Merchant Data Compliance Agreement

Last updated: 14 October 2026

This agreement is between Ordina Ltd (“Ordina”, “we”) and every business that uses Ordina (“you”, the “merchant”). It covers the personal information of the people your business serves: the customers and prospective customers who chat with your Secretary, book, order, pay, fill in your forms, leave reviews or receive messages from you through Ordina (“Customer Data”).

It forms part of our Terms of Service and works alongside our Privacy Policy. You accept it when you create an account or continue to use Ordina. Where it conflicts with the Terms about Customer Data, this agreement applies.

If you used Ordina before 14 October 2026, this agreement applies to you from 13 November 2026.

1. Who is responsible for what

You control Customer Data. You decide which customers you serve, what you ask them, what you send them and how long you keep their information. In data protection terms you are the controller of Customer Data, and you are responsible for how your business collects, uses, shares and keeps it through Ordina.

Ordina processes it for you. We store and process Customer Data to provide the Service, on the instructions you give through how you set up and use Ordina, and for the limited purposes of our own that our Privacy Policy lists (keeping the Service secure and preventing abuse, honouring messaging opt-outs, collecting online payments as your agent, and meeting our legal, tax and accounting obligations).

2. The law and the authority you are bound by

You must comply with the data protection and privacy laws that apply to your business, and you are subject to the data protection authority of your own region. That usually means the law of the country where your business operates, and can also include the law where your customers live. For example:

  • Nigeria: the Nigeria Data Protection Act 2023, overseen by the Nigeria Data Protection Commission.
  • Ghana: the Data Protection Act, 2012 (Act 843), overseen by the Data Protection Commission.
  • Kenya: the Data Protection Act, 2019, overseen by the Office of the Data Protection Commissioner.
  • Uganda: the Data Protection and Privacy Act, 2019, overseen by the Personal Data Protection Office.
  • Tanzania: the Personal Data Protection Act, 2022, overseen by the Personal Data Protection Commission.
  • South Africa: the Protection of Personal Information Act, overseen by the Information Regulator.
  • United Kingdom: the UK GDPR and the Data Protection Act 2018, overseen by the Information Commissioner’s Office.
  • European Union and EEA: the GDPR, overseen by the supervisory authority of your country.
  • United States: the state privacy laws that apply to you, such as California’s, and federal rules on unfair or deceptive practices.
  • Canada: PIPEDA and any provincial law that applies, overseen by the Office of the Privacy Commissioner of Canada.

These are examples, not a complete list, and laws change. Ordina does not give legal advice: if you are unsure what applies to your business, ask a qualified adviser. Registering with an authority, paying any fee it charges and answering its requests about your business are your responsibility.

3. What you are responsible for

A lawful reason, and consent where it is needed

You need a lawful basis for every piece of Customer Data you collect and for every message you send through Ordina. Messages about a booking or order a customer made are usually expected; promotional messages, broadcasts and follow-ups often need the customer’s consent first. Our Messaging Policy sets out how opt-in and STOP work. Ordina stops messages to anyone who opts out; you must not contact them again through Ordina in another way to get around that.

Telling your customers

Where the law requires it, tell your customers who you are, what you collect, why, and who helps you process it, including that an AI Secretary provided by Ordina answers messages and takes bookings for you. Ordina labels the Secretary as an AI, but your own privacy notice to your customers is your responsibility.

Collecting only what you need

Ask only for information you need to serve the customer, including in the custom questions you add to services, products and forms. Do not use Ordina to collect card numbers, bank passwords or sign-in codes. Do not collect especially sensitive information (such as health, religious, biometric or government ID details) unless the law allows it, you need it, and you have any consent the law requires.

Your team and your account

You decide who on your team can see Customer Data, and you are responsible for what they do with it. Keep your sign-in secure, remove team members who leave, and use two-step sign-in where you can. Tell us straight away at help@useordina.com if you think someone has accessed your account without permission.

Requests from your customers

Customers can ask you to see, correct or delete their information, or to stop using it. You must answer those requests as your law requires. Ordina gives you tools for this, such as deleting a conversation, blocking a contact and downloading your data, and we will help when a request needs more than the tools do.

Data you take out of Ordina

When you export Customer Data, download it, or send it to another system (Google Sheets, a webhook, our API, an AI assistant you connect, Shopify, WooCommerce or any other integration), you are responsible for it from then on, including for the security and the lawful use of the systems you chose.

How long you keep it

You decide how long to keep Customer Data and should not keep it longer than you need. You can delete conversations, contacts and your whole account from your dashboard. What Ordina keeps after a deletion, and for how long, is set out in our Privacy Policy.

Children

Do not knowingly collect information about children through Ordina unless you have the consent of a parent or guardian, or another basis that your law requires.

4. What Ordina does as your processor

  • We process Customer Data only to provide the Service and for the purposes of our own listed in section 1.
  • We do not sell Customer Data, use it for our own advertising, or use it to train AI models.
  • People at Ordina who can access Customer Data are bound to keep it confidential, and access it only when they need to.
  • We protect it with the security measures our Privacy Policy describes, including encryption of the most sensitive details.
  • We use the service providers listed in our Privacy Policy, and we keep that list up to date. Each one receives only what it needs for its part of the Service.
  • Where we transfer Customer Data between countries, we do so as our Privacy Policy describes.
  • If we become aware of a security breach affecting your Customer Data, we will tell you without undue delay, with what we know, so you can meet any duty to notify your authority or your customers.
  • We will help you, within reason, to answer your customers’ requests and your authority’s questions about how Ordina processes Customer Data.
  • When you delete your account, we delete Customer Data as our Privacy Policy sets out, except records the law requires us to keep.

5. If something goes wrong

You are responsible for complaints, claims, fines and penalties that arise from how your business collects or uses Customer Data, and you will cover Ordina’s reasonable losses if a breach of this agreement by you leads to a claim against us, as the indemnity in our Terms describes. We may suspend features or your account if your use of Customer Data breaks the law or this agreement. The limits of liability in our Terms apply to this agreement.

6. Changes

If we change this agreement in a material way, we will tell business users by email or in the dashboard before the change applies, and update the date above.

7. Contact us

Questions about this agreement or a data protection request? Contact us at help@useordina.com. Ordina Ltd is based in Lagos, Nigeria.