Data Processing Agreement

Version 2.0 — Effective September 26, 2026

1. Parties and entity status

This Data Processing Agreement ("DPA") describes the terms under which Skofa processes personal data on behalf of a business customer ("Customer") that uses the Skofa platform. Skofa is operated by Skofa Agent Systems, a registered business in the Republic of Ghana. This DPA has been reviewed by legal counsel and approved for use.

2. Roles

For personal data the Customer submits to or processes through the Skofa platform (its own customers' or employees' data, connected via integrations, uploaded documents, or entered directly), the Customer is the data controller and Skofa is the data processor, processing that data solely on the Customer's documented instructions as expressed through the Customer's own configuration of the platform (which integrations are connected, which agents are configured, what autonomy and approval settings apply).

3. Subject matter and duration

Processing continues for as long as the Customer maintains an active Skofa account and the relevant data remains connected or stored, and ends upon deletion as described in the Privacy Policy's retention and deletion terms.

4. Nature and purpose of processing

Skofa processes personal data to provide the platform's core functions: authenticating users, storing and retrieving business records connected to the platform, executing AI agent workflows configured by the Customer, and the billing, security, and reliability functions described in the Privacy Policy.

5. Categories of data and data subjects

Depending on how the Customer configures and uses the platform, this may include: the Customer's own staff/user accounts; the Customer's customers' contact and transaction records, where the Customer connects a CRM, e-commerce, support, or communications integration; and content of messages the Customer's own customers send through a connected channel (e.g. WhatsApp), where the Customer enables that feature.

6. Subprocessors

Skofa's own subprocessors are listed, by name and purpose, on the Subprocessors page, kept current as that list changes. Skofa will provide notice of a material change to this list through that page and, where legal counsel later determines it is required, through direct notice to Customers.

7. Security measures

Skofa encrypts stored third-party integration credentials at rest, enforces role-based access control and tenant isolation between businesses, and maintains audit logs of sensitive actions, as described in the Privacy Policy's Security section. No method of transmission or storage is 100% secure.

8. Data subject rights assistance

Skofa will provide reasonable assistance to the Customer in responding to a verified data subject request (access, correction, deletion, export) concerning data the Customer controls, consistent with the export/deletion mechanisms already available in account settings.

9. International transfers

Skofa's infrastructure and the subprocessors listed on the Subprocessors page may store or process data outside the Customer's own jurisdiction. Where this occurs, Skofa relies on the safeguards those subprocessors themselves contractually and technically provide for cross-border processing, consistent with the Privacy Policy's own International data considerations section.

10. Data Protection Officer

Skofa has not yet appointed a formal Data Protection Officer. Until one is appointed, inquiries under this DPA should be directed to admin@skofa.systems.

11. Changes to this agreement

Skofa may update this DPA as the service or its subprocessors change. Material changes will be reflected here with an updated version and effective date.

12. Contact

Questions about this DPA can be sent to admin@skofa.systems.