Data Processing Agreement

1. When This Agreement Applies

This Data Processing Agreement ("DPA") applies when an organisation ("the Organisation") connects its identity provider to the course so that its staff can sign in with their work accounts. It forms part of the Master Service Agreement between the Organisation and Scalentric Limited ("Scalentric"). Terms not defined here have the meaning given in the NDPA.

2. Roles

• For each sign-in, the Organisation's identity provider sends Scalentric an identifier, an email address and a name for one of its staff. Scalentric processes that sign-in data on the Organisation's instructions, as a data processor, only to confirm who is signing in.
• Once a person is signed in, their course account, progress and activity are handled by Scalentric as an independent controller under the Privacy Notice, because the learner chooses to use the course for their own learning.

3. Details of the Processing

• Subject matter and purpose: authenticating the Organisation's staff to the course.
• Duration: while organisation sign-in is active, and until deletion under clause 9.
• Categories of data subjects: staff and other users the Organisation allows to use its sign-in.
• Categories of personal data: a pseudonymous account identifier from the identity provider (stored only as a keyed hash), work email address, display name.
• Special categories: none.
• Requested OIDC scopes: openid, email and profile, and nothing more. For SAML: a signed assertion with the name identifier, email and name attributes.

4. Scalentric's Obligations as Processor

• Process sign-in data only to authenticate users, and on the Organisation's documented instructions, which are this DPA and the identity provider settings the Organisation gives us.
• Ensure that anyone authorised to process it is bound by confidentiality.
• Apply the security measures in clause 10.
• Use only the sub-processors in clause 7.
• Help the Organisation respond to requests from data subjects and to meet its duties on security, breach notification and impact assessments, as far as the nature of the processing allows.
• Tell the Organisation if, in Scalentric's opinion, an instruction would break the NDPA.

5. The Organisation's Obligations

• Have a lawful basis for sending its staff's sign-in data to Scalentric, and tell its staff about it.
• Keep its identity provider settings accurate: client credentials, signing certificates and the list of permitted email domains.
• Tell Scalentric promptly at info@scalentric.org if its credentials may have been exposed or if it wants organisation sign-in stopped.

6. Personal Data Breaches

Scalentric will notify the Organisation without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting sign-in data, so that the Organisation can meet the 72-hour notification duty in section 40 of the NDPA where it applies. The notice will describe the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed. Information that is not yet available will follow in phases.

7. Sub-Processors

Scalentric uses Hostinger to host the course and deliver its emails. Scalentric will give the Organisation at least 30 days' notice before adding or replacing a sub-processor that would handle sign-in data. The Organisation may object on reasonable data protection grounds; if the parties cannot agree, either may stop organisation sign-in under the MSA.

8. Transfers

Where sign-in data is stored or processed outside Nigeria by a sub-processor, Scalentric will rely on the conditions for transfers in the NDPA.

9. Deletion at the End

When organisation sign-in ends, Scalentric disables the Organisation's sign-in settings at once and deletes its client secret and certificates within 30 days. Accounts created through the Organisation's sign-in remain the learners' own under the Privacy Notice. If the Organisation asks in writing, Scalentric will deactivate them, and they are then erased after 60 days.

10. Security Measures

• HTTPS only, with HSTS. A Content Security Policy that allows scripts only from the course itself.
• Client secrets and identity provider settings encrypted at rest. Learner names, emails and organisations encrypted at rest and sealed in transit.
• OIDC with PKCE, a single-use random state and a nonce; exact, fixed callback addresses; signed ID tokens checked for issuer, audience, expiry and nonce.
• SAML with signed assertions required, checks on audience, destination, response-to and time window, and refusal of replayed assertions.
• Rate limits and automatic blocking on sign-in routes; refusal of private network addresses in calls to identity providers; optional public-key pinning of the Organisation's identity provider.
• A central fault log with alerts; an incident response plan; access to administration limited to Scalentric's course administrator with a signed, device-bound session.

11. Audits and Information

Scalentric will answer the Organisation's reasonable written questions about its processing and security, once a year or after a breach, and will make available the information needed to show compliance with this DPA.

12. Liability, Law and Order of Precedence

Liability under this DPA is subject to the MSA. This DPA is governed by the laws of the Federal Republic of Nigeria. If this DPA and the MSA conflict on data protection, this DPA prevails.