SCHEDULE A • INTEGRATED DATA CONTRACT

Data Processing Agreement (DPA)

Framework: Nigeria Data Protection Act (NDPA) 2023 • Version: v0.1 Beta • Effective Date: November 5, 2026

INTEGRATION NOTICE: This Data Processing Agreement ("DPA") governs the processing of customer personal data between the Merchant ("Data Controller") and Greywood Technologies ("Data Processor") and is incorporated by reference into the Master Terms of Service.

1. NATURE & PURPOSE OF PROCESSING

Greywood processes customer personal data solely for the provision of Tushe OS capabilities, including WhatsApp conversational negotiation, catalog retrieval via pgvector semantic embeddings, payment link generation via Paystack, and daily briefing analytics.

2. TECHNICAL & ORGANIZATIONAL SECURITY MEASURES

Row-Level Security (RLS): Multi-tenant database isolation enforced on org_id across all Supabase PostgreSQL tables.
Encryption in Transit: Mandatory TLS 1.3 encryption across all public APIs and Meta webhooks.
Encryption at Rest: AES-256 standard encryption on all storage volumes and embeddings.
Immutable Audit Chain: Key operational events hashed using SHA-256 forward-linked signatures.

3. SUB-PROCESSORS

Greywood engages sub-processors under written agreements imposing data protection standards no less protective than this DPA. Current authorized technical sub-processors include Supabase Inc., Paystack Payments Ltd, Meta Platforms Inc., Groq Inc., DeepSeek, Google LLC, and Render Inc.

4. 48-HOUR DATA BREACH NOTIFICATION

In the event of an unauthorized disclosure or confirmed security breach impacting customer personal data, Greywood shall notify the Merchant within 48 hours of verification, providing technical details and recommended remediation measures.

5. DATA RETURN & PERMANENT ERASURE

Upon subscription cancellation or account deletion, the Merchant may export their catalog and conversation logs within 30 days. After 30 days, all conversation records, customer profiles, and vector embeddings are permanently wiped from production databases.