Data Processing Agreement

Purpose

This Data Processing Agreement ("DPA") governs the processing of personal data shared between Numaway Education Services Limited ("Numaway") and institutional partners for student referral and admissions purposes.

Scope of Processing

Applies where Numaway shares student personal data (name, contact details, academic records, study preferences) with a partner institution for the purpose of university admissions assessment.

Numaway Obligations

• Process and share data only for agreed admissions purposes
• Maintain appropriate technical and organisational security measures
• Notify partner of confirmed data breaches within 72 hours
• Delete or anonymise data on request or after retention period

Partner Obligations

• Process student data only for stated admissions purposes
• Not retain data beyond 12 months post-admissions decision
• Comply with applicable data protection law in the partner's jurisdiction
• Report data breaches to Numaway within 48 hours of discovery

Governing Law

Nigerian law (NDPA 2023). EU-based partners: GDPR Article 28 compliance provisions apply additionally. Disputes are subject to arbitration in Nigeria.