This Data Processing Addendum ("DPA") forms part of the Habivista Terms of Service for accounts that act as controllers over personal data they upload to Habivista — typically agencies, developers, banks, and insurance partners. By using Habivista to handle your customers' personal data you accept this DPA.

1. Definitions

Controller, processor, data subject, personal data — as defined in the Ghana Data Protection Act, 2012 (Act 843).
Customer — the account holder bound by the Terms.
Sub-processor — a third party that processes personal data on Habivista's behalf.

2. Roles

For data the Customer uploads about its own end customers (clients, prospects, viewing requests), the Customer is the controller and Habivista is the processor. For platform-operated data (account, billing, security logs) Habivista is the controller.

3. Scope of processing

Subject-matter: hosting and processing customer data to deliver the Habivista marketplace.
Duration: for the term of the Customer's Habivista account, plus retention periods in section 9.
Nature: storage, transmission, indexing, search, viewing-request routing, analytics, support.
Categories of data: contact information, ID artefacts (during KYC), property documents, transaction metadata.
Categories of subjects: the Customer's prospective and actual tenants/buyers, viewing-request submitters, agents.

4. Habivista obligations

Process personal data only on the Customer's documented instructions, except where required by law.
Ensure personnel processing personal data are bound by confidentiality.
Implement appropriate technical and organisational measures (TOMs) — encryption in transit and at rest, role-based access control, audit logs, vulnerability management.
Assist the Customer with data subject requests and DPC enquiries.
Notify the Customer without undue delay of any personal data breach affecting the Customer's data.
Make available the information necessary to demonstrate compliance, and allow audits as set out in section 8.

5. Sub-processors

Habivista uses the sub-processors listed at /legal/sub-processors. By accepting this DPA the Customer authorises those sub-processors. Material changes are notified at least thirty days in advance, with a right to terminate the affected service if the Customer reasonably objects.

6. International transfers

Where Habivista or a sub-processor transfers personal data outside Ghana, the transfer is governed by contractual safeguards equivalent to Act 843 protections (e.g. standard contractual clauses or equivalent).

7. Data subject requests

Habivista provides Customer-facing tooling to fulfil access, correction, and deletion requests. Where a request reaches Habivista directly we forward it to the Customer within seven days unless the Customer instructs otherwise.

8. Audits

Habivista provides on request an annual summary of its security posture (penetration test summary, sub-processor list, incident-response posture). Independent on-site audits are available to enterprise plan Customers under reasonable notice and confidentiality terms.

9. Termination & deletion

On account closure, Habivista deletes or anonymises Customer personal data within twelve months, except where we must retain it for legal, tax, or dispute-resolution reasons.

10. Liability

Liability under this DPA is governed by the limitation of liability in the Terms of Service, except where Ghanaian law disapplies that limit.

Data Processing Addendum (DPA)