Data processing terms

01Roles

For personal data inside the customer's workspace, the customer is the controller and Spotledger is the processor. Spotledger processes it only to provide the service.

For radio recordings of public broadcasts, Spotledger decides the purposes of recording and matching. The same protections described here apply to any personal data in them.

02What is processed, and why

• Purpose: to provide the Spotledger service to the customer for as long as the customer has an account.
• People: the customer's team members, and people whose voices are heard in radio recordings and transcripts, such as presenters, callers and guests.
• Data: names, work emails and roles of team members; adverts, scripts and plans uploaded by the customer; audio and transcripts of public radio.
• Nature: storing, fingerprinting, transcribing, matching, reporting and deleting.

03Instructions

Spotledger processes personal data only on the customer's documented instructions, which are these terms, the terms of use and the customer's use of the workspace. If an instruction would break the law, Spotledger will say so.

04People who handle the data

Everyone at Spotledger who can see personal data is bound by confidentiality and sees only what their work needs.

05Security

• Each customer's data is separated and every request is limited to the customer's own organisation.
• Access is by role, and changes are written to an audit log that the customer's owner can read.
• Data is protected in transit, and secrets are never stored in code.
• Raw audio is deleted after 7 days and clips after about 13 months.

06Other processors

Spotledger uses other providers to run the service: cloud hosting and storage, speech to text, language services that receive transcript text, and email delivery. Each is bound by terms that give the same level of protection. We keep a list and will tell the customer before adding a provider that handles the customer's personal data. A customer who objects may end the agreement.

07Transfers outside Nigeria

Where personal data is processed outside Nigeria, Spotledger follows the cross-border transfer rules of the Nigeria Data Protection Act 2023 and records the basis for each transfer. The security page lists the steps that send data to other services, and we give the services and regions that apply to a workspace on request.

08Helping with requests from people

If someone asks the customer to see, correct or delete their personal data, Spotledger will help the customer to respond within the time the law allows. If someone contacts Spotledger directly about the customer's data, Spotledger will pass the request to the customer.

09Personal data breaches

• Spotledger will tell the customer without undue delay after becoming aware of a breach affecting the customer's personal data, with what happened, what data is involved, what we are doing and who to contact.
• Where a breach is likely to put people at risk, the controller must tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as section 40 of the Nigeria Data Protection Act 2023 requires. Spotledger gives the customer what it needs, in time, to do this.
• Spotledger will also tell the Commission about breaches in its own role as a controller.

10Assessments and audits

Spotledger will give the customer the information needed to show that it follows these terms, and help with data protection impact assessments. The customer may audit Spotledger with reasonable notice, no more than once a year unless there has been a breach.

11When the agreement ends

On the customer's request, Spotledger will delete the customer's content and workspace data, or return it, within a reasonable time, unless the law requires us to keep something. Raw audio and clips follow the retention periods in the privacy notice.

12Law that applies

These terms are governed by the laws of the Federal Republic of Nigeria.