Data Processing Terms

1. Roles

For personal data about your shoppers and your own contacts that you put into, or collect through, Konduit, you are the data controller and Corehi Limited is the processor acting on your instructions. For your own account data, Corehi is the controller — see our Privacy Policy.

2. What we process, and why

Subject matter and purpose — providing the Konduit platform to you: hosting your storefront, taking and fulfilling orders, collecting payment, supporting your shoppers, and any messaging or AI features you switch on.

Duration — for as long as your account is open, plus the retention period in these terms.

Categories of data subject — your shoppers and prospective shoppers; your partners and their staff; your own team members.

Categories of personal data — names, email addresses, phone numbers, delivery and billing addresses, order and payment history, messages exchanged with your store, and technical data such as IP address.

Konduit is not designed for special-category data. You should not put health, biometric or similar sensitive data into it.

3. Our obligations

We will:

• process personal data only on your documented instructions, which include your use of the platform’s features, unless we must do otherwise by law — in which case we will tell you unless the law forbids it;
• ensure people authorised to process the data are bound by confidentiality;
• keep appropriate technical and organisational security measures, including access control and encryption in transit;
• help you respond to requests from data subjects, and with your data protection impact assessments and consultations, taking account of the nature of the processing and what is available to us;
• tell you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties;
• on the end of your account, delete or return the personal data as described below.

4. Your obligations

You are responsible for having a lawful basis to collect and use your shoppers’ data, for giving them the notices they are entitled to, for honouring their choices about marketing, and for the accuracy of what you put into the platform. Your instructions to us must not put us in breach of applicable data protection law.

5. Sub-processors

You give us general authorisation to use sub-processors to deliver the service. At this version they are:

• Flutterwave and Stripe — payment collection and payouts.
• Resend — transactional email.
• Cloudflare — DNS, TLS and custom store domains.
• Sentry — error monitoring, which can include personal data contained in an error report.
• Anthropic — the AI model provider behind assistant and content features.
• Database and file storage — run by us on our own server infrastructure, not a third-party managed service.
• Messaging and delivery partners — only those you choose to connect.

We remain responsible for our sub-processors’ performance of these terms. We will give you 30 days’ notice before adding or replacing one, and you may object on reasonable data protection grounds; if we cannot resolve your objection you may end this agreement.

6. International transfers

[TO CONFIRM: which countries data may be transferred to, and the transfer safeguard relied on under the Nigeria Data Protection Act 2023 (and standard contractual clauses if UK/EU data is in scope)]

7. Deletion and return

You can export your records from the portal at any time. After your account ends we delete the personal data we hold for you within 30 days, except where we must keep it by law, or where it is in routine backups — in which case it stays protected by these terms until those backups expire.

8. Audit

On reasonable written request, once a year and additionally following a personal data breach affecting your data, we will give you the information reasonably necessary to show we are meeting these terms. Where an on-site audit is required by law, the parties will agree scope and timing in advance, at your cost.

9. Contact

Data protection queries: info@usekonduit.com.