Data Processing Addendum

Effective from: 15 October 2026

This addendum is part of our Terms of Service. It applies whenever a shop puts personal data about other people into Tabs. It sets out what we, as the shop's processor, will and won't do with that data, as the Nigeria Data Protection Act 2023 requires.

1. Who is who

• The shop is the business that uses Tabs, acting through its owner. For the data in section 2, the shop is the data controller. It decides why the data is held and what is done with it.
• Tabs is Tabs HQ Software Solutions Ltd, RC number 8322949, of 20, Road 7 Close, Bashorun Housing Estate, Akobo, Ibadan, Oyo State, Nigeria. For that data, Tabs is the data processor. We handle it for the shop.
• Shop data means the personal data described in section 2.

The shop accepts this addendum when it accepts the Terms of Service. If the Terms and this addendum disagree about shop data, this addendum applies.

2. The data and why we handle it

Whose data. The shop's staff and members; its customers and the people its orders go to; its suppliers, couriers and resellers and their contact people.

What data. Depending on what the shop uses:

• staff: name, phone, job title, store, role, salary amount and how often it is paid, shift times, clock in and out times, tasks, handover notes, Insights on how each person is doing, and a log of their actions in Tabs;
• chat messages, reactions and files;
• customers: name, email, phone, company, billing and shipping addresses, notes and orders, and receipts emailed to them;
• order recipients' details;
• trade-in items' serial numbers or IMEIs, condition notes and photos;
• suppliers, couriers and resellers: name, contact person, phone, email, and for suppliers and resellers an address.

The shop should not put sensitive personal data, such as health, religion or ethnic origin, into Tabs, which is not built for it.

Why. Only to provide Tabs to the shop: storing, showing, organising, searching, copying, sending and deleting the data as the shop's use of Tabs directs, plus keeping it secure, backing it up, fixing faults and meeting the law.

For how long. For as long as the shop uses Tabs, and after that as set out in section 9.

3. What Tabs will do

We will:

1. handle shop data only on the shop's documented instructions. The Terms, this addendum and the shop's use of Tabs's settings are those instructions. If the law requires us to do otherwise, we will tell the shop first unless the law forbids it.
2. tell the shop if we think an instruction breaks data protection law;
3. make sure everyone at Tabs who can access shop data is bound to keep it confidential, and that only those who need access have it;
4. keep shop data secure, as set out in section 5;
5. use other providers only as set out in section 6;
6. help the shop answer requests from people using their rights, as set out in section 7;
7. tell the shop of a breach, as set out in section 8;
8. help the shop, where reasonable, with data protection impact assessments and with questions from the Nigeria Data Protection Commission about Tabs;
9. return or delete shop data at the end, as set out in section 9;
10. give the shop the information it reasonably needs to show we are keeping to this addendum, as set out in section 10.

We will not sell shop data, use it for advertising, or use it for any purpose of our own beyond running and protecting Tabs.

4. What the shop will do

The shop will:

• have a lawful basis for putting each person's data into Tabs, and tell those people, including its staff, what it holds and why;
• put in only the data it needs;
• decide who in the business can see what, using roles, and remove people who no longer work there;
• keep its own sign-in details safe;
• answer requests from people about their data, with our help;
• keep to data protection law in its own use of Tabs.

5. Security

We take technical and organisational measures suited to the risk, including:

• encrypting data as it travels between your device and our servers;
• keeping each business's data separate in our database, so one shop can't reach another's;
• roles that limit what each member can see and do;
• storing passwords only in scrambled form, and offering two-step sign-in;
• keeping chat files in private storage;
• recording sign-ins and security events;
• All traffic to and from Tabs is encrypted in transit (HTTPS through Cloudflare to our servers).
• Passwords are stored only as bcrypt hashes, and anyone can turn on two-step sign-in.
• Files people attach are kept in private storage and are only handed out through Tabs to someone signed in with the right permission.
• The database accepts connections only from our own servers.
• The database is backed up, and only the team members who run Tabs can reach the servers, the database and the backups.

6. Other providers (sub-processors)

The shop allows us to use these providers to handle shop data:

We will hold each provider to data protection terms at least as protective as this addendum, and we remain responsible to the shop for what they do. Before we add or replace a provider that handles shop data, we will email the owner at least 30 days ahead. If the shop has a reasonable data protection objection, it can tell us, and if we can't resolve it, the shop can cancel and we won't charge for the period after the change.

7. Helping with people's rights

If a person asks us directly to see, correct or delete data the shop holds about them, we will pass the request to the shop within 7 days and won't answer it ourselves unless the shop asks us to. Much of this the shop can do itself in Tabs: it can edit and remove records, and download selected rows of a list as a CSV file. Where it can't, we will help on request.

8. Breaches

If we become aware of a breach of security affecting shop data, we will tell the owner without undue delay, and in time for the shop to meet its own 72 hour deadline to notify the Nigeria Data Protection Commission where that applies. We will tell the shop what happened, what data and people are likely affected, what we are doing about it and who to contact, and keep it updated. We will not notify the shop's staff or customers ourselves unless the shop asks us to or the law requires it.

9. When the shop stops using Tabs

Before deleting a business, or within one month after it is deleted, the owner can ask hello@usetabs.app for a copy of the shop data, and we will send it as CSV files within 30 days.

When a business is deleted, it is removed from Tabs, and its records stay on our systems for one month, then are erased, except where the law requires us to keep them.

10. Showing we keep to this addendum

On reasonable written request, and no more than once a year unless there has been a breach or a regulator asks, we will answer the shop's questions about how we protect shop data and provide a written summary of our security measures.

11. Data outside Nigeria

Our providers handle some shop data outside Nigeria, in the European Union and the United States. We will send shop data abroad only where the Nigeria Data Protection Act allows it: each provider is bound by contract terms that protect shop data, and where the NDPC recognises a country as giving adequate protection we rely on that too.

12. Responsibility

Each party's responsibility under this addendum is subject to the limits in the Terms of Service, except where the law does not allow a limit.

---