Data Processing Agreement & Subprocessors
Last updated: October 22, 2026 • In effect for all Spike Console Workspaces • Corporate Entity: Cyber Ultimax Limited
Data Processing Addendum (DPA) Framework
Conforming with Section 29 of the Nigeria Data Protection Act 2023 and GDPR Article 28.
This Data Processing Addendum ("DPA") governs the processing of personal and business data that Customer (the "Data Controller") enters into the Spike Console platform operated by Cyber Ultimax Limited (the "Data Processor"). By subscribing to or maintaining an active workspace, you agree to this DPA to ensure complete regulatory compliance across all business operations.
Scope & Details of Processing
- Subject Matter: The provision of an Autonomous Business Operating System (CRM, People & Payroll, Finance & Ledger, Commerce, Projects, AI Advisor, and API tooling).
- Duration of Processing: The term of Customer's subscription plus a thirty (30) day post-termination data export window.
- Nature & Purpose: Recording, organizing, computing statutory withholdings, generating invoices, storing order records, and automating event-driven business actions under tenant control.
- Categories of Data Subjects: Customer's employees, contractors, leads, prospects, clients, suppliers, and partners.
Schedule of Approved Subprocessors
Pursuant to NDPA Section 29(2) and GDPR Article 28(2), Customer authorizes Cyber Ultimax Limited to engage the following vetted third-party subprocessors:
| Subprocessor | Service Activity | Entity Location | Security Safeguards |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, managed PostgreSQL databases, encrypted S3 document storage | United States / Global | SOC 1/2/3, ISO 27001, AES-256 encryption at rest |
| Anthropic PBC | Enterprise Generative AI inference for Advisor, SWOT matrices, and business analysis | United States | Zero-retention enterprise API, no training on customer inputs, TLS 1.3 |
| Paystack Payments Ltd | Subscription billing, card debits, automated payouts, virtual dedicated NGN accounts | Nigeria / Africa | CBN Licensed PSSP, PCI-DSS Level 1 compliant |
| Flutterwave Inc | Multi-currency pan-African payments, cross-border settlements, mobile money routing | Nigeria / Pan-Africa / USA | PCI-DSS Level 1, ISO 27001, tokenized transactions |
| Stripe Inc | International subscription billing, USD/EUR credit card processing, dispute handling | United States / Ireland | PCI-DSS Level 1 certified, Standard Contractual Clauses (SCCs) |
| Termii Limited | SMS OTP verification, transaction alerts, and multi-factor authentication routing | Nigeria | NCC Licensed, encrypted transit, local telco firewalls |
| Twilio Inc | Global international SMS, telephony tokens, and WhatsApp notification dispatch | United States | Binding Corporate Rules (BCRs), SOC 2 Type II |
| Amazon SES & SendGrid | Transactional email delivery (workspace invitations, invoice alerts, password resets) | United States | DKIM, SPF, DMARC, TLS transport encryption |
| Cloudflare Inc | DDoS mitigation, edge caching, web application firewall (WAF), custom domain SSL | Global Anycast Edge | SOC 2 Type II, ISO 27001, automated edge certificate rotation |
Subprocessor Changes & Notification Protocol
Cyber Ultimax maintains strict vetting standards for all subprocessors. We provide Workspace Owners with at least thirty (30) calendar days' prior notice before commissioning any new subprocessor or replacing an existing subprocessor that handles customer personal data. Customers may object on reasonable data protection grounds in writing to dpo@cyberultimax.com during the notice window.
Audit Rights & Regulatory Certifications
Upon reasonable written notice (not more than once annually, unless following a verified security incident), Cyber Ultimax shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA and Section 29 of the NDPA 2023. Where requested for statutory enterprise compliance, Cyber Ultimax provides third-party security audit summaries and penetration test attestation letters.
To request a custom signed Data Processing Agreement (DPA) or enterprise compliance package, contact our legal counsel at legal@cyberultimax.com.