirement.

• The business must have a lawful basis for collecting and submitting Customer Data and must give people the required information about its use.
• It must obtain the required permission for marketing and respect unsubscribe requests.
• It must keep information relevant and accurate, set appropriate team permissions and control the content it publishes or shares.
• It must ensure that its instructions and use of the service comply with applicable law and promptly inform Xonbay if an instruction needs correction.

Xonbay limits access to Customer Data to people who need it to provide, support or secure the service or meet a legal obligation. Personnel authorised to handle Customer Data must keep it confidential. The business’s own authorised team members can access data according to the permissions and sharing actions it configures.

• Account authentication and team permission controls limit access within the service.
• Secure connections protect information in transit to supported production services.
• File access and sharing controls govern how stored content is made available.
• Operational logging and maintenance support investigation of service problems and misuse.

The business must protect its credentials and devices, remove unnecessary team access and check file-sharing and publication settings. Xonbay may update security measures as the service changes. We do not promise that every integration or device provides the same safeguards, or that any online service is immune from compromise. Contact us for security information relevant to a particular use before submitting data with special requirements.

The business authorises Xonbay to use infrastructure and service providers needed to deliver the features it requests. Xonbay remains responsible for its processor obligations when using a subprocessor and will require appropriate protections for Customer Data.

Other enabled integrations are assessed according to their role: a payment provider handling a payment or an identity provider handling sign-in can have its own responsibilities rather than act solely as Xonbay’s subprocessor. Providers and locations depend on the service used. The business can request further information about providers handling its Customer Data at privacy@xonbay.com. Xonbay will notify affected businesses of material subprocessor changes and consider reasonable data-protection objections before applying the change to their data.

Xonbay will provide reasonable assistance to help the business respond to valid requests concerning Customer Data. If a person contacts us about data controlled by the business, we may direct the request to the business or pass it on, unless law requires us to respond directly. The business is responsible for the decision and response concerning its own processing.

If Xonbay becomes aware of a personal-data breach affecting Customer Data processed under this Agreement, we will notify the affected business without undue delay using its account contact details. We will provide available information about the affected data, known consequences and actions taken or proposed, and update it as relevant facts become known. The business is responsible for assessing its own notification obligations to individuals and authorities; this notice is not an admission of fault.

Report a suspected incident to privacy@xonbay.com or through the contact page. Include the affected workspace and a description, but do not send passwords, access tokens or unnecessary sensitive data. Keep account contact details current so we can reach an authorised person.

Xonbay will provide information reasonably needed to explain the processing and assist the business with applicable data-protection duties, taking account of the nature of the service and information available to us. Reasonable requests for evidence or audits must protect the confidentiality, security and personal information of other customers. Any audit arrangements, scope and costs will be agreed before access is granted; mandatory statutory rights are unaffected.

Providers may process Customer Data outside Ghana. The business’s chosen country and operating currency do not determine the location of data storage. The parties must comply with applicable transfer requirements and use required safeguards. This Agreement does not itself certify compliance with every jurisdiction, promise data residency in a selected country, or incorporate a specific international transfer contract that has not been separately agreed.

The business can use available download or export features and request assistance to retrieve its Customer Data. At the end of services, it can instruct Xonbay to return or delete the data, subject to applicable law. A request should identify the workspace, authorised contact and requested scope. We will explain any technical limits or records that must remain for legal or transaction obligations.

Deletion from active services does not instantly remove backups or copies already lawfully shared with recipients. Retained data remains restricted to its applicable retention purpose. Expiry or downgrade of a paid plan is not a deletion instruction; the account may continue under Free entitlements. The business should retain its own required records and make a separate closure or deletion request when appropriate.

For processing on the business’s behalf, this Agreement controls if it conflicts with the Terms of Service on processor obligations. Applicable mandatory law takes precedence over both. Xonbay’s independent processing remains governed by the Privacy Policy. Updates are identified by the version and dates and material changes will be communicated to affected businesses.