Back to site

Data Processing Agreement

This English version is provided for convenience. In case of any discrepancy, the French version prevails.

Concluded pursuant to article 20 paragraph 2 of Togolese Law no. 2019-014 of 29 October 2019 on the protection of personal data, and to the equivalent provisions of the national laws applicable to the client companies.

Version: 1.3 Effective date: August 11, 2026

This agreement is annexed to and forms an integral part of the SANZA General Terms of Use and Sale. The Client accepts this agreement by accepting the Terms.

1. Parties

The Controller: the client company that subscribes to SANZA, hereinafter the "Client", whose identification details appear in the company record created at registration (business name, RCCM, tax ID, address, manager, contact details).

The Processor: BAHINIBA, a single-member limited liability company under OHADA law with share capital of 1,000,000 FCFA, registered in the trade register under number TG-LFW-01-2024-B13-00256, tax ID 11001918218, whose registered office is located at Adidogomé, Lomé, Togo, hereinafter "BAHINIBA".

2. Definitions

The terms used in this agreement have the meaning given to them by article 4 of Law no. 2019-014 of 29 October 2019, in particular: "personal data", "processing", "controller", "processor", "data subject", "consent", "recipient", "third party". Any reference to "the Law" refers to that law, unless otherwise indicated.

3. Purpose

This agreement sets out the conditions under which BAHINIBA, acting as a processor, processes on behalf of the Client the personal data that the Client or its authorized users enter, import or generate in the SANZA application. It specifies the respective obligations of the parties regarding confidentiality, security, duration of processing, use of other processors, exercise of data subjects' rights, notification of breaches, and return or deletion of data at the end of the service.

4. Nature, purpose and duration of the sub-processed operations

Nature of the operations performed: collection through the SANZA interface, recording, structuring, storage, adaptation, modification, extraction, consultation, use, transmission by electronic communication, availability, alignment, backup, deletion.

Purposes of processing: to provide the Client with the SANZA features corresponding to its subscription, including as the case may be invoicing, customer tracking and collection, mobile money collection, inventory management, SYSCOHADA-compliant accounting assisted by artificial intelligence, purchasing, payroll and fixed assets. No processing for other purposes is carried out by BAHINIBA on this data, except on written instruction from the Client or under a legal obligation.

Duration: the agreement is concluded for the entire duration of the subscription contract, including its trial periods, any non-payment suspensions, and its post-termination retention period provided for in the Privacy Policy, until the permanent deletion of the data in accordance with the three-notice protocol (D-90, D-30, D-7).

5. Categories of data and data subjects

Categories of personal data processed:

  • Identification and contact data of the Client's customers, suppliers and employees (name, contact details, tax or professional identifier where applicable).
  • Commercial data (invoices, quotes, credit notes, transaction history).
  • Accounting and tax data (entries, allocations, reference data).
  • Payment data (mobile money number, transaction reference, payment method).
  • Payroll data (remuneration, contributions, working time).
  • Health data, limited to sick leave recorded in the payroll module, processed exclusively on the basis of article 22 paragraphs 7 and 8 of the Law (performance of the employment contract, statutory social security obligations).

Categories of data subjects: the Client's natural person customers, natural person contacts within the Client's legal person customers, the Client's natural person suppliers, natural person contacts within the Client's legal person suppliers, the Client's employees, the Client's managers and shareholders.

Absence of processing of certain categories: no biometric data, no genetic data, no data relating to criminal offences or convictions is processed in SANZA.

6. BAHINIBA's obligations as processor

Client's instructions: BAHINIBA processes personal data only on documented instructions from the Client, including with regard to transfers of data to a third country, save where required to do so by a law to which BAHINIBA is subject, in which case BAHINIBA informs the Client of that legal requirement before processing, unless that law prohibits such information.

Confidentiality: BAHINIBA ensures that persons authorized to process the personal data have committed to confidentiality, by employment contract, internal memo or separate written commitment.

Security: BAHINIBA implements the technical and organizational measures described in chapter 8 of the Privacy Policy, pursuant to article 52 of the Law, including in particular encryption in transit and at rest, multi-tenant isolation through automatically tested Row Level Security policies, available reinforced authentication, tamper-proof audit log, regular backups with restoration tests.

Assistance to the Client: BAHINIBA assists the Client, by appropriate technical and organizational measures, in fulfilling the Client's obligation to respond to requests from data subjects for the exercise of their rights, as well as in the Client's obligations regarding security, breach notification and impact assessment.

End of service: at the end of this agreement, BAHINIBA returns the personal data to the Client, in the form of a downloadable JSON and CSV export, and proceeds to their deletion, in accordance with the three-notice protocol set out in the Privacy Policy and the Terms. This obligation does not preclude the retention by BAHINIBA of certain data where required by a legal obligation, in particular for accounting (SYSCOHADA retention period of 10 years for subscription invoices).

Availability of information: BAHINIBA makes available to the Client the documentation necessary to demonstrate compliance with its obligations as processor, allows for reasonable audits and contributes to their performance under the conditions set out in point 12 below.

7. General authorization to use other processors (sub-processors)

By accepting this agreement, the Client authorizes BAHINIBA to use the sub-processors ("processor's processors") listed in section 6 of the SANZA Privacy Policy. That list includes as of the date of signature:

  • Supabase Pte. Ltd. (database, authentication, storage — Singapore, contracting entity; data hosted in Europe, Paris).
  • Vercel Inc. (application hosting).
  • Anthropic PBC (artificial intelligence processing).
  • Meta Platforms (WhatsApp Business messaging).
  • 360dialog GmbH (technical intermediary for WhatsApp Business API access).
  • Twilio Inc. (backup SMS).
  • CinetPay (mobile money and card payment collection, primary aggregator retained, UEMOA coverage).
  • Sentry (error logs).
  • Referenced accounting partner, only where the Client has explicitly granted them advisory access to its account (access limited to that Client's data only, revocable by the Client at any time — never a default or blanket access to the entire partner network).

BAHINIBA imposes on these sub-processors, by contract, the same data protection obligations as those set out in this agreement, in particular regarding security and confidentiality. In the event of the addition or replacement of a sub-processor, BAHINIBA informs the Client with reasonable prior notice, allowing the Client to object to the change on legitimate grounds. In the event of objection, the parties confer to find a solution; failing that, the Client may terminate the subscription contract under the conditions set out in the Terms.

8. Transfers of data to third countries

Some of the sub-processors listed above are established outside the ECOWAS area, in particular in the United States and Ireland. The Client expressly authorizes these transfers, which are governed by contractual data protection commitments concluded between BAHINIBA and each of these sub-processors, offering a level of guarantee at least equivalent to the requirements of Law no. 2019-014 regarding confidentiality, security and purpose limitation.

Where relevant, BAHINIBA requests the opinion or authorization of the IPDCP under articles 28 and 30 of the Law, and informs the Client of substantial changes affecting the regime of these transfers.

9. Data subjects' rights

The Client is the primary contact for data subjects for the exercise of their rights of access, rectification, erasure, objection, restriction and portability provided for in articles 39 to 46 of the Law. Where a data subject nevertheless addresses BAHINIBA, BAHINIBA transmits the request to the Client as soon as possible, refraining from responding itself, unless on written instruction from the Client.

BAHINIBA makes available to the Client, within SANZA, the technical means necessary for the effective exercise of these rights, including: editing and modification of data subject records, full data export in JSON and CSV format, permanent deletion after the three-notice protocol, audit log allowing traceability of actions performed.

A maximum period of 30 days applies to any valid request, in accordance with article 46.

10. Notification of a data breach

BAHINIBA notifies the Client of any personal data breach within a maximum of 72 hours after becoming aware of it. The notification specifies, to the extent of the information available at the time of sending:

  • the nature of the breach, including, if possible, the categories and approximate number of data subjects and records affected;
  • the likely consequences of the breach;
  • the measures taken or proposed to address it and to mitigate its effects;
  • the contact details of BAHINIBA's data protection correspondent.

The Client, as controller, decides on the notifications to be made to the competent supervisory authority and, where appropriate, to the data subjects. BAHINIBA provides, upon reasonable request, any assistance necessary for these notifications.

11. Impact assessments and prior consultation

Upon reasoned request from the Client, BAHINIBA provides assistance in carrying out data protection impact assessments and prior consultations with the IPDCP, within the limits of the information available to BAHINIBA as processor.

12. Audit and documentation

The Client may request BAHINIBA to provide the documentation necessary to demonstrate compliance with this agreement, including independent audit reports, any certifications, and descriptions of technical and organizational measures.

The Client may also have carried out, at its expense, an audit on documents or on site, no more than once every twelve months except in the event of a security incident justifying immediate action, with reasonable prior notice, under conditions to be agreed between the parties, preserving the rights of other clients and the confidentiality of data. BAHINIBA may have the audit carried out by an independent third party that it proposes to the Client.

13. Liability and indemnification

Each party is liable for compensating for damage caused by a breach of its obligations under this agreement or under the Law. BAHINIBA is liable only for damage caused by processing where it has not complied with its specific processor obligations or where it has acted outside the Client's lawful instructions.

Without prejudice to the foregoing, BAHINIBA's overall liability under this agreement is capped within the limits set out in the Terms.

14. Duration, termination and effects

This agreement takes effect on the date of the Client's registration with SANZA and ends upon expiry of the subscription contract, plus the post-termination retention period provided for in the Privacy Policy.

Termination of the subscription contract automatically terminates this agreement, without prejudice to surviving obligations (return of data, deletion, confidentiality).

15. Amendments

Any substantial amendment to this agreement is notified to the Client at least 30 days before it takes effect, via the same channels as those provided for the Terms. Continued use of the service beyond that date constitutes acceptance; in the event of refusal, the Client may terminate its subscription under the same conditions.

16. Governing law and disputes

This agreement is governed by Togolese law and by the applicable provisions of the national data protection laws of the Client's country where those provisions are of public policy. Any dispute relating to its interpretation or performance falls within the jurisdiction of the competent courts of Lomé, subject to public policy rules on international jurisdiction.

17. Contact

For any question or correspondence relating to this agreement:

  • BAHINIBA data protection correspondent: Mr KOUASSI N. Emmanuel, dpo@bahiniba.com.
  • BAHINIBA, Adidogomé, Lomé, Togo. WhatsApp: +228 71675944.