Terms of service

These terms apply where a customer subscribes to the Estreat platform without a separately negotiated agreement. Where the customer and Estreat have signed an enterprise agreement, master services agreement or order form containing terms that differ from these, that signed document prevails to the extent of any inconsistency, and these terms apply only to fill any gap it leaves.

Please read section 11 with particular care. Estreat is not a law firm, does not provide legal advice, and does not guarantee any regulatory outcome.

1. Definitions

• Estreat means Estreat Technologies Limited, a private company incorporated in Nigeria and based in Lagos.
• Customer means the organisation that subscribes to the Service, and “you” is read accordingly.
• Service means the Estreat platform, including the modules for record of processing, impact assessments, data subject requests, breach register, evidence vault and CARPath, together with any documentation and support we provide.
• Order Form means the document or online order recording the plan, the subscription term, the number of authorised users, the deployment region and the fees.
• Authorised User means an individual the Customer permits to use the Service under the Customer’s subscription.
• Customer Data means all content the Customer or its Authorised Users submit to or generate in the Service, including personal data contained in it.
• NDPA means the Nigeria Data Protection Act 2023, and GAID means the General Application and Implementation Directive 2025 issued under it.
• DPCO means a Data Protection Compliance Organisation licensed by the Nigeria Data Protection Commission.
• Data Processing Terms means the terms at estreat.ng/legal/dpa, which form part of these terms.

2. Subscription and access

Subject to these terms and to payment of the fees, Estreat grants the Customer a non-exclusive, non-transferable right for its Authorised Users to access and use the Service during the subscription term for the Customer’s internal business purposes, in accordance with the plan and limits set out in the Order Form.

The Service is provided as a hosted service. Estreat retains all right, title and interest in the Service, its software, models, documentation and templates, and in any improvement to them. Nothing in these terms transfers intellectual property in the Service. The Customer may not copy, modify, reverse engineer, resell or make the Service available to a third party except as these terms permit, and may not use the Service to build a competing product.

Estreat may make changes to the Service that improve it or that respond to a change in law or regulatory guidance. We will not make a change that materially reduces the core functionality of the plan the Customer has purchased during a paid term without giving reasonable prior notice.

3. Customer responsibilities and acceptable use

The Customer is responsible for:

• the accuracy, quality and legality of Customer Data, and for having a lawful basis for the processing it instructs through the Service;
• the acts and omissions of its Authorised Users, and for keeping credentials confidential and enabling multi-factor authentication where offered;
• promptly deactivating access for a user who leaves the organisation or changes role;
• notifying Estreat without delay at security@estreat.ng of any suspected unauthorised access to its account;
• its own decisions on compliance, including whether it is an Ultra-High Level, Extra-High Level or Ordinary-High Level entity, what it files with the Commission, and when.

The Customer must not use the Service to:

• upload material that is unlawful, or that infringes another party’s rights;
• store personal data it has no lawful basis to process, or sensitive personal data without the safeguards the NDPA requires;
• probe, scan or test the vulnerability of the Service other than in accordance with our published coordinated disclosure practice on the trust and security page;
• interfere with the integrity or performance of the Service, or attempt to access another customer’s data;
• introduce malicious code, or use automated means to extract the Service beyond documented interfaces.

4. Customer Data and our licence to process it

Customer Data belongs to the Customer. Estreat claims no ownership in it. The Customer grants Estreat a limited licence to host, copy, transmit, display and process Customer Data solely as necessary to provide, secure and support the Service, and as otherwise instructed by the Customer.

Where Customer Data contains personal data, the Customer is the controller and Estreat is the processor. The Data Processing Terms govern that processing and are incorporated into these terms. Estreat does not use Customer Data for its own purposes, does not sell it, and does not use it to train artificial intelligence or machine learning models. Estreat may generate aggregate, de-identified statistics about use of the Service which do not identify the Customer or any individual, and may use those to operate and improve the Service.

The Customer may export its record in a structured format at any time during the subscription term. On termination, Estreat will delete or return Customer Data in accordance with the Data Processing Terms.

5. Confidentiality

Each party may receive information of the other that is marked confidential or that would reasonably be understood to be confidential, including the Service’s non-public features, security documentation, pricing, and Customer Data. The receiving party will use that information only for the purposes of these terms, will protect it with at least reasonable care, and will disclose it only to personnel and advisers who need it and who are bound by equivalent obligations.

These obligations do not apply to information that is or becomes public without breach, was lawfully known before disclosure, or is independently developed. A party may disclose confidential information where required by law or by a competent authority, and will, where lawfully able, give the other party prior notice so that it may seek protective relief.

6. Fees and payment

Fees are stated in the Order Form in Nigerian naira unless expressly stated otherwise, and are payable in naira. Unless the Order Form provides otherwise, fees are invoiced annually in advance and are payable within thirty days of the invoice date.

Fees are exclusive of value added tax and any other applicable tax or levy, which the Customer pays in addition where it is properly chargeable. Where the Customer is required by law to withhold tax from a payment, it will provide the relevant certificate.

Fees are non-refundable except where these terms expressly provide otherwise. Estreat may charge interest on undisputed amounts more than thirty days overdue at the rate of 1.5 per cent per month or the maximum rate permitted by Nigerian law, whichever is lower. Estreat may revise fees on renewal with at least sixty days’ written notice before the end of the current term.

7. Term, renewal and termination

The subscription begins on the start date in the Order Form and continues for the term stated there. Unless the Order Form provides otherwise, the subscription renews automatically for successive terms of the same length. Either party may prevent renewal by giving written notice at least thirty days before the end of the current term.

Either party may terminate for material breach where the breach is not remedied within thirty days of written notice describing it. Either party may terminate immediately if the other becomes insolvent, enters liquidation or administration, or ceases to carry on business. Termination does not relieve the Customer of the obligation to pay fees accrued before termination.

On termination, access to the Service ends. Estreat will make Customer Data available for export for thirty days after termination unless the Customer instructs deletion sooner, and will then delete or return it in accordance with the Data Processing Terms.

8. Suspension

Estreat may suspend access to the Service, in whole or in part, where suspension is reasonably necessary to protect the security or integrity of the Service or of another customer’s data, where use of the Service breaches section 3 in a way that creates a risk of harm or legal liability, or where an undisputed invoice remains unpaid more than thirty days after written notice of non-payment. We will give as much notice as the circumstances allow, limit any suspension to what is necessary, and restore access promptly once the cause is resolved. Suspension does not extend the subscription term or reduce fees except where the suspension was not justified under this section.

9. Support and availability

Estreat will provide the support described in the Order Form or in the applicable plan description, during Nigerian business hours unless otherwise agreed. Estreat will use commercially reasonable efforts to keep the Service available, and will schedule planned maintenance outside Nigerian business hours where practicable and give advance notice of any maintenance likely to interrupt service materially. Where a written service level commitment is agreed in the Order Form, that commitment and its remedies apply.

10. Warranties

Estreat warrants that:

• it has the right to grant the rights in these terms and will provide the Service with reasonable skill and care;
• the Service will perform materially in accordance with its documentation, and where it does not, Estreat will use reasonable efforts to correct the defect;
• it will maintain the technical and organisational security measures described on the trust and security page and in the Data Processing Terms at a standard no less protective during the subscription term.

The Customer warrants that it has the authority to enter into these terms, that it will use the Service in accordance with applicable law including the NDPA and GAID, and that it has the lawful basis and, where required, the notices and consents needed for the Customer Data it submits.

11. No legal advice and no guaranteed outcome

Estreat is a software company. Estreat is not a law firm, is not a licensed Data Protection Compliance Organisation, and does not provide legal advice. Content in the Service, including templates, prompts, classifications, risk scores, readiness indicators and guidance text, is provided for the Customer’s own assessment and does not constitute legal or regulatory advice. The Customer should take advice from qualified counsel or from a licensed DPCO on its specific circumstances.

Where the Service prepares or packages a Compliance Audit Return, the filing is made through a DPCO licensed by the Commission. Estreat prepares and packages the return and works alongside licensed DPCO partners. Estreat does not file on the Customer’s behalf and does not act in the capacity of a licensed DPCO.

Estreat does not warrant or guarantee any regulatory outcome. That includes acceptance of a return, the absence of an enquiry, investigation, sanction or penalty, or a particular determination by the Commission or any court. Responsibility for compliance with the NDPA and GAID remains with the Customer at all times.

Except as expressly set out in section 10, and to the fullest extent permitted by law, the Service is provided without further warranty, whether express, implied or statutory, including any implied warranty of merchantability, fitness for a particular purpose or non-infringement. Estreat does not warrant that use of the Service will be uninterrupted or error free.

12. Limitation of liability

Neither party excludes or limits liability where it may not lawfully do so, including for death or personal injury caused by negligence, or for fraud or fraudulent misrepresentation.

Subject to the paragraph above, neither party is liable for loss of profit, loss of revenue, loss of anticipated savings, loss of business or goodwill, or for indirect or consequential loss, in each case however arising.

Subject to the two paragraphs above, the total aggregate liability of each party under or in connection with these terms, whether in contract, tort including negligence, breach of statutory duty or otherwise, is limited to the total fees paid or payable by the Customer under the Order Form in the twelve months immediately preceding the event giving rise to the claim. Where the claim arises in the first twelve months, the cap is calculated on an annualised basis by reference to the fees for the initial term.

The cap in the paragraph above does not limit the Customer’s obligation to pay fees properly due, or either party’s liability under the indemnities in section 13.

13. Indemnities

Estreat will defend the Customer against a claim by a third party that the Customer’s permitted use of the Service infringes that party’s intellectual property rights, and will indemnify the Customer against damages and reasonable costs finally awarded or agreed in settlement. Estreat may, at its option, modify the Service so that it is non-infringing, procure the necessary right, or terminate the affected subscription and refund fees paid for the unexpired term.

The Customer will indemnify Estreat against claims, damages and reasonable costs arising from Customer Data that is unlawful or infringing, from the Customer’s use of the Service in breach of section 3, or from the Customer’s failure to have a lawful basis for the processing it instructs.

An indemnity applies only where the indemnified party gives prompt written notice of the claim, gives the indemnifying party control of the defence and settlement, and provides reasonable assistance at the indemnifying party’s cost. No settlement that imposes an obligation on the indemnified party may be made without its consent.

14. Force majeure

Neither party is liable for a failure or delay in performance caused by an event beyond its reasonable control, including an act of God, flood, fire, epidemic, civil unrest, act of terrorism, war, act of government or regulator, industrial action, or failure of a public telecommunications or power network. The affected party will notify the other promptly, use reasonable efforts to mitigate, and resume performance as soon as practicable. Where the event continues for more than sixty consecutive days, either party may terminate the affected subscription on written notice.

15. Assignment and subcontracting

Neither party may assign or transfer these terms without the other’s prior written consent, except that either party may assign to an affiliate or to a successor in connection with a merger, acquisition or transfer of substantially all of its business or assets, on written notice. Estreat may engage subprocessors and subcontractors to assist in providing the Service and remains responsible for their performance. Subprocessors that process personal data are governed by the Data Processing Terms.

16. Governing law and jurisdiction

These terms and any dispute arising out of or in connection with them are governed by the laws of the Federal Republic of Nigeria. The parties submit to the exclusive jurisdiction of the courts of Lagos State, Nigeria. Before commencing proceedings, each party will use reasonable efforts to resolve the dispute through discussion between senior representatives for a period of thirty days. Nothing in this section prevents a party from seeking urgent injunctive relief.

17. Notices

Notices to Estreat are given in writing to hello@estreat.ng, and for matters concerning personal data to privacy@estreat.ng. Notices to the Customer are given to the administrative contact recorded in the Order Form or in the Service. A notice sent by email is deemed given on the next business day after sending, provided no delivery failure is received. Operational communications about the Service, including maintenance notices, may be given through the Service or by email to Authorised Users.

18. General

These terms, together with the Order Form and the Data Processing Terms, form the entire agreement between the parties on their subject matter and replace any earlier statement or understanding, except that nothing excludes liability for fraud. Where a signed enterprise agreement exists, it prevails as described at the top of this page.

If a provision is held unenforceable, it is modified to the minimum extent necessary or severed, and the remainder continues in force. A failure to enforce a right is not a waiver of it. There is no partnership, agency or employment relationship between the parties. These terms do not create rights for any third party.

19. Changes to these terms

Estreat may update these terms to reflect a change in the Service, in law or in regulatory guidance. Where a change materially and adversely affects the Customer, we will give at least thirty days’ written notice before it takes effect, and the Customer may terminate the affected subscription before the effective date and receive a pro-rata refund of prepaid fees for the unexpired term. The date at the top of this page records when these terms were last changed.