Part of the SCPL Cloud Terms of Service (version 2026-11-07, last updated 7 November 2026). They apply to personal data that you keep on Systems (as defined in the Terms: a computer we run for you in our cloud, with its storage, restore points, backups and the software on it), apps, databases and storage you buy from SCPL Cloud (“your data”).
1. Who is responsible for what
You are the data controller for your data: you decide what is collected, why, and for how long.
SCPL is your data processor under the Nigeria Data Protection Act 2023: we process your data only to provide the Services, on your instructions.
You are responsible for having a lawful basis for your data, for telling the people concerned how it is used, for any consent you rely on, and for answering their requests. You hold any licence, registration or approval your work needs; we don’t hold them for you.
2. The processing
What we do: host, run, monitor, update, back up and restore your Systems and apps, and keep them secure.
What we don’t do: read, analyse, sell or use your data for anything else, including marketing or training AI models. Our AI assistant never receives your data.
How long: for as long as you keep the service, then as set out in section 8.
Whose data: whoever you keep data about: your customers, staff, members, patients and so on.
3. Instructions and confidentiality
Your instructions are your orders, the settings you choose and your support requests. If we think an instruction breaks the law, we’ll tell you and need not follow it.
Our staff and contractors are bound to confidentiality in writing. We only access your data if you ask us to (for example for support), if it’s needed to keep the service working or secure, or if the law requires it.
If a public authority asks us for your data, we disclose only what the law requires and, where the law allows, tell you first.
4. Where your data is, and sub-processors
Your Systems, including their disks and backups, are in the location you choose when you order: Tier III datacentres in Lagos, Nigeria, or in Nairobi, Kenya. We don’t move them to another location without your written instruction.
Our sub-processor for your data is our infrastructure provider in that location (servers, storage and network). We give you 30 days’ notice before adding or changing a sub-processor for your data; if you object on reasonable grounds, you may end the affected service.
Our own records about you (your account, orders and tickets) are covered by our Privacy Policy, not these terms.
5. Security
We keep appropriate technical and organisational measures for the service you buy, as described on its page: for example HTTPS, firewalls, security updates, two-step sign-in, and, where included, encryption at rest, access logs, warm standby or two-location copies. You are responsible for the security of what you install and of your own users, passwords and devices.
6. Breaches
If we become aware of a breach affecting your data, we tell you without undue delay and within 24 hours, with what we know, and update you as we learn more.
You decide whether to notify the Nigeria Data Protection Commission (the law requires notice within 72 hours of becoming aware of a breach likely to risk people’s rights and freedoms) and the people affected. We give you the facts and logs you need.
7. Helping you with your duties
The apps we provide let you find, export, correct and delete records, so you can answer people’s requests. If someone contacts us about your data, we pass the request to you within 2 working days.
We give you reasonable information for your data protection impact assessments and, once a year or after a breach, answers to a reasonable security questionnaire. On-site audits of the datacentres aren’t available; we pass on our provider’s reports where we can.
8. When the service ends
You can export your data at any time. When a service ends we keep it for the grace period in our Terms so you can take your data, then delete the System, including its backups. For the services in sections 10 and 11, the grace period is at least 30 days, and we confirm the deletion in writing if you ask.
9. Sensitive Data Terms: health and financial records
These apply if you keep health records (including lab results) or members’ or customers’ financial records (savings, loans, repayments, balances) on SCPL Cloud, for example with Clinic and Lab Records or the Cooperative and Microfinance Ledger. They add to sections 1 to 8.
No routine access. Our staff don’t sign in to your applications or read your records. If we ever need to open your records to fix a problem, we ask you first and record who did it, when and why. In an emergency that threatens your data (for example an attack in progress) we may act first and tell you within 24 hours.
Location. These records and their copies stay in Nigeria, always: the products built for them run in our Lagos datacentres only.
Controls. We keep the security controls listed on the service’s page, and won’t lower them without telling you 30 days before.
Your part. Give each person their own account with two-step sign-in, remove leavers the day they leave, review the access log, keep your devices up to date, and don’t put these records in services not built for them (such as a website or a chat inbox).
Regulators. If your regulator requires you to notify it of, or get approval for, using an outside technology provider, you do this; we give you the information you reasonably need.
Fines. Each of us is responsible for regulatory fines caused by our own breach of the law or of these terms. Otherwise the limits in our Terms apply.
10. Clinics and laboratories
Your duty of confidentiality over patient information (including under the National Health Act 2014) stays with you. We support it with the measures above and in the Clinic and Lab Records service.
Health data needs a data protection impact assessment. We give you a template with our parts (hosting, security, sub-processors) filled in; ask us for it.
Records the law requires you to keep for a set time remain your responsibility to keep, including after you leave.
11. Cooperatives, thrift groups and microfinance banks
Cooperatives confirm they are registered with their state’s Director of Cooperatives (or as their state’s law requires), and that the officers who sign up are authorised by their committee or bye-laws.
Thrift and contribution groups confirm they collect from and pay out to their own members only, as their members agreed.
Licensed microfinance banks sign our technology services agreement before go-live; contact us for it.
Your officers are responsible for what they post. The ledger records who entered and who approved each posting, needs a second person for withdrawals, loan payouts, reversals and large amounts, and can’t be edited or deleted. We don’t decide disputes between your members or officers, but give you or a court the records we hold, as the law allows.
12. What we never claim
We don’t say that you, or we, are “compliant”, “approved” or “certified” by any regulator. Our services are built to help you meet your own duties; meeting them stays your responsibility.