Oriald
Login

LEGAL DOCUMENT

Data Processing Agreement

Governs the processing of personal data by Oriald on behalf of our customers in accordance with applicable data protection laws.

Last Updated: October 8, 2026

This Data Processing Agreement ("DPA") forms part of the Master Subscription Agreement or Terms of Service (the "Agreement") entered into by and between Oriald ("Processor", "we", "us", or "our") and the Customer ("Controller", "you", or "your"). This DPA reflects the parties' agreement with regard to the processing of personal data in connection with the Services provided under the Agreement.

1. Definitions

  • "Applicable Data Protection Laws" means all data protection and privacy laws and regulations applicable to the processing of Personal Data under this DPA, including, where applicable, the Nigeria Data Protection Regulation (NDPR), the Nigeria Data Protection Act (NDPA), and the EU General Data Protection Regulation (GDPR).
  • "Personal Data" means any information relating to an identified or identifiable natural person that is processed by Oriald on behalf of the Customer in the course of providing the Services.
  • "Data Subject" means the identified or identifiable natural person to whom the Personal Data relates (e.g., hotel guests, employees).
  • "Sub-processor" means any third party appointed by or on behalf of Oriald to process Personal Data on behalf of the Customer in connection with this DPA.

2. Processing of Personal Data

2.1 Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Data Controller, Oriald is the Data Processor, and that Oriald or members of the Oriald Group will engage Sub-processors pursuant to the requirements set forth in Section 5 below.

2.2 Customer's Processing of Personal Data. Customer shall, in its use of the Services, Process Personal Data in accordance with the requirements of Applicable Data Protection Laws. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data.

2.3 Oriald's Processing of Personal Data. Oriald shall treat Personal Data as Confidential Information and shall only Process Personal Data on behalf of and in accordance with Customer's documented instructions for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); (ii) Processing initiated by Users in their use of the Services; and (iii) Processing to comply with other documented reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement.

3. Security and Confidentiality

3.1 Security Measures. Oriald shall implement and maintain appropriate technical and organizational security measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise Processed by Oriald.

3.2 Confidentiality of Processing. Oriald shall ensure that any person who is authorized by Oriald to Process Personal Data (including its staff, agents, and subcontractors) shall be under an appropriate obligation of confidentiality (whether a statutory or contractual duty).

3.3 Personal Data Breaches. Oriald shall notify Customer without undue delay upon Oriald becoming aware of a Personal Data Breach affecting Customer Personal Data, providing Customer with sufficient information to allow Customer to meet any obligations to report or inform Data Subjects of the Personal Data Breach under Applicable Data Protection Laws.

4. Sub-processing

Customer provides a general authorization for Oriald to engage Sub-processors to Process Personal Data on Customer's behalf. Oriald shall enter into a written agreement with each Sub-processor imposing data protection terms that require the Sub-processor to protect the Personal Data to the standard required by Applicable Data Protection Laws. Oriald remains liable for any breach of this DPA caused by a Sub-processor.

5. Data Subject Rights

To the extent Customer, in its use of the Services, does not have the ability to address a Data Subject Request, Oriald shall, upon Customer's request, provide commercially reasonable efforts to assist Customer in responding to such Data Subject Request, to the extent Oriald is legally permitted to do so and the response to such Data Subject Request is required under Applicable Data Protection Laws.

6. Deletion or Return of Personal Data

Following termination or expiration of the Agreement, Oriald shall, at the choice of the Customer, delete or return all Personal Data Processed on behalf of the Customer, and delete existing copies unless Applicable Law requires storage of the Personal Data.