Data Processing Agreement
Last updated
This Data Processing Agreement (“DPA”) is part of the Terms of Service between the customer (“you”, the controller) and Numbers Ventures Limited, a company registered in Nigeria (“Du3”, the processor). It applies when Du3 processes personal data on your behalf.
1. What we process
| Subject matter | Providing Du3: invoicing, submission links, branded sites, Slack and Discord alerts and the Du3y bot |
| Duration | While you have a Du3 account, plus the deletion periods below |
| Types of personal data | Names, emails, phone numbers, addresses, company details, tax IDs, bank details, invoice contents, uploaded files, Slack user IDs and names, Discord user IDs, activity history |
| People concerned | Your team members, clients, contractors and vendors |
| Special category data | None expected. Please don’t put it in Du3 |
2. Our commitments
We will:
- process personal data only on your documented instructions — these terms, your settings and your use of Du3 — unless the law requires otherwise (we’ll tell you if so, where allowed);
- make sure our staff and contractors who can access the data are bound by confidentiality;
- keep the data secure with the measures in section 4;
- use sub-processors only as described in section 5;
- help you respond to requests from people exercising their data rights;
- help you with security, breach notification, data protection impact assessments and consultations with regulators, as far as is reasonable;
- delete or return the data when you leave, as described in section 7;
- give you the information you need to show compliance, and allow reasonable audits (section 8).
3. Your commitments
You confirm you have a lawful basis to collect the personal data you put in Du3 — including contractors’ bank details and tax IDs — and that you’ve told the people concerned.
4. Security measures
- Encryption in transit (TLS) and at rest.
- Extra field-level encryption for bank details, tax IDs and Slack tokens.
- Strict separation between customers: every request is checked against your company, and Du3y only acts for the Slack workspace or Discord server a request came from.
- Access for Du3 staff limited to what they need, with every change they make logged.
- Uploaded files scanned for malware before they can be opened.
- Rate limits and link expiry on public forms.
- Backups, monitoring and an incident response process.
See Security for more.
5. Sub-processors
You authorise Du3 to use the sub-processors below. We’ll give at least 30 days’ notice of a new sub-processor by email to the owner and on this page. You can object on reasonable data protection grounds; if we can’t resolve it, you may cancel the affected service.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Database, file storage and backups | Ireland (database), United States (files) |
| Slack Technologies | Du3y app, alerts and commands in your workspace | USA / global |
| Discord, Inc. | Du3y app, alerts and commands in your Discord server | USA / global |
| Cloudflare, Inc. | Carries traffic to our websites and apps, and the private connection to our database | USA / global |
| Paystack | Subscription payments (Nigeria) | Nigeria |
| RevenueCat, Inc. | Checks plans bought in the Du3 app through the App Store or Google Play | United States |
| OpenRouter, Inc. | Passes Du3y’s plain-English requests to the AI model that answers them (no bank details or tax IDs sent; data sharing turned off, so requests aren’t kept or used for training) | United States |
| Resend, Inc. | Transactional email | United States |
| PostHog, Inc. | Product analytics: which features are used, keyed by user and company IDs (no names, emails, invoice contents, client or contractor details; amounts only as ranges) | United States |
We impose data protection terms on each sub-processor at least as protective as this DPA, and we remain responsible for them.
6. Personal data breaches
If we become aware of a breach affecting your personal data, we’ll tell you without undue delay, and within 48 hours where possible, with what we know and what we’re doing about it.
7. Deletion and return
You can export your data at any time. When your plan ends, your data stays available to view and export. When you delete your company, we keep it for 90 days, then delete it for good, including its invoices, contacts and files, unless the law requires us to keep it. Deleted invoices can be restored for 30 days, then they are deleted for good.
8. Audits
We’ll answer reasonable security questionnaires and share summaries of our security measures. If that isn’t enough to meet a legal requirement, you may audit us once a year with 30 days’ notice, at your cost, under confidentiality.
9. International transfers
Du3 is run from Nigeria. Personal data is stored with Amazon Web Services in Ireland (database) and the United States (files), and some sub-processors above are based in the United States. Where personal data leaves the country it was collected in, we only use sub-processors that protect it to the standard the law asks for, for example through the standard contractual clauses in their data protection terms.
10. Order of precedence
If this DPA and the Terms of Service conflict about personal data, this DPA wins.