1. Introduction and scope
1.1 This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Cosine Terms of Service (the "Terms"). Capitalised terms not defined here have the meaning given in the Terms.
1.2 This DPA applies where Cosine processes Personal Data on behalf of the School in connection with the Services.
1.3 This DPA is entered into between:
- the School, acting as Controller; and
- Cosine Technologies Limited, acting as Processor.
1.4 Where a conflict arises between this DPA and the Terms in respect of the processing of Personal Data, this DPA prevails.
1.5 This DPA takes effect on the date the School accepts the Terms and continues for as long as Cosine processes Personal Data on the School's behalf.
2. Definitions
"Applicable Data Protection Law" means the Nigeria Data Protection Act 2023 ("NDPA"), any subsidiary legislation, regulation, directive, or guidance issued under it by the Nigeria Data Protection Commission ("NDPC"), and any other data protection or privacy law applicable to a party in respect of the Processing under this DPA.
"Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", and "Sensitive Personal Data" have the meanings given in the NDPA.
"Child" means a person under the age of 18 years.
"School Personal Data" means Personal Data that Cosine Processes on behalf of the School under the Terms, as described in Annex 1.
"Sub-processor" means any third party engaged by Cosine to Process School Personal Data.
3. Roles of the parties
3.1 The School is the Controller of School Personal Data. The School determines the purposes and means of Processing, and is responsible for the lawfulness of the Processing it instructs.
3.2 Cosine is the Processor in respect of School Personal Data and Processes it only on the School's documented instructions.
3.3 Cosine acts as an independent Controller, and this DPA does not apply, in respect of:
(a) account registration, identity and business verification, and know-your-customer checks carried out on the School, its directors, and its beneficial owners;
(b) fraud prevention, anti-money laundering, sanctions screening, and security monitoring;
(c) billing, collection of amounts due to Cosine, credit risk management, and financial record-keeping;
(d) compliance with Cosine's own legal, regulatory, and reporting obligations;
(e) the generation and use of aggregated or de-identified data under clause 13.4 of the Terms; and
(f) direct communications between Cosine and the School's users about the Services, including service notices, support, and product updates.
In respect of these activities, Cosine's Privacy Policy applies and Cosine determines its own lawful basis.
3.4 Payers. In respect of Payers, both parties Process Personal Data. The School is the Controller of the underlying billing relationship and the contact details it supplies. Cosine is the Processor when issuing invoices, sending reminders, and attributing payments on the School's instruction, and is an independent Controller for the purposes listed in clause 3.3.
3.5 Each party is responsible for its own compliance with Applicable Data Protection Law in the capacity in which it acts.
4. The School's obligations
4.1 The School warrants and undertakes that:
(a) it has a valid lawful basis under the NDPA for each Processing operation it instructs, and has identified that basis;
(b) it has provided all privacy notices required by Applicable Data Protection Law to Data Subjects, including students, parents, guardians, and staff, covering the disclosure of their Personal Data to Cosine and its Processing under the Terms;
(c) it has obtained all consents required by Applicable Data Protection Law, including the consent of a parent or legal guardian where required in respect of a Child under section 31 of the NDPA, and has taken reasonable steps to verify that consent was given by a person holding parental responsibility;
(d) the Personal Data it uploads or supplies is accurate, is limited to what is adequate, relevant, and necessary for the purposes of the Services, and is lawfully obtained;
(e) it has the authority to instruct Cosine to Process School Personal Data; and
(f) its instructions to Cosine will not cause Cosine to breach Applicable Data Protection Law.
4.2 The School must not upload, transmit, or otherwise make available through the Services any category of Personal Data not described in Annex 1. In particular, the Services are not designed for and must not be used to Process Sensitive Personal Data, including health, medical, dietary, biometric, genetic, religious, or disciplinary information relating to any Data Subject. Where the School uploads such data, including by entering it into a free-text field, it does so in breach of this DPA and at its own risk, and Cosine has no obligation to apply any additional safeguard to it.
4.3 The School is responsible for maintaining the accuracy of School Personal Data, for removing records that are no longer required, and for managing user permissions under clause 3.4 of the Terms.
4.4 The School must maintain, and provide to Cosine on reasonable request, evidence of the consents and notices referred to in clause 4.1.
5. Cosine's processing obligations
5.1 Documented instructions. Cosine will Process School Personal Data only:
(a) as necessary to provide the Services under the Terms;
(b) in accordance with the School's further documented instructions, where those instructions are consistent with the Terms and technically feasible; and
(c) as required by law to which Cosine is subject.
5.2 Where Cosine is required by law to Process School Personal Data other than on the School's instructions, it will inform the School of that requirement before Processing, unless prohibited from doing so by that law.
5.3 Cosine will inform the School without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law. Cosine may suspend performance of the instruction until it is withdrawn, amended, or confirmed.
5.4 Cosine will not sell School Personal Data, and will not Process it to market or advertise to Data Subjects, to build behavioural or advertising profiles of Data Subjects, or to disclose it to third parties for their own marketing purposes.
5.5 Reference and case study use. Clause 5.4 does not prevent Cosine from:
(a) identifying the School as a customer and using the School's name and logo in accordance with clause 14.4 of the Terms;
(b) publishing aggregated or de-identified metrics derived from the School's use of the Services under clause 13.4 of the Terms; or
(c) publishing a case study, customer story, testimonial, or quotation, provided that any Personal Data of an identifiable individual included in it is used with that individual's separate, specific, and freely given consent, which Cosine will obtain and record.
Cosine will give the School a reasonable opportunity to review a case study or customer story before publication, and will not include School Personal Data relating to students, parents, guardians, or Payers in any such material.
5.6 The Services use automated matching to attribute incoming payments, as described in clause 8.4 of the Terms. This Processing does not produce a legal or similarly significant effect on any Data Subject, and Cosine provides tools for the School to review and correct attributions. Where the School enables features that involve automated decision-making with significant effects on a Data Subject, the School is responsible for meeting the requirements of the NDPA in respect of that Processing.
6. Confidentiality and personnel
6.1 Cosine will ensure that any person authorised to Process School Personal Data:
(a) is subject to a binding obligation of confidentiality, whether contractual or statutory, that survives the end of their engagement;
(b) is granted access only to the extent necessary for their role, on a least-privilege basis; and
(c) receives appropriate training on data protection and information security.
6.2 Cosine will maintain a record of persons with access to production systems containing School Personal Data and will review that record periodically.
7. Security
7.1 Cosine will implement and maintain appropriate technical and organisational measures to protect School Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk to Data Subjects.
7.2 The measures in place as at the date of this DPA are described in Annex 2.
7.3 Cosine may update the measures in Annex 2 from time to time, provided that the updated measures do not materially reduce the overall level of security.
7.4 The School is responsible for the security of its own systems, devices, and credentials, and for configuring the access controls available to it within the Services.
8. Sub-processors
8.1 General authorisation. The School gives Cosine general authorisation to engage Sub-processors for the provision of the Services.
8.2 The Sub-processors engaged as at the date of this DPA are listed at the Sub-processor List published on the Cosine website.
8.3 Terms. Cosine will:
(a) carry out reasonable due diligence on each Sub-processor before engagement;
(b) impose on each Sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA; and
(c) remain fully liable to the School for the acts and omissions of each Sub-processor as if they were its own.
8.4 Changes. Cosine will give the School at least 30 days' notice before adding or replacing a Sub-processor, by updating the Sub-processor List and notifying the School by email or in-product notification. The School may subscribe to change notifications at security@trycosine.com.
8.5 Objection. The School may object to a new Sub-processor within 15 days of notice, on reasonable data protection grounds, by writing to security@trycosine.com. The parties will discuss the objection in good faith. If Cosine is unable to offer a reasonable alternative within 30 days, the School may terminate the Terms in respect of the affected Services on written notice, without penalty, and clause 21.4 of the Terms applies. This is the School's sole remedy in respect of an objection.
8.6 Cosine may engage a replacement Sub-processor immediately and without prior notice where required to preserve the security or continuity of the Services, and will notify the School as soon as practicable afterwards.
9. International transfers
9.1 Location of Processing. School Personal Data is Processed outside Nigeria. Cosine's primary database and file storage are hosted in Stockholm, Sweden (European Union). Other Sub-processors Process School Personal Data in the jurisdictions identified in the Sub-processor List.
9.2 Basis for transfer. Cosine transfers School Personal Data outside Nigeria in reliance on appropriate safeguards constituting a Cross-Border Data Transfer Instrument under sections 41 to 43 of the NDPA and the NDPC General Application and Implementation Directive 2025 ("GAID"). Specifically:
(a) Cosine has entered into a written data processing agreement with each Sub-processor that Processes School Personal Data outside Nigeria, imposing obligations that ensure a level of protection substantially equivalent to that required by the NDPA, including obligations as to purpose limitation, security, confidentiality, onward transfer, and the exercise of Data Subject rights;
(b) where the Sub-processor is established in, or transfers data to, a jurisdiction subject to the European Union General Data Protection Regulation, those agreements incorporate the European Commission Standard Contractual Clauses or equivalent binding contractual protections; and
(c) Cosine has assessed the legal framework of each receiving jurisdiction, and records that assessment.
9.3 Where the NDPC has issued or subsequently issues an adequacy decision, approved Cross-Border Data Transfer Instrument, standard contractual clause, code of conduct, or certification mechanism applicable to a transfer under this DPA, the parties will take reasonable steps to adopt it, and Cosine will update this clause accordingly.
9.4 Cosine will maintain a record of the safeguards applied to each transfer, including its transfer risk assessments, and will make a summary available to the School on reasonable request.
9.5 Cosine will not transfer School Personal Data to a Sub-processor in a jurisdiction that has no enforceable data protection framework unless it has completed a documented transfer risk assessment and implemented additional safeguards.
9.6 The School acknowledges that School Personal Data will be Processed in the jurisdictions described in clause 9.1, and that this is a necessary consequence of Cosine's use of the infrastructure described in the Sub-processor List. The School is responsible for reflecting this in the privacy notices it provides to Data Subjects under clause 4.1(b).
10. Children's data
10.1 The parties acknowledge that the Services involve the Processing of Personal Data relating to Children, including students enrolled at the School.
10.2 The School is responsible for the lawful basis for Processing Children's Personal Data, including obtaining and recording the consent of a parent or legal guardian where required under section 31 of the NDPA, and for verifying that consent was given by a person holding parental responsibility.
10.3 Cosine will:
(a) Process Children's Personal Data only as necessary to provide the Services on the School's instructions;
(b) not use Children's Personal Data for marketing, advertising, behavioural profiling, or any purpose unrelated to the Services;
(c) not disclose Children's Personal Data to any third party other than a Sub-processor engaged under clause 8, or as required by law; and
(d) apply the security measures in Annex 2 to Children's Personal Data without distinction.
10.4 Where a Child's Personal Data is included in inputs used to assess or administer a Credit Facility, it will be limited to aggregated enrolment and payment history and will not include individual academic, behavioural, or health information.
10.5 Where the School becomes aware that consent for a Child's Personal Data has been withheld, withdrawn, or was not validly obtained, it must promptly remove or restrict the relevant records through the Services, or instruct Cosine to do so.
11. Data subject rights
11.1 The School is responsible for responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Law, including rights of access, rectification, erasure, restriction, objection, and portability.
11.2 Cosine will provide, within the Services, functionality enabling the School to access, correct, export, restrict, and delete School Personal Data.
11.3 Where the functionality in clause 11.2 is not sufficient to enable the School to respond to a request, Cosine will provide reasonable assistance on written request, taking into account the nature of the Processing and the information available to it.
11.4 Where Cosine receives a request directly from a Data Subject in respect of School Personal Data, it will not respond to the substance of the request, and will:
(a) promptly redirect the Data Subject to the School; and
(b) notify the School of the request without undue delay, and in any event within 5 business days.
11.5 Cosine may charge a reasonable fee for assistance under clause 11.3 where the request is manifestly unfounded, excessive, or repetitive, or where the assistance requires significant engineering effort. Cosine will notify the School of any such fee before incurring it.
12. Personal data breach
12.1 Cosine will notify the School of a Personal Data Breach affecting School Personal Data without undue delay, and in any event within 48 hours of becoming aware of it.
12.2 The notification will include, to the extent known at the time and updated as further information becomes available:
(a) a description of the nature of the breach, including where possible the categories and approximate number of Data Subjects and records concerned;
(b) the likely consequences of the breach;
(c) the measures taken or proposed to address the breach and mitigate its effects; and
(d) the contact point from whom further information may be obtained.
12.3 Cosine will take reasonable steps to contain, investigate, and remediate the breach, will preserve relevant evidence, and will keep the School reasonably informed.
12.4 The School is responsible for notifying the NDPC and affected Data Subjects where required under section 40 of the NDPA. Cosine will provide reasonable assistance to enable the School to do so within the statutory timeframe.
12.5 Neither party will make any public statement, regulatory notification, or communication to Data Subjects identifying the other party in connection with a Personal Data Breach without prior consultation, except where required by law or by a regulator.
12.6 A notification under this clause is not, and will not be construed as, an admission of fault or liability by either party.
13. Assistance and impact assessments
13.1 Taking into account the nature of the Processing and the information available to it, Cosine will provide reasonable assistance to the School in relation to:
(a) data protection impact assessments;
(b) prior consultation with the NDPC;
(c) the security of Processing; and
(d) breach notification under clause 12.
13.2 Assistance under this clause is provided at the School's cost where it requires more than a reasonable and proportionate effort. Cosine will notify the School of any charge before incurring it.
14. Records and audit
14.1 Cosine will maintain records of its Processing activities carried out on behalf of the School as required by Applicable Data Protection Law.
14.2 Cosine will make available to the School the information reasonably necessary to demonstrate compliance with this DPA. In the first instance this will be satisfied by:
(a) the information in this DPA and its Annexes;
(b) the Sub-processor List; and
(c) any current third-party audit report, certification, security assessment, or completed security questionnaire that Cosine makes available.
14.3 Where the information in clause 14.2 is not sufficient, the School may request an audit, subject to the following:
(a) audits may be carried out no more than once in any 12-month period, except where required by a regulator or following a Personal Data Breach affecting the School;
(b) the School must give at least 30 days' written notice;
(c) the audit must be conducted during business hours, must not unreasonably disrupt Cosine's operations, and must be limited in scope to matters relevant to the Processing of School Personal Data;
(d) the auditor must not be a competitor of Cosine and must be bound by confidentiality obligations at least as protective as those in clause 15 of the Terms;
(e) the audit must not extend to the premises, systems, or data of other customers, or to Cosine's source code, commercially sensitive information, or Personal Data of other Data Subjects; and
(f) the School bears its own costs and Cosine's reasonable costs of supporting the audit.
14.4 The School will share the results of any audit with Cosine and will treat them as Cosine's Confidential Information.
15. Deletion and return
15.1 On termination or expiry of the Terms, Cosine will, at the School's election, delete or return School Personal Data in accordance with clause 21.4 of the Terms.
15.2 The School may export School Personal Data using the export tools within the Services for 60 days after termination.
15.3 After that period, Cosine will delete or irreversibly anonymise School Personal Data within 90 days, except to the extent that Cosine is required to retain it:
(a) by law or regulation, including financial, transaction, tax, and anti-money laundering record-keeping obligations;
(b) to establish, exercise, or defend a legal claim; or
(c) in routine backups, which are deleted on the ordinary backup rotation cycle of no more than 90 days.
15.4 Personal Data retained under clause 15.3 remains subject to the confidentiality and security obligations of this DPA for as long as it is retained, and will not be actively Processed for any other purpose.
15.5 Cosine will confirm deletion in writing on the School's written request.
16. Liability
16.1 Each party's liability under or in connection with this DPA is subject to the exclusions and limitations in clause 18 of the Terms.
16.2 Nothing in this DPA limits the liability of either party to a Data Subject or to the NDPC, or limits either party's obligations under Applicable Data Protection Law.
16.3 Where one party pays compensation, a fine, or a penalty arising from a breach of Applicable Data Protection Law, it may recover from the other party the proportion corresponding to that other party's responsibility for the breach.
17. General
17.1 This DPA is governed by the laws of the Federal Republic of Nigeria, and clauses 22, 24, and 25 of the Terms apply to it.
17.2 Cosine may amend this DPA and its Annexes in accordance with clause 24 of the Terms, and where necessary to reflect a change in Applicable Data Protection Law or guidance issued by the NDPC.
17.3 If any provision of this DPA is held invalid or unenforceable, the remainder continues in force.
17.4 Data protection enquiries may be directed to security@trycosine.com.
Annexes
Subject matter.
The provision of school management, fee billing, payment collection, reconciliation, and related services under the Terms.
Duration.
For the term of the Terms, plus the retention periods in clause 15.
Nature and purpose of processing.
Collection, recording, organisation, structuring, storage, retrieval, use, transmission, disclosure to Sub-processors, restriction, erasure, and destruction, for the purposes of:
- maintaining student, guardian, and staff records;
- generating and distributing invoices;
- provisioning Collection Accounts and attributing incoming payments;
- issuing payment reminders and, on instruction, escalating unpaid invoices;
- reconciliation and reporting;
- providing support and maintaining the Services; and
- where enabled by the School, supplying underwriting inputs to Lending Partners and administering scholarship or fund features.
Categories of Data Subject.
- Students, including Children
- Parents, guardians, sponsors, and other Payers
- School staff, administrators, and authorised users
Categories of Personal Data.
| Data Subject | Categories |
|---|---|
| Students | Name, date of birth, sex, photograph, student identifier, class and enrolment records, attendance records, assessment results and report cards, guardian linkage, fee and payment history |
| Parents, guardians, and Payers | Name, email address, telephone number, postal address, relationship to student, invoice and payment history, payer name and bank details as they appear on incoming transactions, communications with Cosine and the School |
| Staff and authorised users | Name, work email address, telephone number, role and permissions, authentication data, access and activity logs |
Sensitive Personal Data.
None. The Services provide no field for the collection of Sensitive Personal Data, and the School must not upload it. See clause 4.2.
Frequency.
Continuous, for the duration of the Terms.
Sub-processors.
As listed in the Sub-processor List.