1. Roles
You are the controller of personal data you put into the Service ("Customer Personal Data"). Rimbra Limited is your processor and processes it only to provide the Service.
Rimbra is the controller of account and billing data about you and your team, as described in the Privacy Policy.
2. Instructions
We process Customer Personal Data only on your documented instructions, which are these Terms, your use of the Service and any settings you choose. If an instruction appears to break the law, we will tell you.
3. Confidentiality
Everyone at Rimbra who can access Customer Personal Data is bound by confidentiality and has access only where their work needs it.
4. Security
We keep the technical and organisational measures described at rimbra.app/security, including encryption in transit, encryption of storage at rest, access controls, isolation between workspaces, backups and monitoring. We may improve them over time but will not lower the overall level of protection.
5. Sub-processors
You authorise the sub-processors listed at rimbra.app/subprocessors. We will give at least 14 days' notice of a new sub-processor by email or in the dashboard, and you may object on reasonable data protection grounds. Each sub-processor is bound by data protection terms at least as protective as these.
6. International transfers
Customer Personal Data is stored and processed in the European Union (Germany and France). Where it is transferred outside Nigeria or the European Economic Area, we rely on lawful transfer mechanisms under the Nigeria Data Protection Act 2023 and, where it applies, the GDPR.
7. Helping you meet your obligations
We will help you, taking into account the nature of the processing, to answer requests from data subjects, carry out data protection impact assessments and consult regulators. Most requests can be handled directly in the dashboard, for example by exporting or deleting data.
8. Personal data breaches
We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information we have at the time and updates as we learn more.
9. Deletion and return
You can export Customer Personal Data at any time. After your account ends you have 30 days to export it, after which we delete it from active systems, and from backups within a further 90 days, unless the law requires us to keep it.
10. Audits
We will make available the information reasonably needed to show we meet this agreement, and answer reasonable security questionnaires once a year. On-site audits are by agreement, at your cost, with reasonable notice and confidentiality.
11. Contact
Questions about this agreement: legal@rimbra.app. Rimbra Limited, 7 Olufunke Alade Close, Amikanle, Alagbado, Lagos State, Nigeria.