Data Processing Agreement

1. Introduction and Scope

This Data Processing Agreement ("DPA") is entered into between the party identified as the Controller in the relevant engagement documentation ("Controller" or "Client") and Corpshore Solutions Corporation, trading as Corpshore Ghana, Accra, Ghana ("Processor" or "Corpshore Ghana").

This DPA forms part of, and is subject to, the Master Services Agreement (MSA), Statement of Work (SOW), or Engagement Letter between the parties (collectively, the "Principal Agreement"). In the event of any conflict between this DPA and the Principal Agreement in relation to the processing of personal data, this DPA shall prevail.

This DPA is intended to satisfy the requirements of Article 28 of the EU General Data Protection Regulation 2016/679 (GDPR), Article 28 of the UK GDPR, and the obligations applicable to data processors under the Ghana Data Protection Act 2012 (Act 843). It applies wherever Corpshore Ghana processes personal data on behalf of the Controller in the course of delivering the Services.

This DPA does not apply to personal data for which Corpshore Ghana acts as a data controller in its own right — for example, data collected through its own website or processed for its own human resources purposes. The handling of such data is described in Corpshore Ghana's Privacy Policy.

2. Definitions

Terms defined in applicable data protection law — including "personal data", "processing", "data subject", "controller", "processor", "supervisory authority", and "data breach" — have the meanings given to them in those laws. In addition, for the purposes of this DPA:

• "Applicable Data Protection Law" means, as relevant to the processing activities, the Ghana Data Protection Act 2012 (Act 843), the EU GDPR, the UK GDPR, and any other data protection or privacy legislation applicable to the processing of personal data under this DPA.
• "Controller" means the Client, being the party that determines the purposes and means of the processing of personal data that is the subject of this DPA.
• "Processor" means Corpshore Ghana, being the party that processes personal data on behalf of the Controller in accordance with this DPA.
• "Processing Instructions" means the documented instructions of the Controller to the Processor regarding the processing of personal data, as set out in the relevant SOW, this DPA, or as otherwise communicated in writing.
• "Sub-Processor" means any third party engaged by Corpshore Ghana to process personal data on behalf of the Controller in connection with the Services.
• "Technical and Organisational Measures" (TOMs) means the security and data protection measures described in section 8 of this DPA.

3. Subject Matter and Duration

The subject matter of this DPA is the processing of personal data by Corpshore Ghana in the course of delivering the Services specified in the Principal Agreement.

The duration of processing under this DPA corresponds to the term of the Principal Agreement, or such shorter period as may be specified in a particular SOW. Processing obligations under this DPA survive termination of the Principal Agreement to the extent necessary to give effect to sections 11 (Return and Deletion of Data) and 12 (Audit Rights).

The specific categories of personal data, categories of data subjects, and nature of processing applicable to each engagement are set out in Schedule 1 (Processing Details) attached to the relevant SOW. Where no Schedule 1 is attached, the description of data types in the relevant SOW or engagement documentation shall serve as the Processing Details for the purposes of this DPA.

4. Nature and Purpose of Processing

The nature and purpose of Corpshore Ghana's processing activities vary by service line. The following describes the principal processing activities relevant to each major service offering:

4.1 Business Process Outsourcing (BPO) — Customer Operations

In the course of delivering BPO and customer operations services, Corpshore Ghana processes personal data of the Controller's end customers, including names, contact details, account information, transaction history, communication records, and complaint data. Processing activities include: receiving inbound contacts, making outbound contacts, updating CRM records, resolving enquiries, processing orders and returns, and generating performance reports. The legal basis for processing is the performance of the contract between the Controller and their end customers, or such other basis as is documented by the Controller.

4.2 AI and Data Services — Training Data Annotation

In the course of providing AI data annotation, labelling, content moderation, and AI quality assurance services, Corpshore Ghana processes datasets supplied by the Controller, which may include images, audio recordings, text, video, or other data containing personal data of third parties. Processing activities include: viewing, annotating, categorising, rating, and labelling data items. Corpshore Ghana does not use such data for any purpose other than the specific annotation task, and does not use it to train Corpshore Ghana's own models without express written consent.

4.3 IT Outsourcing

In the course of providing managed IT services, software development, testing, helpdesk, or system administration services, Corpshore Ghana may access systems that contain personal data of the Controller's employees, customers, or other data subjects. Access is granted solely for the purpose of performing the relevant IT task and is subject to role-based access controls and least-privilege principles.

4.4 HR Outsourcing

In the course of providing HR outsourcing services, including recruitment process outsourcing, HR administration, and payroll processing, Corpshore Ghana processes personal data of the Controller's employees and job applicants, including names, contact details, employment history, payroll data, National ID numbers (where required), and performance records. Processing is carried out strictly in accordance with the Controller's instructions and applicable employment law.

4.5 Finance and Accounting Outsourcing

In the course of providing finance and accounting services, Corpshore Ghana may process financial data that includes personal data of individuals — for example, sole traders, self-employed persons, or named contacts on invoices. Such data is processed for the purposes of bookkeeping, accounts preparation, payroll, and financial reporting.

5. Processor Obligations

Corpshore Ghana, as Processor, agrees to the following obligations in relation to personal data processed under this DPA:

• 5.1 Processing only on instructions: Corpshore Ghana will process personal data only on documented instructions from the Controller, as set out in this DPA, the relevant SOW, and any written instructions subsequently provided. If Corpshore Ghana is required to process data beyond those instructions by applicable law, it will inform the Controller of that legal requirement before processing (unless prohibited from doing so by law).
• 5.2 Confidentiality: Corpshore Ghana will ensure that all staff authorised to process personal data under this DPA are bound by appropriate confidentiality obligations — either statutory or contractual — and have been trained in data protection requirements.
• 5.3 Security: Corpshore Ghana will implement and maintain the Technical and Organisational Measures described in section 8, commensurate with the risks associated with the processing.
• 5.4 Sub-processors: Corpshore Ghana will not engage sub-processors without the prior written consent of the Controller (which may be general consent for the categories of sub-processors listed in section 7 of this DPA).
• 5.5 Assistance with data subject rights: Corpshore Ghana will assist the Controller in responding to data subject rights requests as described in section 10.
• 5.6 Assistance with compliance: Corpshore Ghana will assist the Controller in ensuring compliance with applicable security obligations, data breach notification requirements, data protection impact assessments (where required), and prior consultation with supervisory authorities.
• 5.7 Deletion or return: At the Controller's option, Corpshore Ghana will securely delete or return all personal data upon termination of the relevant engagement, as described in section 11.
• 5.8 Audit cooperation: Corpshore Ghana will make available all information necessary to demonstrate compliance with this DPA and will cooperate with audits as described in section 12.
• 5.9 Notification of unlawful instructions: If Corpshore Ghana considers that an instruction from the Controller infringes applicable data protection law, it will promptly inform the Controller. Corpshore Ghana is not required to follow instructions that it reasonably considers to be unlawful.

6. Controller Obligations

The Controller agrees to the following obligations:

• The Controller is responsible for ensuring that it has a lawful basis for the processing of personal data that it shares with Corpshore Ghana and that it has provided all necessary privacy notices to data subjects.
• The Controller will not instruct Corpshore Ghana to carry out any processing that would cause Corpshore Ghana to breach applicable data protection law.
• The Controller will promptly notify Corpshore Ghana of any changes to applicable law or regulatory guidance that may affect the processing activities carried out under this DPA.
• The Controller will ensure that the personal data it provides to Corpshore Ghana is accurate, relevant, and limited to what is necessary for the specified processing purpose.
• The Controller will co-operate with Corpshore Ghana in the implementation of appropriate security measures and in the resolution of any data breach or data subject rights request.

7. Sub-Processors

The Controller grants Corpshore Ghana general written consent to engage the sub-processors listed below. Corpshore Ghana will impose obligations on each sub-processor that are equivalent to those imposed on Corpshore Ghana under this DPA. Corpshore Ghana remains fully liable to the Controller for the performance of sub-processors' obligations.

Corpshore Ghana will notify the Controller of any intended addition or replacement of sub-processors via email at least thirty (30) days before the change takes effect, giving the Controller the opportunity to object. If the Controller raises a reasonable objection to a new or replacement sub-processor, the parties will work in good faith to resolve the objection. If the objection cannot be resolved and the sub-processor change is essential to the delivery of the Services, either party may terminate the affected SOW upon thirty (30) days' notice.

8. Technical and Organisational Security Measures (TOMs)

Corpshore Ghana implements the following Technical and Organisational Measures, which are designed to be appropriate to the risk presented by the processing and are aligned with the requirements of the Ghana Data Protection Act 2012 (Act 843) and the GDPR:

8.1 Access Controls

• Role-based access control (RBAC): access to personal data is granted only to staff who require it for their specific job function.
• Multi-factor authentication (MFA) is required for access to systems containing personal data.
• Privileged access management (PAM) controls for system administrators.
• Automatic session timeouts for inactive sessions.
• Regular access reviews and prompt removal of access upon staff departure or role change.

8.2 Encryption

• Data in transit is encrypted using TLS 1.2 or higher for all communications between Corpshore Ghana's systems and external parties.
• Data at rest is encrypted using AES-256 or equivalent encryption on all storage systems containing personal data.
• Portable media containing personal data is encrypted prior to use.

8.3 Physical Security

• Access to Corpshore Ghana's offices and data processing facilities in Accra is controlled by physical access controls including keycards, visitor registration, and CCTV monitoring.
• Clear desk and screen lock policies are enforced.
• Secure disposal of physical documents containing personal data by cross-cut shredding.

8.4 Staff Training and Vetting

• All staff receive data protection and information security training upon onboarding and annually thereafter.
• Staff who process personal data sign confidentiality agreements as a condition of employment.
• Background checks are conducted on all staff who access personal data, in accordance with applicable Ghana labour law.

8.5 Incident Management

• Corpshore Ghana maintains a documented data breach response procedure.
• A dedicated incident response team is responsible for detecting, containing, and reporting security incidents.
• Security incidents are logged and reviewed to identify root causes and prevent recurrence.

8.6 System and Network Security

• Firewalls, intrusion detection systems, and endpoint protection software are deployed on all systems.
• Operating systems and software are kept up to date with security patches.
• Vulnerability assessments and penetration tests are conducted at least annually.
• Separation of production and non-production environments; personal data is not used in non-production environments without anonymisation or explicit authorisation.

8.7 Data Minimisation and Pseudonymisation

• Corpshore Ghana applies data minimisation principles: only personal data necessary for the specific processing task is accessed by operational staff.
• Where technically feasible and agreed with the Controller, pseudonymisation or anonymisation techniques are applied to reduce the risk associated with the processing.

9. Data Breach Notification

In the event that Corpshore Ghana becomes aware of a personal data breach affecting personal data processed under this DPA, Corpshore Ghana will:

• Notify the Controller without undue delay and in any event within seventy-two (72) hours of becoming aware of the breach, in accordance with the requirements of Article 33 GDPR and the Ghana Data Protection Act 2012.
• Provide the Controller with sufficient information to enable the Controller to assess the breach and fulfil its own notification obligations to supervisory authorities and data subjects. The notification will include, to the extent available: a description of the nature of the breach; the categories and approximate number of data subjects affected; the categories and approximate volume of personal data records affected; the likely consequences of the breach; and the measures taken or proposed to address the breach and mitigate its effects.
• Co-operate fully with the Controller in investigating and mitigating the breach.
• Not notify affected data subjects or supervisory authorities directly without the prior agreement of the Controller, unless Corpshore Ghana is required to do so by applicable law.

Corpshore Ghana will document all personal data breaches, including those that do not require notification, and make that documentation available to the Controller upon request.

The Controller remains responsible for assessing whether a breach must be notified to the relevant supervisory authority and/or to affected data subjects, and for making such notifications within the applicable legal timeframes.

10. Data Subject Rights

Corpshore Ghana will assist the Controller in responding to data subject rights requests. Where Corpshore Ghana receives a request from a data subject exercising their rights — for example, a request for access, rectification, erasure, restriction, portability, or objection — directly in connection with data processed under this DPA, Corpshore Ghana will:

• Promptly forward the request to the Controller;
• Not respond to the data subject directly without the Controller's authorisation, unless required to do so by applicable law; and
• Provide the Controller with reasonable assistance in retrieving, correcting, or deleting the relevant personal data as required to fulfil the request, within the timeframes and to the extent technically feasible.

The Controller is responsible for making the substantive decision on how to respond to any data subject rights request.

11. Return and Deletion of Data

Upon termination or expiry of the relevant SOW or Principal Agreement, or upon written request from the Controller, Corpshore Ghana will, at the Controller's choice:

• Securely delete or destroy all personal data processed under this DPA (including any copies held by sub-processors) within thirty (30) days; or
• Return all personal data to the Controller in a commonly used, machine-readable format within thirty (30) days, and then securely delete all copies held by Corpshore Ghana.

Corpshore Ghana will provide the Controller with written confirmation that deletion has been completed. Corpshore Ghana may retain personal data beyond this period only where it is required to do so by applicable law or a legal obligation, in which case it will notify the Controller of the specific legal basis and the period of retention.

12. Audit Rights

Corpshore Ghana will make available to the Controller all information reasonably necessary to demonstrate its compliance with the obligations set out in this DPA and, upon reasonable notice and at the Controller's cost, will permit and contribute to audits and inspections by the Controller or an independent auditor appointed by the Controller, subject to the following conditions:

• Audits may take place no more than once per calendar year in the absence of a suspected breach, and upon reasonable notice of at least thirty (30) days (save in the case of a confirmed or suspected breach, where shorter notice is permitted).
• Audits will be conducted during Corpshore Ghana's normal business hours and in a manner that minimises disruption to Corpshore Ghana's operations.
• The Controller's auditors must sign appropriate confidentiality undertakings before accessing Corpshore Ghana's premises, systems, or records.
• Corpshore Ghana may satisfy its audit obligations by providing the Controller with a copy of a relevant third-party audit report or certification (such as ISO 27001 or SOC 2 Type II, where held), provided that such report covers the period and processing activities in question.

13. International Data Transfers

Corpshore Ghana will not transfer personal data to a country outside the European Economic Area (EEA) or the United Kingdom without the prior written authorisation of the Controller, except where:

• The transfer is to a country that has been recognised as providing an adequate level of data protection by the European Commission or the UK Information Commissioner's Office;
• Appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs), which Corpshore Ghana will execute with the Controller or with relevant sub-processors as appropriate; or
• The transfer falls within one of the derogations set out in Article 49 GDPR.

Transfers from Ghana to third countries are conducted in accordance with Part V of the Ghana Data Protection Act 2012, which requires that the destination country provides equivalent protection or that appropriate contractual safeguards are in place.

Where the Controller requires SCCs or IDTAs to be executed to authorise transfers, Corpshore Ghana will execute those instruments promptly upon the Controller's request. Where SCCs are the transfer mechanism, the applicable module of the SCCs (as updated by the European Commission from time to time) will be incorporated by reference into this DPA.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Principal Agreement, except to the extent that applicable data protection law imposes liability that cannot be limited or excluded by contract.

Where a data subject suffers damage as a result of a breach of applicable data protection law and both the Controller and the Processor bear some responsibility for that damage, each party shall be liable for the part of the damage for which it is responsible. Corpshore Ghana, as Processor, may be exempt from liability where it demonstrates that it is not at fault for the event giving rise to the damage.

15. How to Execute This DPA

16. Governing Law

This DPA is governed by the laws of the Republic of Ghana, including the Ghana Data Protection Act 2012 (Act 843) and regulations made thereunder. Where GDPR or UK GDPR obligations apply by reason of the nature of the Controller or the data subjects involved, those obligations are incorporated into this DPA and take precedence to the extent of any conflict with Ghanaian law, except where Ghanaian law imposes more stringent obligations.

Disputes arising under this DPA shall be resolved in accordance with the dispute resolution provisions of the Principal Agreement. The parties acknowledge that effective data protection enforcement may require urgent interim relief from a court of competent jurisdiction, and this DPA does not limit either party's right to seek such relief.

This DPA shall be reviewed and updated at least every two (2) years or whenever required by changes to applicable data protection law, and any updates shall be notified to the Controller with reasonable advance notice.