KARRABO
0%
These Terms & Conditions govern access to and use of the payment processing services, terminals, software, applications, websites, APIs, portals, and related services provided by Karrabo Financial Solutions Limited. By signing up for, accessing, or using the Services through any approved channel, you confirm that you are acting as a Client and agree to be bound by this Agreement.
Please read this Agreement carefully to understand your rights and obligations and the terms on which KARRABO provides the Services. If you do not agree to this Agreement, you must not sign up for, access, or use the Services.
1.1This Agreement sets out the terms on which KARRABO provides payment processing, settlement, terminal, software, API, portal, and related services to Clients. It is intended to operate as the legal and operational framework for the use of the Services offered by KARRABO through KarKollect.
1.2The operative commercial and risk provisions appear in the main body of this Agreement. Detailed restricted-business requirements are set out in Schedule 1, detailed chargeback and refund operational requirements are set out in Schedule 2, and data processing addendum terms are set out in Schedule 3. Each Schedule forms part of this Agreement.
2.1In this Agreement, the following terms have the meanings set out below:
3.1The Client represents and warrants that:
3.2KARRABO may request supporting information or documentation at any time to verify the Client’s eligibility and compliance with this Agreement.
4.1The Client must use the Services only for lawful business purposes and in accordance with this Agreement, Applicable Laws, Payment Network rules, KARRABO’s onboarding, compliance, risk, and operational requirements, and the restricted-business rules in Schedule 1.
4.2The Client acknowledges that KARRABO may provide the Services directly, through affiliates, or through licensed banks, processors, switches, Payment Network participants, technology providers, or other regulated or authorised partners, and that the Client must comply with any requirements imposed by those parties where relevant to the Services.
4.3The Client must promptly provide accurate and complete Due Diligence Information requested by KARRABO for onboarding, KYC/KYB, AML/CFT/CPF, fraud prevention, transaction monitoring, reconciliation, audit, reporting to a Statutory Authority, or investigation purposes, and must notify KARRABO without undue delay of any material change to its business, ownership, control, products, services, address, contact details, Settlement Account, or expected transaction profile.
4.4The Client must provide beneficial ownership, director, signatory, business registration, tax, address, licensing, source-of-funds, source-of-wealth, sanctions, politically exposed person, and other Due Diligence Information requested by KARRABO for risk-based onboarding, periodic review, enhanced due diligence, transaction monitoring, reporting to a Statutory Authority, or investigation purposes.
4.5The Client must not use the Services for any fraudulent, deceptive, unlawful, or abusive activity, including money laundering, terrorist financing, sanctions evasion, illegal gambling, prohibited products or services, or any activity that could expose KARRABO, its partners, or the payments ecosystem to undue legal, regulatory, financial, or reputational risk.
4.6KARRABO may decline, suspend, restrict, or reverse any Transaction, or refuse to provide any Service, where KARRABO reasonably believes that the Transaction or activity is unauthorised, suspicious, unlawful, inconsistent with the Client’s stated business profile, or otherwise presents heightened risk. Where reasonably practicable and not prohibited by Applicable Laws, direction from a Statutory Authority, or risk management requirements, KARRABO will notify the Client of the relevant action and the general reason for it.
5.1Unless otherwise agreed in writing, all Terminals remain the property of KARRABO or its designated partner. The Client must use each Terminal only for authorised business purposes, at approved locations, and in accordance with KARRABO’s operating, security, maintenance, and return instructions.
5.2The Client must not tamper with, alter, reconfigure, reverse engineer, relocate, sell, lease, lend, transfer, misuse, or allow unauthorised access to any Terminal, SIM, software, or related equipment. The Client is responsible for loss, theft, damage, misuse, or unauthorised use of any Terminal while in its possession or control, except to the extent caused by KARRABO’s proven fault.
5.3Upon suspension, termination, replacement, recall, or request by KARRABO, the Client must promptly return each Terminal in good working condition, fair wear and tear excepted. KARRABO may charge the Client for any lost, damaged, unreturned, misused, or tampered Terminal and may deduct those amounts from settlements, Reserves, or other amounts payable to the Client.
5.4KARRABO may remotely monitor, update, disable, deactivate, inspect, or recall any Terminal where reasonably required for security, fraud prevention, maintenance, compliance, Payment Network requirements, direction from a Statutory Authority, suspected misuse, or operational integrity.
6.1The Client must pay all Fees applicable to its use of the Services.
6.2The applicable Fees, Terminal rental charges, settlement cycles, transaction limits, reserve requirements, and other commercial terms may be set out in a pricing schedule, order form, client application, onboarding confirmation, fee notice, platform notice, or other commercial document issued or approved by KARRABO (each a Commercial Schedule). Each Commercial Schedule forms part of this Agreement to the extent it applies to the Client.
6.3KARRABO may deduct applicable fees, charges, taxes, Refunds, Chargebacks, reversals, penalties, Reserve amounts, and other amounts owed by the Client from Transaction proceeds, settlements, Reserves, or any other funds payable to the Client, to the extent permitted by Applicable Laws.
6.4Unless expressly agreed otherwise in writing, all fees and charges are exclusive of applicable taxes, and the Client is responsible for all taxes arising from its business, Transactions, products, services, and use of the Services.
6.5If there is any inconsistency between this Agreement and a Commercial Schedule, the Commercial Schedule will prevail for the specific commercial term it addresses, but this Agreement will continue to govern all legal, compliance, risk, security, liability, dispute, and operational matters unless the Commercial Schedule expressly states otherwise.
6.6If amounts recoverable from the Client exceed available settlements, Reserves, or other funds held by KARRABO, the Client must promptly fund the shortfall upon demand and remains liable for those amounts after suspension, termination, or closure of its Client account.
7.1Subject to KARRABO’s internal controls, fraud checks, Reserve requirements under Clause 10, Payment Network rules, banking timelines, and any applicable holds or restrictions, KARRABO will ordinarily settle cleared Transaction proceeds to the Client’s designated Settlement Account within the Settlement Cycle communicated by KARRABO for the relevant Service, except where a delay is reasonably required for risk, compliance, operational, or legal reasons.
7.2KARRABO may delay, suspend, set off, withhold, or adjust settlements where reasonably necessary to account for Chargebacks, Refunds, reversals, fees, taxes, Reserve funding, suspected fraud, compliance reviews, Transaction disputes, processing errors, or any amount owed by the Client under this Agreement.
7.3The Client must promptly reconcile its Transaction and settlement records and notify KARRABO within seventy-two hours after the Transaction’s settlement due date of any discrepancy, omission, or error. Failure to notify KARRABO within that time may affect the Client’s ability to dispute the relevant item.
7.4Settlement timing, deductions, charges, and related commercial adjustments may be further described in the applicable Commercial Schedule or any written settlement notice issued by KARRABO.
8.1Chargebacks are reversals of Transactions and are subject to the operational requirements in Schedule 2.
8.2The Client may be responsible for Chargebacks arising from:
9.1Unless otherwise agreed in writing, KARRABO is not responsible for handling returns of the Client’s products or services or for responding to customer enquiries about those returns. The Client remains solely responsible for its return, cancellation, and Refund obligations to its customers, subject to the operational requirements in Schedule 2.
9.2The Client must maintain a fair, transparent, and timely process for handling customer complaints, failed Transaction claims, Refund requests, delivery disputes, and cancellation requests, and must cooperate with KARRABO in responding to customer escalations, Payment Network enquiries, complaints or enquiries from a Statutory Authority, and other consumer protection matters relating to the Client’s products, services, or Transactions.
10.1KARRABO may place a Reserve on part of the Client’s settlements for as long as is reasonably necessary where KARRABO reasonably believes that the Client’s business presents a heightened level of risk.
10.2If KARRABO imposes a Reserve, it will notify the Client of the relevant Reserve terms, which may include the percentage of settlements to be withheld, the duration of the Reserve, the basis for release, and any other conditions reasonably required by KARRABO.
10.3KARRABO will notify the Client of any material change to the Reserve terms.
10.4KARRABO may periodically review the continued need for any Reserve and may adjust, release, or retain the Reserve based on the Client’s risk profile, Chargeback levels, Refund levels, fraud indicators, concerns raised by a Statutory Authority, Payment Network requirements, outstanding liabilities, or other relevant risk factors.
10.5Subject to any unresolved Chargebacks, Refunds, reversals, disputes, investigations, Payment Network requirements, requirements of a Statutory Authority, or amounts owed by the Client, KARRABO will use reasonable efforts to release any remaining Reserve within one hundred and eighty (180) days after the later of: (a) termination of the Services; (b) final processing of the relevant Transactions; or (c) expiry of the applicable risk period under the relevant Payment Network rules, Commercial Schedule, dispute process, investigation, or Applicable Laws.
10.6KARRABO may retain all or part of the Reserve beyond that period where reasonably necessary to cover actual, contingent, or anticipated liabilities.
10.7The Client remains liable for all obligations relating to its Transactions, whether any Reserve has been released.
10.8KARRABO may also require the Client to keep its bank account open and available for open settlements, Chargebacks, Refunds, reversals, and other adjustments.
10.9To secure the Client’s obligations under this Agreement, the Client grants KARRABO a lien or security interest over any funds held in Reserve to the extent of any amounts payable by the Client.
11.1The Client must comply with all applicable anti-corruption, anti-money laundering, counter-terrorist financing, sanctions, and related laws, regulations, and requirements of any Statutory Authority, and must maintain appropriate internal controls to prevent, detect, and report violations where required.
11.2The Client must cooperate with KARRABO’s anti-money laundering, counter-terrorist financing, counter-proliferation financing, sanctions screening, fraud prevention, and transaction monitoring controls, including by providing information promptly, supporting enhanced due diligence where required, and refraining from tipping off any person where disclosure would be unlawful or would prejudice an investigation.
12.1Each party must comply with applicable data protection and privacy laws relating to the collection, use, disclosure, storage, transfer, and other processing of Personal Data in connection with the Services, including the Nigeria Data Protection Act 2023 and any subsidiary instruments, directives, or guidance issued by any applicable Statutory Authority.
12.2Unless otherwise agreed in writing, each party acts as an independent data controller for Personal Data it independently determines the purposes and means of processing in connection with the Services. Where either party processes Personal Data on behalf of the other, the parties will comply with Schedule 3 (Data Processing Addendum) and any additional data processing terms required by Applicable Laws.
12.3The Client must ensure that it has a valid lawful basis for processing any Personal Data submitted through or in connection with the Services, and that it provides any notices, obtains any consents, and takes any other steps required for that processing under Applicable Laws.
12.4Where required by Applicable Laws or the nature of the processing, the Client must maintain appropriate technical and organisational measures to protect Personal Data, support data subject rights, maintain required records, conduct risk assessments, and cooperate with KARRABO in managing or responding to data protection complaints, incidents, audits, or enquiries from a Statutory Authority.
12.5The Client must promptly support KARRABO with data mapping, data subject requests, breach assessment, enquiries from a Statutory Authority, lawful transfer assessments, and any notices or filings required under applicable data protection and privacy laws.
13.1If the Client stores, processes, or transmits Cardholder Data, the Client must comply with all applicable Payment Card Industry Data Security Standards (PCI DSS), Payment Network rules, acquiring bank requirements, and KARRABO security requirements relevant to its use of the Services.
13.2The Client must not store sensitive authentication data after authorisation and must implement and maintain appropriate safeguards, access controls, patching, staff awareness, and incident response procedures to protect payment data and connected systems.
13.3Upon request, the Client must provide evidence of PCI DSS compliance or other applicable security compliance, complete required attestations or questionnaires, remediate identified gaps within reasonable timelines, and cooperate with any forensic investigation, security review, or Payment Network enquiry relating to payment data or connected systems.
13.4The Client must notify KARRABO without undue delay and, in any event, within twenty-four (24) hours after becoming aware of any actual or suspected Security Incident, compromise, or unauthorised access affecting Cardholder Data, Personal Data, Credentials, devices, Terminals, or systems connected with the Services. The Client must preserve evidence, support containment and remediation, and cooperate reasonably and in good faith in any investigation, customer communication, notification to a Statutory Authority, Payment Network notification, forensic review, or other required reporting.
14.1The Client is responsible for maintaining the confidentiality and security of all Credentials and for protecting the devices used for access to the Services. KARRABO is not liable for any unauthorised access, instruction, or Transaction arising from the Client’s failure to protect its Credentials or devices.
15.1The Client must maintain complete, accurate, and up-to-date records relating to its business, customers, Transactions, settlements, Chargebacks, Refunds, complaints, compliance controls, authorisations, consents, delivery evidence, invoices, receipts, and any other information reasonably required to verify compliance with this Agreement and Applicable Laws.
15.2The Client must retain those records for at least six (6) years after the relevant Transaction or for any longer period required by Applicable Laws, Payment Network rules, regulatory requirements, dispute processes, or KARRABO’s reasonable risk, audit, or compliance requirements.
15.3Upon reasonable request, the Client must promptly provide KARRABO, its auditors, Payment Network participants, partner banks, any Statutory Authority, or other authorised recipients with records, information, explanations, system access, transaction evidence, or cooperation reasonably required for onboarding, monitoring, reconciliation, investigations, audits, Chargebacks, Refunds, fraud prevention, sanctions screening, regulatory reporting, or dispute resolution.
15.4KARRABO will use reasonable efforts to ensure that any audit, review, or information request is proportionate to the relevant risk, regulatory, operational, or contractual purpose. The Client must not withhold, alter, destroy, conceal, or delay records or information requested under this clause.
16.1All products and services rendered under this Agreement are the works of KARRABO. All rights therein, including without limitation all intellectual property rights, are and shall remain the sole and exclusive property of KARRABO. Nothing in this Agreement grants the Client any right, title, interest, or licence in or to KARRABO’s intellectual property.
17.1All non-public, confidential, or proprietary information disclosed by KARRABO in connection with the Services, whether commercial, financial, technical, customer-related, supplier-related, product-related, or otherwise, is Confidential Information.
17.2The Client must:
17.3Nothing in this clause prevents KARRABO from disclosing information where required for the provision of the Services, by Applicable Laws, by a Statutory Authority, or by a Payment Network participant, provided that KARRABO will limit the disclosure to what is reasonably necessary in the circumstances.
18.1KARRABO will use reasonable efforts to make the Services available, but the Client acknowledges that:
19.1To the fullest extent permitted by Applicable Laws, KARRABO is not liable for any indirect, incidental, special, punitive, or consequential loss or damage, including loss of profit, revenue, goodwill, or opportunity, except to the extent such limitation is prohibited by Applicable Laws.
19.2Without limiting the above, KARRABO is not liable for any loss resulting from:
19.3Subject to the exclusions and limitations in this Clause 19 and to the fullest extent permitted by Applicable Laws, KARRABO’s aggregate liability arising out of or in connection with this Agreement, the Services, or any Transaction will not exceed the total fees actually paid by the Client to KARRABO for the affected Services during the three (3) months immediately preceding the event giving rise to the claim.
19.4The liability cap does not limit the Client’s obligation to pay fees, taxes, Chargebacks, Refunds, reversals, Reserve shortfalls, indemnity amounts, or any other amounts owed to KARRABO under this Agreement.
19.5Nothing in this Agreement excludes or limits liability to the extent that such exclusion or limitation is not permitted by Applicable Laws.
20.1The Client must indemnify and hold harmless KARRABO and its directors, officers, employees, affiliates, agents, and partners against third-party claims, liabilities, damages, losses, penalties, costs, and expenses arising out of or in connection with:
21.1KARRABO is not liable for any delay or failure in performing its obligations to the extent caused by circumstances beyond its reasonable control, provided that KARRABO uses reasonable efforts to mitigate the impact of the relevant event where practicable. Such circumstances include:
22.1KARRABO may suspend or terminate the Client’s access to the Services immediately where:
22.2Where reasonably practicable and not prohibited by Applicable Laws, a Statutory Authority, or risk management requirements, KARRABO will give the Client notice of a suspension or termination and, where appropriate, an opportunity to remedy the issue within a reasonable period.
22.3Upon suspension or termination, KARRABO may disable or restrict the Client’s access to the Services, Credentials, APIs, dashboards, Terminals, and related systems; stop, reject, reverse, complete, investigate, hold, or settle pending Transactions; complete final reconciliation, deductions, set-off, settlement holds, Reserve retention, and recovery actions; and require the return of Terminals and other KARRABO materials.
22.4Without limiting Clause 29 (Survival and Post-Termination Obligations), the Client must continue cooperating in relation to Chargebacks, Refunds, reversals, complaints, investigations, audits, Security Incidents, data protection matters, Payment Network enquiries, and enquiries or requirements of any Statutory Authority after suspension or termination.
23.1If any dispute arises out of or in connection with this Agreement, the parties will first use reasonable efforts to resolve the dispute through good-faith discussions within fifteen (15) Business Days after written notice of the dispute is given.
23.2If the dispute is not resolved through those discussions, either party may pursue any remedy available to it under Applicable Laws or bring proceedings before a court of competent jurisdiction in Nigeria, subject to any mandatory pre-action or regulatory process that may apply.
24.1This Agreement shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria. Subject to Clause 23 (Dispute Resolution), the courts of Nigeria shall have jurisdiction over disputes arising out of or in connection with this Agreement.
25.1If any provision of this Agreement is held to be invalid, illegal, or unenforceable by any court or Statutory Authority of competent jurisdiction, that provision will be modified or interpreted to the minimum extent necessary to make it valid and enforceable. If modification is not possible, the provision will be severed, and the remaining provisions of this Agreement will continue in full force and effect.
26.1The Client must not assign, transfer, novate, subcontract, delegate, charge, or otherwise dispose of any of its rights or obligations under this Agreement without KARRABO’s prior written consent.
26.2KARRABO may assign, transfer, novate, subcontract, delegate, charge, or otherwise dispose of any of its rights or obligations under this Agreement to any affiliate, successor, purchaser, financing provider, service provider, partner bank, Payment Network participant, or other third party where reasonably required for the provision, operation, financing, restructuring, sale, transfer, or continuation of the Services, provided that such action does not materially reduce the Client’s rights under this Agreement.
26.3The Client must provide any cooperation, confirmation, or documentation reasonably requested by KARRABO to give effect to any permitted assignment, transfer, novation, subcontracting, delegation, or related arrangement under this clause.
27.1Any notice or communication under this Agreement may be given by email, platform notification, dashboard message, in-app message, courier, hand delivery, or any other official communication channel used by KARRABO for Client communications.
27.2A notice will be deemed received when delivered electronically to the Client’s registered email address, account dashboard, platform inbox, or other contact channel provided by the Client, or when physically delivered to the Client’s last notified business address.
28.1KARRABO may amend this Agreement from time to time by publishing an updated version on its website or notifying the Client through any official communication channel. Unless a shorter period is required by Applicable Laws, a Statutory Authority, or urgent risk management needs, KARRABO will use reasonable efforts to provide prior notice of any material amendment.
28.2The Client’s continued use of the Services after that notice takes effect constitutes acceptance of the amended Agreement.
29.1Termination or suspension of the Services does not affect any rights, remedies, liabilities, or obligations that accrued before termination or suspension, including obligations relating to fees, settlements, Reserves, Chargebacks, Refunds, reversals, taxes, confidentiality, data protection, Security Incidents, indemnities, limitation of liability, dispute resolution, governing law, and any other provision that by its nature should survive.
29.2KARRABO may retain Reserves or other amounts reasonably required to cover actual, contingent, or anticipated liabilities after termination and may complete final settlements, adjustments, deductions, Chargeback processing, Refund processing, reconciliation, and recovery actions after the Client’s access to the Services ends.
29.3After suspension or termination, the Client must continue to provide KARRABO with reasonable assistance, records, information, access, confirmations, and cooperation required to resolve or manage Chargebacks, Refunds, reversals, failed Transactions, customer complaints, investigations, audits, Security Incidents, data protection requests, Payment Network enquiries, enquiries or requirements of any Statutory Authority, final reconciliation, recovery of outstanding amounts, return of Terminals, and any other matter arising from or connected with the Client’s use of the Services before suspension or termination.
30.1By signing up for, accessing, using, or continuing to use the Services, or by executing this Agreement or any related onboarding document, the Client confirms that it has read, understood, and agreed to be bound by this Agreement, including the Schedules. Each method of acceptance, including electronic acceptance, platform-based acceptance, onboarding confirmation, continued use of the Services, or manual signature, constitutes valid acceptance of this Agreement.
The Client must not use the Services for any business, product, service, or activity that is illegal, prohibited by Applicable Laws, or otherwise restricted by KARRABO, its banking partners, Payment Network participants, or any Statutory Authority. Without limiting the foregoing, the following categories are prohibited or restricted and may not be processed through the Services except with KARRABO’s prior written approval where such approval is legally permissible:
KARRABO may update this Schedule from time to time to reflect changes in Applicable Laws, Payment Network rules, banking requirements, risk appetite, fraud trends, or requirements of any Statutory Authority. The Client is responsible for ensuring that its business and Transactions remain outside restricted categories at all times.
This Schedule sets out additional operational rules that apply to Chargebacks, Refunds, reversals, retrieval requests, and related customer or Payment Network disputes. It supplements Clauses 7 (Settlements and Adjustments), 8 (Chargebacks), 9 (Refunds), and 10 (Reserves) and is intended to support timely dispute handling, reconciliation, and risk management.
2.1Client Responsibilities. The Client must maintain complete and accurate Transaction records, implement dispute-prevention processes, and deal with customer complaints promptly and in good faith.
2.2Chargeback Notifications and Evidence. The Client must provide requested dispute evidence within timelines specified by KARRABO or applicable Payment Network rules. KARRABO may submit, decline to submit, or limit any response where evidence is insufficient, late, inconsistent, or unlikely to succeed, provided KARRABO acts reasonably and in good faith.
2.3Refund Processing. The Client must process Refunds in accordance with its customer terms, Applicable Laws, Payment Network rules, and KARRABO’s operational requirements. KARRABO may refuse, delay, or reverse Refund requests where it reasonably suspects fraud, abuse, processing error, insufficient funds, legal or regulatory risk, or inconsistency with the relevant Transaction record.
2.4Recovery, Set-Off, and Funding. KARRABO may recover Chargebacks, Refunds, reversals, fines, penalties, fees, and related costs by deduction from settlements, Reserves, or other amounts payable to the Client. If recoverable amounts exceed available funds, the Client must promptly fund the shortfall upon demand.
2.5Monitoring and Remedial Measures. If Chargeback, Refund, fraud, complaint, or dispute levels exceed thresholds determined by KARRABO or relevant Payment Network participants, KARRABO may require remedial actions or apply restrictions, increase Reserves, delay settlements, suspend Services, or terminate this Agreement.
2.6Finality of Payment Network Outcomes. The Client acknowledges that Chargeback, Refund reversal, or related dispute outcomes may depend on decisions of Payment Network participants and agrees to accept outcomes binding on KARRABO under applicable rules.
This Schedule 3 forms part of the Agreement and applies where either party processes Personal Data on behalf of the other party, where the parties share Personal Data in connection with the Services, or where additional data protection terms are required by Applicable Laws, a Statutory Authority, the nature of the processing, or the parties’ operating model.
3.1Data Protection Roles. Unless otherwise agreed in writing, each party acts as an independent data controller for Personal Data for which it independently determines the purposes and means of processing. Where one party processes Personal Data on behalf of the other, the processing party acts as a data processor and the instructing party acts as a data controller for that processing. The parties will cooperate in good faith to document any specific controller, processor, joint controller, or independent controller allocation required for a particular Service, Transaction flow, or operating model.
3.2Processing Details. Personal Data processed under this Schedule may include identification information, contact information, business information, onboarding information, Due Diligence Information, Transaction information, payment information, device or Terminal information, Credentials-related information, fraud and risk signals, complaint records, support records, and compliance records. Data subjects may include Customers, Merchants, Authorised Representatives, directors, beneficial owners, signatories, employees, Agents, users, and other persons connected with the Services. Processing may include collection, recording, organisation, structuring, storage, retrieval, use, disclosure, transmission, alignment, combination, restriction, erasure, destruction, reconciliation, reporting, monitoring, screening, investigation, and other operations necessary to provide, secure, monitor, improve, audit, or comply with the Services.
3.3Lawful Basis and Notices. Each party is responsible for identifying and maintaining any lawful basis required for its own processing of Personal Data. The Client must provide all required privacy notices, obtain all required consents, and ensure that it has authority to disclose Personal Data to KARRABO, Payment Network participants, partner banks, service providers, and Statutory Authorities where required for the Services.
3.4Processor Instructions and Assistance. Where a party acts as a data processor, it must process Personal Data only on documented instructions from the relevant data controller, unless processing is required by Applicable Laws or a Statutory Authority. The Agreement, applicable Commercial Schedule, onboarding documents, operational instructions, support requests, and lawful service configurations may constitute documented instructions. The processor must provide reasonable assistance to the controller, taking into account the nature of processing and information available to it, to support compliance with security, breach notification, data subject rights, data protection impact assessment, consultation, recordkeeping, audit, and other controller obligations under Applicable Laws.
3.5Confidentiality and Personnel. Each party must ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations, receive appropriate guidance or training, and process Personal Data only as required for the Services or as permitted by this Agreement and Applicable Laws.
3.6Security Measures. Each party must implement appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing, accidental loss, destruction, damage, alteration, or disclosure. Such measures may include access controls, authentication, encryption or tokenisation where appropriate, logging, monitoring, segregation, backup, vulnerability management, incident response, staff awareness, and reasonable physical, administrative, and technical safeguards.
3.7Sub-processors and Service Providers. KARRABO may engage affiliates, cloud providers, technology providers, fraud prevention providers, support providers, Payment Network participants, partner banks, processors, switches, and other service providers to process Personal Data where reasonably required for the Services. KARRABO will remain responsible for ensuring that any such provider is subject to appropriate contractual, confidentiality, and security obligations where required by Applicable Laws. KARRABO may notify the Client of material changes to sub-processors or service providers through a platform notice, policy update, email, or other official communication channel. If the Client reasonably objects to a material change on data protection grounds, the parties will discuss the objection in good faith, but KARRABO may continue using the provider where reasonably necessary for the Services, compliance, security, or Payment Network operations.
3.8Cross-Border Transfers. Personal Data may be transferred, accessed, routed, stored, or processed outside Nigeria where required for the Services, including through cloud hosting, group-company access, Payment Network routing, fraud monitoring, support, settlement, reporting to a Statutory Authority, or security operations. Each party must ensure that any cross-border transfer for which it is responsible complies with Applicable Laws and is supported by any required lawful transfer mechanism, safeguards, adequacy basis, transfer assessment, notice, consent, contractual protection, or other measure required by Applicable Laws.
3.9Data Subject Rights. Each party must provide reasonable assistance to the other party, taking into account the nature of the processing and information available to it, to enable responses to lawful requests from data subjects relating to access, correction, deletion, objection, restriction, portability, withdrawal of consent, automated decision-making, or any other right recognised under Applicable Laws.
3.10Security Incidents and Breach Cooperation. Each party must notify the other party without undue delay after becoming aware of any Security Incident affecting Personal Data processed under this Schedule. Where the Client is required to notify KARRABO under this Agreement, the twenty-four (24) hour notification period in Clause 13 (PCI DSS and Payment Data Security) applies. The parties must reasonably cooperate in assessing, containing, investigating, remediating, documenting, and, where required, notifying data subjects, Payment Network participants, partner banks, insurers, or any Statutory Authority of the Security Incident.
3.11Audits and Compliance Information. Each party must provide reasonable information and cooperation required to demonstrate compliance with this Schedule, subject to reasonable confidentiality, security, operational, and legal restrictions. KARRABO may satisfy audit or information requests by providing policies, summaries, attestations, certifications, questionnaires, audit reports, or other reasonable evidence rather than allowing direct access to systems where direct access would create security, confidentiality, regulatory, or operational risk.
3.12Retention, Deletion, and Return. Each party may retain Personal Data for as long as lawfully and reasonably necessary for the Services, compliance with Applicable Laws, Payment Network requirements, dispute resolution, audit, tax, accounting, fraud prevention, risk management, recordkeeping, legal claims, enforcement, or documented legitimate business purposes. Where a party acts as data processor, it must delete, return, anonymise, or retain Personal Data in accordance with the controller’s lawful instructions, subject to Applicable Laws and reasonable backup, archival, security, compliance, and legal retention requirements.
3.13Sensitive Personal Data. The Client must not submit sensitive Personal Data to KARRABO unless required for the Services, required by Applicable Laws, requested by KARRABO for lawful compliance purposes, or expressly approved by KARRABO. Where sensitive Personal Data is processed, the Client must ensure that any additional lawful basis, notice, consent, protection, or restriction required by Applicable Laws is satisfied.
3.14Priority. If there is any conflict between this Schedule 3 and Clause 12, this Schedule 3 will prevail for data processing matters. If there is any conflict between this Schedule 3 and mandatory Applicable Laws, the mandatory Applicable Laws will prevail.
Reach out and we’ll help you understand how it applies to you.
Contact us