Data Processing Agreement

1. Definitions & Interpretation

"Agreement" means this Data Processing Agreement. "Client" means the party engaging Kraapht Bags Ltd, under a separate order or services arrangement, who supplies personal data for processing in connection with that order. "Data Protection Act" means Ghana's Data Protection Act, 2012 (Act 843). "Personal Data," "Processing," "Data Controller," "Data Processor," "Data Subject," and "Data Breach" have the meanings given to them in the Data Protection Act. "Subprocessor" means any third party engaged by Kraapht Bags Ltd to process Personal Data on its behalf in connection with this Agreement.

2. Scope, Purpose & Duration of Processing

This Agreement applies where a Client provides Kraapht Bags Ltd with personal data belonging to third parties (such as names, and where applicable, addresses, emails, or phone numbers) for the purpose of personalizing or fulfilling an order — for example, printing individual recipient names on branded bags for an event or gift run. Kraapht Bags Ltd processes this personal data only for the duration necessary to complete the order and any related warranty or reprint period, as set out in Section 10.

3. Roles of the Parties

For personal data covered by this Agreement, the Client is the Data Controller and determines the purpose and means of processing. Kraapht Bags Ltd is the Data Processor and processes personal data only on the Client's documented instructions, as set out in the applicable order. The order form, purchase order, or written communication through which the Client supplies personal data and specifies how it should be used (for example, "print these names on these bags") constitutes the Client's documented instructions for the purposes of this Agreement.

3A. Client Warranties

The Client warrants that it has a lawful basis to collect and share the personal data it provides to Kraapht Bags Ltd (for example, the consent of the individuals named), and that providing this data to Kraapht Bags Ltd for the purposes described in Section 2 does not violate any law or the rights of any third party. The Client agrees to indemnify Kraapht Bags Ltd against claims, damages, or costs arising from the Client's breach of this warranty.

4. Kraapht Bags' Obligations as Processor

Kraapht Bags Ltd will:

• Process personal data only on the Client's documented instructions, including those set out in the order
• Not use personal data provided by the Client for any purpose other than fulfilling the Client's order
• Ensure that personnel authorized to process personal data are subject to confidentiality obligations
• Implement appropriate technical and organizational security measures (Section 6)
• Assist the Client in responding to data subject requests and Data Protection Act compliance obligations, to the extent reasonably possible (Section 8)
• Notify the Client of a data breach affecting the Client's personal data (Section 9)
• Not engage a Subprocessor without the Client's consent (Section 7)

5. Confidentiality

Kraapht Bags Ltd will keep personal data provided by the Client confidential and will not disclose it to any third party except as permitted under this Agreement or as required by law.

6. Security Measures

Kraapht Bags Ltd implements reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or disclosure, including access controls, encrypted transmission (HTTPS), and confidentiality obligations for personnel who handle the data.

7. Subprocessors

Kraapht Bags Ltd may engage the following Subprocessors in connection with an order: Paystack (payment processing), Supabase (account and data storage), its email service provider (order notifications), and third-party delivery providers (order fulfillment outside Accra). The Client consents to the use of these Subprocessors. Kraapht Bags Ltd will notify the Client before engaging any new Subprocessor and give the Client the opportunity to object. Some Subprocessors, including Supabase, may store data on servers located outside Ghana; where this is the case, Kraapht Bags Ltd takes steps to ensure the data receives an appropriate level of protection, consistent with the Data Protection Act.

7A. Audit & Compliance

On reasonable written request, Kraapht Bags Ltd will provide the Client with written confirmation of its compliance with this Agreement. Given the scale of its operations, Kraapht Bags Ltd does not offer on-site audits, but will respond in good faith to reasonable requests for information about how the Client's personal data is handled.

8. Assistance With Data Subject Rights

Where a data subject exercises a right under the Data Protection Act (for example, a request for access, correction, or deletion) in relation to personal data processed under this Agreement, Kraapht Bags Ltd will notify the Client and provide reasonable assistance to help the Client respond, as it is the Client's responsibility as Data Controller to respond to the data subject.

9. Data Breach Notification

If Kraapht Bags Ltd becomes aware of a data breach affecting personal data processed under this Agreement, it will notify the Client without undue delay, providing what information is available about the nature of the breach and the personal data affected.

10. Data Return or Deletion at End of Engagement

Kraapht Bags Ltd retains personal data provided by the Client for up to 12 months after the order is completed, to support any reprint, warranty, or defect-related work. After this period, the data is deleted, unless the Client requests earlier deletion, requests that it be returned, or Kraapht Bags Ltd is required to retain it for longer under law.

11. Liability

Liability arising from a breach of this Agreement, including a data breach affecting personal data processed under it, is not subject to the liability cap set out in Kraapht Bags Ltd's Terms of Service, and is instead governed by the terms of this Agreement and applicable law.

12. Governing Law & Term

This Agreement is governed by the laws of the Republic of Ghana, including the Data Protection Act, 2012 (Act 843). It takes effect when a Client provides Kraapht Bags Ltd with personal data for an order and remains in effect for as long as Kraapht Bags Ltd holds that data, including during the retention period described in Section 10.

13. Signatures / Contact

This Agreement applies automatically, as part of the terms on which Kraapht Bags Ltd accepts an order, whenever a Client supplies personal data in connection with that order — signature is not required for it to take effect. Clients who require a formally countersigned copy for their own internal compliance records can request one directly by contacting us — completing it does not change the terms of this Agreement.

Kraapht Bags Ltd
Accra, Ghana
Email: kraaphtbags@gmail.com
WhatsApp / Phone: +233 558 619 224