Data Processing Agreement

Last updated: 2 November 2026

This Data Processing Agreement (“DPA”) is between you, the customer (“you”, the controller), and Zedapex Limited, Lagos (“Zedapex”, “we”, the processor), the company that operates Joinvoo. It forms part of, and is incorporated by reference into, our Terms of Service, and applies whenever we process personal data on your behalf. You accept it when you accept the Terms. Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given in the GDPR.

“Data Protection Law” means all laws that apply to the processing, including the GDPR, the UK GDPR and UK Data Protection Act 2018, the Nigeria Data Protection Act 2023, and, where relevant, US state privacy laws such as the CCPA/CPRA. “Customer Data” means the personal data we process for you under the Terms.

1. Subject matter, duration, nature and purpose

• Subject matter: providing the Joinvoo Service to you as described in the Terms.
• Duration: for as long as we provide the Service to you, plus the period until Customer Data is deleted under section 9.
• Nature: collecting, recording, storing, matching, organising, encrypting, displaying, transmitting (to the recipients you choose), and deleting data, by automated means.
• Purpose: tracking clicks, joins, visits and conversions from your ads; sending conversion events to the platforms and addresses you set up; running landing pages, offer rotation and channel copies; storing and answering your managers’ chats in Team inbox, including AI replies and Flows when you switch them on; reports, exports and the API; and support you ask for.

2. Data subjects and types of data

• Your leads: people who click your tracking links, visit your landing pages or tracked websites, join your Telegram channels or groups, start your bots, or open your mini apps. Data: IP address, browser and device, approximate country, page address and campaign tags, ad click identifiers and ad cookies, Telegram user ID, first and last name, username and language, join and leave events, offers shown, and conversions reported to us (event, amount, currency, reference).
• Your chat contacts: people who write to your managers in Telegram Business chats the managers allow. Data: Telegram ID, name, username, small profile picture, and, with Team inbox on, message text, references to photos, voice notes and files, voice-note transcripts, and your team’s notes, tags and statuses.
• Your team members and agency clients: name, email, role, login and activity data.
• People in your content: anyone shown in media or text you upload or copy between channels.

You must not send us special categories of personal data (for example health, religion, sexual orientation or biometric data), data about criminal convictions, or government ID or payment card numbers, unless we agree in writing. If such data arrives in a chat, it is processed only as part of that conversation.

3. Our duties as processor

• Instructions. We process Customer Data only on your documented instructions. Your instructions are the Terms, this DPA and the settings and actions you choose in the Service. We may also process it where the law requires us to; in that case we tell you first unless the law forbids it. We tell you if we believe an instruction breaks Data Protection Law.
• Confidentiality. Only staff and contractors who need access to provide, secure or support the Service may access Customer Data, and they are bound by confidentiality.
• Security. We apply the measures in section 4 and keep them appropriate to the risk.
• Help with rights requests. Taking into account the nature of the processing, we help you answer data subjects’ requests, mainly through the Service’s features (search, export and deletion) and, where needed, by request. If a data subject contacts us directly, we pass the request to you and do not answer it ourselves except to say we have done so.
• Help with compliance. We give you reasonable information and help for your data protection impact assessments, prior consultations with authorities and security duties, taking into account the information available to us.
• Records. We keep the records of processing that Data Protection Law requires of a processor.

4. Security measures (summary)

• Encryption in transit (HTTPS) for all connections to the Service.
• Encryption at rest (AES-256-GCM) for Team inbox messages and notes, AI setup notes, Telegram bot tokens, secret settings and the sign-in tokens of ad platforms connected by logging in.
• One-way hashing of passwords and API keys; Telegram IDs hashed before they are sent to ad platforms.
• Data minimisation and retention limits: unjoined clicks deleted after 90 days; IP address, device and ad cookies removed from joined clicks after 180 days; Team inbox messages deleted after 180 days, and 30 days after the add-on is turned off; other limits as listed in our Privacy Policy.
• Telegram Business access limited by Telegram to the one-to-one chats a manager allows; no groups, channels, secret chats or earlier messages.
• Role-based access for your team; restricted, logged staff access to admin tools; API keys with permissions, channel limits and IP allow-lists.
• Daily backups kept for 7 days; new-login alerts and session management for customers.

5. Subprocessors

• You give us general authorisation to use subprocessors. Our current subprocessors are listed on our Subprocessors page.
• We impose on each subprocessor data protection terms that protect Customer Data at least as well as this DPA in substance, and we remain responsible to you for their performance under this DPA.
• We give at least 15 days’ notice of a new subprocessor by updating that page and by email or dashboard notice, except where an urgent change is needed for security or continuity, in which case we tell you as soon as we can.
• You may object on reasonable data protection grounds within that period. We will then try to address the objection; if we cannot, you may stop using the affected feature or close your account, and we refund the paid credits you haven’t used.
• Recipients you choose (such as Telegram, ad platforms, your trackers and webhooks, and your own bot server) are not our subprocessors. They receive data on your instruction, under your own relationship with them.

6. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, and give you the information you reasonably need to meet your own duties (what happened, the data and people likely affected, likely consequences, and what we are doing), in stages if not all is known at once. We take reasonable steps to contain it. Notifying you is not an admission of fault.

7. International transfers

• We may process Customer Data, and let subprocessors process it, outside the country where it was collected, including in the United States.
• Where Customer Data from the EEA or Switzerland is transferred to a country without an adequacy decision, the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) are incorporated into this DPA by reference: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor for your own client. For them: clause 7 (docking) applies; under clause 9 option 2 (general authorisation) applies with the notice period in section 5; the optional wording in clause 11 does not apply; under clauses 17 and 18 the law and courts of Ireland apply; Annex I is filled in by sections 1 and 2 of this DPA (you are the data exporter and Zedapex the data importer), Annex II by section 4, and Annex III by the Subprocessors page.
• For transfers from the UK, the UK International Data Transfer Addendum (version B1.0) issued by the Information Commissioner applies to those clauses, with the information in this DPA used to complete its tables; either side may end it as allowed by its section 19.
• Where another country’s law requires a transfer mechanism, the closest equivalent safeguard applies. If a mechanism stops being valid, we will work with you on an alternative.

8. Your duties as controller

• You have a lawful basis for all Customer Data you have us process and for every recipient you send it to, including ad platforms, trackers and webhooks, and you obtain any consent required (for example for cookies, pixels and tracking on your pages).
• You give your leads, chat contacts and website visitors the notices the law requires, including how their data is used for ad measurement and, where you use AI replies or Flows, that they may be talking to an AI where the law requires that disclosure (for example under the EU AI Act).
• You do not send us special-category data except as section 2 allows, and you do not use the Service to target children.
• You are responsible for the accuracy of the data you give us and for answering data subjects’ requests.

9. Deletion or return at the end

You can export your data from the dashboard or through the API while your account is open. When the Service ends, we delete Customer Data within a reasonable period (normally within 30 days), after which it may remain only in backups until they roll over (up to 7 days), unless the law requires us to keep it. If you ask before closure, we help you export it first.

10. Audits

We make available the information reasonably necessary to show we meet this DPA. You agree to rely first on our written answers, documents and any certifications or third-party reports we have. If these are not enough, or an authority requires it, you may audit us, at your own cost, no more than once a year (unless after a breach), with at least 30 days’ written notice, during business hours, without disrupting our operations or seeing other customers’ data, and through an independent auditor bound by confidentiality. Audits of subprocessors happen through their own reports and terms.

11. Liability and order of precedence

Each side’s liability under or in connection with this DPA, including the Standard Contractual Clauses to the extent the law allows, is subject to the limitations and exclusions of liability in the Terms. If this DPA conflicts with the Terms on the processing of Customer Data, this DPA wins; if it conflicts with the Standard Contractual Clauses, the Clauses win.

12. Contact

Data protection questions and notices under this DPA: [email protected]