Where Dakyworld handles personal data belonging to the Client's own customers, staff or contacts, the Client is the data controller and Dakyworld is the data processor. Dakyworld processes that data only on the Client's documented instructions, keeps it confidential, applies appropriate technical and organisational security measures, gives notice before engaging any new sub-processor, assists the Client with data subject requests and with its own compliance obligations, notifies the Client of a personal data breach without undue delay, and returns or deletes the data at the end of the engagement.
These obligations are those required of a processor by Article 28 of the GDPR and by Ghana's Data Protection Act, 2012 (Act 843). A separate Data Processing Agreement is available on request and will be signed at no charge; where one is signed, it prevails over this clause. Dakyworld's own handling of personal data — enquiries, billing, marketing and website analytics — is described in the privacy policy, which forms part of these terms.
Neither party will instruct the other to process personal data in a way that would put it in breach of applicable data protection law, and each will tell the other promptly if it believes an instruction would do so.