RuyQA
Log in

Data Processing Addendum

This document details our commitment to data protection and serves as an addendum to our Terms.

Last updated: October 27, 2026
Effective date: October 27, 2026

This Data Processing Addendum (“DPA”) forms part of, and is subject to, the Terms of Service (or other main agreement) between Tensflare Inc. (“Processor”, “we”, “us”) and the customer (“Controller”, “you”) (collectively the “Parties” and each a “Party”) governing the provision of the RuyQA service (the “Service”).

This DPA applies when Processor Processes Personal Data on behalf of Controller in the provision of the Service. By using the Service, Controller agrees to this DPA.

1. Definitions

Capitalized terms not defined here have the meaning in the main agreement or applicable Data Protection Law.

  • Data Protection Law: means the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR) to the extent applicable, Regulation (EU) 2016/679 (GDPR), UK GDPR, and any other applicable data protection or privacy law.
  • Personal Data: means any information relating to an identified or identifiable natural person that is Processed by Processor on behalf of Controller.
  • Process / Processing: means any operation or set of operations on Personal Data.
  • Restricted Transfer: means a transfer of Personal Data to a country or territory outside Nigeria that is not subject to an adequacy decision or equivalent safeguards under the NDPA.
  • Standard Contractual Clauses (SCCs): means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced.

2. Scope and Roles

  • 2.1 Processor acts as a data processor (or sub-processor) and Controller acts as a data controller.
  • 2.2 The subject matter, duration, purpose, and categories of Data are set out in Annex 1.

3. Processing Instructions

3.1 Processor shall Process Personal Data only:

  • on documented instructions from Controller;
  • as necessary to provide the Service;
  • as required by applicable law (in which case Processor shall inform Controller, unless prohibited).

3.2 Processor shall immediately inform Controller if, in its opinion, an instruction infringes Data Protection Law.

4. Confidentiality

4.1 Processor shall ensure that persons authorised to Process Personal Data are bound by confidentiality obligations.

5. Security

5.1 Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including those set out in Annex 2.

6. Sub-processors

6.1 Controller provides general written authorisation for Processor to engage sub-processors.

6.2 Processor shall maintain an up-to-date list of sub-processors (available at /sub-processors).

6.3 Processor shall notify Controller before engaging a new sub-processor.

6.4 Controller may object to a new sub-processor on reasonable grounds relating to data protection within 15 days of notification.

7. Assistance to Controller

Processor shall assist Controller by:

  • Implementing appropriate technical and organisational measures;
  • Notifying Controller without undue delay (within 72 hours) after becoming aware of a Personal Data Breach;
  • Assisting with data subject rights requests, impact assessments, and prior consultations.

8. Data Retention and Deletion

8.1 Processor shall retain Personal Data only for as long as necessary to provide the Service, in accordance with Controller's documented instructions and applicable law.

8.2 Upon termination of the Service, Processor shall, at Controller's election, delete or return all Personal Data within 90 days, subject to legal retention requirements.

9. Audit

9.1 Processor shall make available to Controller all information necessary to demonstrate compliance with this DPA and allow for audits by Controller (or a qualified independent auditor appointed by Controller), provided that:

  • Audits are conducted no more than once per 12 months (except upon a Personal Data Breach);
  • Controller provides at least 30 days' notice;
  • Audits are conducted during business hours and do not unreasonably disrupt Processor's operations;
  • Costs of the audit are borne by Controller unless Processor was found to be non-compliant.

10. International Transfers

10.1 Processor shall not make a Restricted Transfer unless appropriate safeguards are in place.

10.2 For transfers subject to GDPR: The Parties agree to incorporate the Standard Contractual Clauses (Module 2 – Controller to Processor) with Clause 17 governed by the law of Ireland and disputes under Clause 18 resolved by the courts of Ireland.

11. Governing Law

This DPA is governed by the same law, and disputes under it are resolved in the same forum, as the Terms of Service (see Section 9 of the Terms).

IN WITNESS WHEREOF, the Parties have executed this DPA.

Tensflare Inc.

By: ________________________

Name: ______________________

Title: _____________________

Date: ______________________

Controller

By: ________________________

Name: ______________________

Title: _____________________

Date: ______________________

Annex 1 – Data Processing Details

  • Subject matter: Provision of the RuyQA SaaS platform.
  • Nature and purpose: Hosting, storage, retrieval, analysis, and display of test management data.
  • Type of Personal Data: Any Personal Data included in test cases, defects, comments, attachments, user profiles (e.g., names, emails).
  • Categories of Data Subjects: Employees, contractors, or personnel of Controller.

Annex 2 – Technical Measures

  • Encryption in transit (TLS 1.2+) and at rest.
  • Access controls: role-based access, MFA, least privilege.
  • Regular security patching and vulnerability management.
  • Logging and monitoring of access.
  • Backup and disaster recovery procedures.
  • Incident response plan (breach notification within 72h).