Legal

Data Processing Agreement

Last updated: 4 October 2026

This Data Processing Agreement (“DPA”) is entered into between Phos Lab (“Processor”, “we”) and the customer or partner identified in the applicable order form, agreement or platform terms (“Customer”, “you”). It applies where we process personal data on your behalf in providing the Jobiest platform, API or related services, and is incorporated into the governing agreement between us.

1. Roles

You are the controller (or, where you are yourself a processor, you pass on the controller’s instructions). We are the processor. Each party complies with the Nigeria Data Protection Act 2023 and, where applicable, the EU/UK GDPR.

2. Processing details

Subject matter: AI career-agent services (job matching, document generation, application assistance) provided to your end users.
Categories of data subjects: your end users (job seekers).
Categories of personal data: names, contact details, career documents (CVs, cover letters), target-role preferences, application records, usage metadata.
Purposes: solely to deliver the Services under your documented instructions.
Duration: the term of the governing agreement, plus the deletion or return wind-down below.

3. Our obligations

We process personal data only on your documented instructions, including as to international transfers, unless required by law (and then with prior notice where lawful).
Persons authorised to process data are bound by confidentiality.
We implement the technical and organisational measures in Schedule B.
We engage subprocessors only under written contracts imposing the same protections, from the list in Schedule A. We give at least 30 days’ notice of new subprocessors; you may object on reasonable data-protection grounds.
We assist you, so far as possible, with data-subject requests, data-protection impact assessments and regulator enquiries.
We notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach, with known details and remediation status.
On termination, we delete or return personal data within 30 days, except where retention is required by law.
We make available information reasonably necessary to demonstrate compliance, including an annual security questionnaire and, for cause, a supervised audit with 30 days’ notice.

4. International transfers

Where personal data is transferred outside Nigeria (or the EEA/UK), transfers rely on adequate contractual clauses with the recipient provider. Current processing regions are listed in Schedule A.

5. Term

This DPA runs alongside the governing agreement and survives until all personal data has been deleted or returned.

Schedule A: subprocessors (as at 4 October 2026)

Vercel Inc. — application hosting (global, EU/US)
Supabase — database and authentication (US/EU)
Resend Inc — transactional email (US/EU)
Render Inc — browser automation worker (EU, Frankfurt)
Oracle Corporation — compute and storage (US/EU)
Paddle.com / Creem (as active) — merchant of record (EU)
Paystack / Flutterwave (as active) — payment processing (Nigeria)

Schedule B: security measures

Encryption in transit (TLS 1.2+) for all user-facing traffic; encryption at rest for secrets and AI provider keys (AES-256-GCM).
Role-based access control with row-level security (RLS) policies at the database layer; least-privilege service roles.
Audit logging of administrative actions and security-relevant events.
Rate limiting and abuse protection on all public endpoints.
Isolated execution: browser automation runs in a dedicated worker without database master credentials.
No credentials in source control; environment-scoped secrets.
Scheduled dependency and security updates; documented incident-response procedure.
Anonymised backups rotated on a 30-day cycle.

Questions about this DPA: support@jobiest.com.