Data Processing Agreement - Dextro Compliance

This Data Processing Agreement ("DPA") forms part of the Master Services Agreement between the Client ("Data Controller") and Dextro ("Data Processor").

1. Scope of Processing

Dextro provides a managed Compliance Operations Desk. In providing this service, Dextro will process Personal Data strictly on the documented instructions of the Client for the purpose of verifying candidate or client documentation.

2. Roles and Responsibilities

Data Controller: The Client remains the Data Controller and is responsible for obtaining the necessary consent or legal basis to process the Personal Data.
Data Processor: Dextro acts solely as a Data Processor and will not process Personal Data for its own purposes.

3. Confidentiality and Security

Dextro ensures that all personnel authorized to process Personal Data have committed themselves to confidentiality. Dextro has implemented appropriate Technical and Organisational Measures (TOMs) to ensure a level of security appropriate to the risk.

4. Subprocessors

The Client authorizes Dextro to engage third-party subprocessors (including Vercel, Supabase, and Resend). Dextro will remain fully liable to the Client for the performance of the subprocessor's obligations.

5. International Data Transfers (Restricted Transfers)

The Client acknowledges that while primary databases are hosted in the UK, Dextro’s human administration operations are located in Nigeria (a country not currently on the UK's Adequacy list). To safeguard this restricted transfer in strict adherence with UK GDPR Chapter V, this DPA incorporates by reference the UK International Data Transfer Addendum (IDTA).

Dextro ensures that its personnel in Nigeria access the UK-hosted data solely via secure, authenticated, and encrypted endpoints.
No Personal Data is permanently stored on local devices in Nigeria (zero local file caching).

6. Data Subject Rights & Incident Response

DSARs: If Dextro receives a request from a Data Subject (e.g., candidate), Dextro will promptly notify the Client and will not respond to the request without the Client's prior written consent.
Breach Notification: Dextro will notify the Client without undue delay (and strictly within 72 hours) upon becoming aware of a Personal Data Breach.

7. Data Deletion

Dextro operates an "Automated Document Purging" policy. Upon completion of the verification process, or upon termination of the service, Dextro will return or securely delete all Personal Data within 30 days, unless legally required to retain it.