Data Processing Agreement

1. Who is who

This agreement is between Astra Digital CM, operator of Proxim ("Proxim", "we"), and the merchant using the platform ("you"). Under Cameroon's Law No. 2024/017 of 23 December 2024 on the protection of personal data, you are the controller of the personal data of your own customers, and Proxim is your processor. Article 30 requires that this relationship be governed by a contract, which is what this document is.

2. What we process, and why

Proxim processes personal data only on your documented instructions, and only for these purposes:

• Running your account, your team, your subscription and your storefront.
• Answering your customers on WhatsApp and Telegram with the assistant you configured, and delivering the messages, photos and voice notes they send.
• Taking, recording and fulfilling orders placed on your storefront, and notifying buyers.
• Sending campaigns and re-engagement messages that you have asked us to send.
• Keeping the accounting records that tax law requires us and you to keep.

We do not use your customers' data for our own purposes, and we do not sell or rent it.

3. Categories of data and data subjects

Proxim does not ask for and does not intend to process special categories of data (health, biometrics, political or religious opinions, or criminal data). Do not send such data through the assistant or a customer record.

4. Your obligations

• You are responsible for the lawfulness of the collection you ask us to perform, and for telling your customers why you are collecting their data.
• You must not use the assistant to send unsolicited bulk marketing to people who have not asked for it. Broadcasts go only to contacts who have not opted out.
• You must tell us promptly if you become aware that data we hold for you has been obtained unlawfully, so we can stop the processing.
• You keep instructing us: we follow your configuration, not our own opinion about what you should send.

5. Our obligations

• Process only on your instructions, and only for the purposes in section 2.
• Keep your data separate from every other merchant's, at the database level, and never expose one merchant's data to another.
• Keep a register of the processing we perform on your behalf (Article 29 of the Law), and make it available to you on request.
• Assist you in answering requests from your customers: access, correction, erasure, objection and portability. Erasure is built into the product — see section 8.
• Delete or return your data when this agreement ends, subject only to what tax law requires us to keep.
• Tell you immediately if we are ever asked to hand over your data by a third party, and refuse unless legally compelled.

6. Security

Article 25 and 26 of the Law require technical and organisational measures proportionate to the risk, including preventing unauthorised reading, copying, transmission or erasure, restricting access to each person's own scope, and being able to verify after the fact who accessed or changed what, and when. We apply, among others:

• Encryption in transit (TLS) and at rest for credentials and payment keys.
• Mandatory tenant scoping on every tenant-owned record, so a query cannot reach another merchant's data.
• Signed and replay-protected authentication on every inbound channel: Meta webhooks, NotchPay, Telegram and the WhatsApp service.
• Rate limiting and validation on every public endpoint, including inbound webhooks.
• An append-only log of every deletion performed, retained for ten years, so an erasure can be evidenced rather than merely asserted.
• Access limited to the smallest team that needs it, with a super-admin role audited separately.

7. Sub-processors

These providers process data on our instructions so the service can work. Each is bound by its own contract with us.

If we add or replace a sub-processor we will tell you at least thirty days before your data starts going to them, and you may object in writing. If we cannot resolve the objection you may close your account and export your data, and we will delete it as described in section 8.

8. Retention, deletion and your data subjects' rights

Data is kept only as long as the processing needs it, as required by Article 13 of the Law. The current schedule is published in our Privacy Policy and is enforced automatically.

When one of your customers asks to be forgotten, you action it in Proxim by deleting that customer:

• Their conversations, messages, photographs and voice notes are deleted immediately.
• Their name, phone number and address are removed from their past orders.
• The order itself is kept for ten years, because Article L 5 of the General Tax Code requires accounting records to be kept for that long, and that record does not need the buyer's identity.
• Every step is written to a deletion log, without quoting the data that was deleted.

When you close your business, everything without a legal retention duty is deleted immediately, your channel credentials included, and your financial records are kept for ten years with buyer identity removed. We will never quietly retain data we are required to keep: when we do, we tell you, and tell you for how long.

9. Personal data breaches

Article 22(1) of the Law requires that, as soon as we become aware of a breach, the processor — which is us, not only you — informs the data protection authority and the affected person, without delay. The Law sets no deadline in days. We will notify you at the same time, with what we know, what it affects, and what we are doing about it. Because the supervisory authority has not yet been established and has no published contact point, please report anything you suspect to support@astradigitalcm.com.

10. International transfers

Article 32 of the Law requires prior authorisation from the data protection authority before personal data is transferred to another country, together with standard contractual clauses published by that authority. The authority was created by Article 53 of the Law but has not yet been put in place, so no such authorisation or clauses exist today, and our providers — several of which are outside Cameroon — operate in that gap. We are not treating the absence as permission: we minimise what leaves the platform, we publish the list rather than hide it, and we will complete the authorisation as soon as there is an authority to file it with. This paragraph will be updated when that happens.

11. Audit

You may ask us for evidence that we are meeting this agreement — a report on the processing we perform for you, a copy of the deletion log for your business, or confirmation of the sub-processors in use. We will answer within thirty days. An on-site audit is possible on reasonable written notice, at your cost, once a year, and only where an account of our measures is not sufficient.

12. Liability and governing law

This agreement is governed by the laws of the Republic of Cameroon. Each party is liable for its own breaches. Where our breach causes you a loss that is not covered by the refund or service credits in our Terms of Service, our aggregate liability is limited to the fees you paid in the twelve months before the loss. Nothing here limits liability that cannot be limited by law, including for the wilful or reckless mishandling of personal data.

13. Changes to this agreement

If we change this agreement in a way that affects your obligations, we will tell you before the change takes effect and ask you to accept the new version. Your acceptance is recorded with the version number, the date, and the locale you read it in. Continuing to use the platform after the change takes effect means you accept it.

14. Contact