1. Parties and Agreement

These Terms and Conditions ("Agreement") constitute a legally binding contract between:

• GiftFlow Technologies Limited ("GiftFlow", "we", "us", or "our"), a company incorporated under the Companies and Allied Matters Act (CAMA) 2020 of the Federal Republic of Nigeria, operating the corporate gifting and employee milestone management platform available at www.giftflow.ng and related applications (the "Platform"); and

• The entity or organisation that registers for or uses the Platform ("Client", "you", or "your"), acting through its duly authorised representative.

This Agreement governs all access to and use of the Platform, including any features, tools, integrations, APIs, content, and support services provided by GiftFlow to the Client.

2. Definitions

In this Agreement, the following terms shall have the meanings ascribed to them below:

Platform

The GiftFlow web application, mobile application, APIs, and any related software, tools, or services offered by GiftFlow.

Client

The company, organisation, or business entity that subscribes to or uses the Platform.

Authorised User

Any individual employee, contractor, or agent of the Client who is permitted by the Client to access the Platform.

Employee Data

Personal data relating to the Client's employees or workforce, including but not limited to names, email addresses, phone numbers, physical addresses, dates of birth, work anniversaries, and any other data synced or uploaded to the Platform.

Data Controller

As defined under the NDPA 2023: the entity that determines the purposes and means of processing personal data. The Client is the Data Controller of all Employee Data.

Data Processor

As defined under the NDPA 2023: the entity that processes personal data on behalf of the Data Controller. GiftFlow acts as the Data Processor.

NDPA

The Nigeria Data Protection Act, 2023.

NDPR

The Nigeria Data Protection Regulation, 2019, issued by the National Information Technology Development Agency (NITDA), as amended.

NDPC

The Nigeria Data Protection Commission, the regulatory body established under the NDPA 2023.

Personal Data

Any information relating to an identified or identifiable natural person, as defined under the NDPA 2023 and NDPR 2019.

Subscription

The paid service plan selected by the Client granting access to specified features of the Platform.

Subscription Fee

The fee payable by the Client for access to the Platform as specified in the applicable Order Form or pricing page.

Service Level

The performance and availability standards applicable to the Platform as set out in Section 8 of this Agreement.

Intellectual Property

All patents, copyrights, trade marks, service marks, trade secrets, know-how, and other proprietary rights.

Force Majeure Event

Any event beyond a party's reasonable control, including acts of God, government actions, war, cyber-attacks, or network outages.

Order Form

A written or electronic document specifying the Subscription tier, fees, and other commercial terms agreed between the parties.

3. Platform Access and Permitted Use

3.1 Grant of Access

Subject to the Client's compliance with this Agreement and timely payment of all Subscription Fees, GiftFlow grants the Client a limited, non-exclusive, non-transferable, revocable licence to access and use the Platform solely for the Client's internal business operations during the Subscription term.

3.2 Authorised Users

The Client may permit its Authorised Users to access the Platform. The Client is fully responsible and liable for:

• Ensuring each Authorised User accepts this Agreement and any applicable policies before accessing the Platform.

• All actions and omissions of its Authorised Users on the Platform.

• Maintaining the confidentiality of all login credentials and immediately notifying GiftFlow of any unauthorised access.

• Ensuring that the total number of active Authorised Users does not exceed the number permitted under the applicable Subscription tier.

3.3 Acceptable Use

The Client and its Authorised Users shall not:

• Reverse engineer, decompile, disassemble, or attempt to derive the source code of the Platform.

• Sublicense, resell, or otherwise make the Platform available to any third party outside the Client's organisation without GiftFlow's prior written consent.

• Use the Platform to store, transmit, or process any unlawful, defamatory, obscene, or fraudulent data.

• Attempt to gain unauthorised access to the Platform, its systems, or the data of other clients.

• Introduce viruses, malicious code, or any harmful software into the Platform.

• Use the Platform in any manner that violates applicable Nigerian law or international law.

• Use any automated scraping, crawling, or data extraction tools against the Platform without prior written approval.

4. Subscription, Fees, and Payment

4.1 Subscription Tiers

GiftFlow offers multiple Subscription tiers as detailed on our pricing page or the applicable Order Form. Features available to the Client depend on the tier selected.

4.2 Subscription Fees

All Subscription Fees are payable in Nigerian Naira (NGN) unless otherwise agreed in writing. Fees are due in advance on a monthly or annual basis as specified in the Order Form.

4.3 Payment Methods

Payments shall be made via the approved payment methods indicated on the Platform, which may include bank transfer, direct debit, or supported payment gateways. Invoices shall be issued electronically to the Client's registered billing email.

4.4 Late Payment

Where Subscription Fees remain unpaid after fourteen (14) days from the due date, GiftFlow reserves the right to:

• Suspend the Client's access to the Platform until all outstanding amounts are settled.

• Charge interest on overdue amounts at the rate of one and a half percent (1.5%) per month, or the maximum rate permitted under Nigerian law, whichever is lower.

• Engage debt recovery measures after thirty (30) days of non-payment.

4.5 Taxes

All Subscription Fees are exclusive of applicable taxes, including Value Added Tax (VAT) at the prevailing rate under Nigerian law. The Client is responsible for any withholding tax obligations applicable under the Companies Income Tax Act (CITA) or any other applicable Nigerian tax legislation.

4.6 Fee Revisions

GiftFlow may revise Subscription Fees at any time upon providing the Client with at least thirty (30) days' written notice. Continued use of the Platform after the effective date of a fee revision constitutes acceptance of the revised fees.

5. Subscription Term and Termination

5.1 Initial Term

The Subscription shall commence on the date the Client completes registration or executes an Order Form and shall continue for the period specified therein (the "Initial Term").

5.2 Renewal

Unless either party provides written notice of non-renewal at least thirty (30) days before the end of the Initial Term or any renewal term, the Subscription shall automatically renew for successive periods equal to the Initial Term.

5.3 Termination for Convenience

Either party may terminate this Agreement at any time by providing thirty (30) days' written notice to the other party. Where the Client terminates mid-term, no refund of prepaid Subscription Fees shall be due unless otherwise specified in the Order Form.

5.4 Termination for Cause

Either party may terminate this Agreement immediately upon written notice if:

• The other party commits a material breach of this Agreement and fails to remedy such breach within fourteen (14) days of receiving written notice specifying the breach.

• The other party becomes insolvent, is wound up, or has a receiver or administrator appointed over its assets.

• The other party engages in fraudulent or unlawful conduct in connection with the Agreement.

5.5 Effect of Termination

Upon termination or expiry of this Agreement:

• All licences granted to the Client shall immediately cease.

• The Client shall immediately cease all use of the Platform.

• Each party shall promptly return or securely destroy the other's Confidential Information.

• GiftFlow shall handle Employee Data in accordance with Section 6.8 (Data Retention and Deletion) of this Agreement.

• Any outstanding Subscription Fees shall become immediately due and payable.

6. Data Privacy and NDPA / NDPR Compliance

6.1 Governing Framework

GiftFlow is committed to the responsible, lawful, and transparent processing of all personal data. The Platform processes personal data in accordance with:

• The Nigeria Data Protection Act (NDPA) 2023;

• The Nigeria Data Protection Regulation (NDPR) 2019;

• Any subsidiary regulations, guidelines, or directives issued by the Nigeria Data Protection Commission (NDPC);

• This Agreement, including this Section 6 which constitutes the Data Processing Addendum between the parties.

6.2 Controller and Processor Roles

The parties expressly agree and acknowledge the following roles for the purposes of data protection law:

• The Client is the Data Controller of all Employee Data processed through the Platform. The Client determines the purposes for which Employee Data is collected and the means by which it is processed.

• GiftFlow is the Data Processor acting on behalf of the Client. GiftFlow processes Employee Data solely on the instructions of the Client and for the purposes set out in this Agreement.

• GiftFlow shall not process Employee Data for any purpose other than fulfilling its obligations under this Agreement without the prior written consent of the Client.

6.3 Categories of Personal Data Processed

Depending on the integration method used (HRIS integration, API, or CSV upload), GiftFlow may process the following categories of Employee Data:

• Full names and preferred names

• Corporate and personal email addresses

• Phone numbers

• Physical/residential addresses (for gift delivery)

• Dates of birth and work anniversary dates

• Job titles and department information

• Gift preferences and dietary restrictions (where voluntarily provided)

• Delivery confirmation records and gifting history

6.4 Lawful Basis and Consent

As the Data Controller, the Client represents, warrants, and undertakes that:

• It has established and documented a valid lawful basis for processing Employee Data as required under Section 25 of the NDPA 2023 prior to sharing any Employee Data with GiftFlow.

• Where the lawful basis for processing is consent, the Client has obtained explicit, freely given, specific, informed, and unambiguous consent from each employee whose personal data is shared with GiftFlow.

• The Client has provided employees with appropriate privacy notices disclosing that their personal data will be shared with GiftFlow for corporate gifting purposes, in accordance with the NDPA 2023 and NDPR 2019.

• The Client shall promptly notify GiftFlow if any employee withdraws consent or objects to the processing of their personal data, so that GiftFlow can take appropriate action.

• GiftFlow shall bear no liability arising from the Client's failure to obtain the required consents or establish a lawful basis for processing prior to sharing Employee Data with GiftFlow.

6.5 GiftFlow's Processing Obligations

As Data Processor, GiftFlow shall:

• Process Employee Data only on the documented instructions of the Client and in accordance with this Agreement.

• Ensure that all personnel who access Employee Data are bound by appropriate confidentiality obligations.

• Implement and maintain appropriate technical and organisational measures to protect Employee Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

• Not engage any sub-processor to process Employee Data without the prior written consent of the Client, and where sub-processors are engaged, impose equivalent data protection obligations on them.

• Assist the Client in fulfilling its obligations to respond to requests from data subjects exercising their rights under the NDPA 2023 and NDPR 2019.

• Notify the Client without undue delay upon becoming aware of any actual or suspected data breach involving Employee Data.

• At the Client's request, make available all information necessary to demonstrate compliance with this Section 6 and permit audits by the Client or its authorised representative.

6.6 Data Security Measures

GiftFlow implements and maintains robust, industry-standard security measures including, but not limited to:

• AES-256 encryption of Personal Data at rest and TLS 1.2+ encryption in transit.

• Role-based access controls limiting Employee Data access to personnel with a legitimate business need.

• Multi-factor authentication (MFA) for administrative access to systems holding Employee Data.

• Regular security vulnerability assessments and penetration testing.

• Automated intrusion detection and monitoring systems.

• Business continuity and disaster recovery plans tested at least annually.

6.7 Data Breach Notification

In the event of an actual or reasonably suspected personal data breach affecting Employee Data:

• GiftFlow shall notify the Client within forty-eight (48) hours of becoming aware of the breach, providing all available information about the nature of the breach, the categories and approximate volume of data subjects and records affected, the likely consequences, and the measures taken or proposed.

• The Client, as Data Controller, shall be responsible for notifying the Nigeria Data Protection Commission (NDPC) within seventy-two (72) hours of becoming aware, as required under Section 40 of the NDPA 2023.

• GiftFlow shall cooperate fully with the Client and the NDPC in the investigation of any data breach and provide reasonable assistance in preparing any required notifications to affected employees.

6.8 Data Subject Rights

GiftFlow shall reasonably assist the Client in fulfilling its obligations to respond to Employee Data Subject Requests under the NDPA 2023, including:

• Right of Access: Providing the Client with copies of the Employee Data held on its systems upon request.

• Right to Rectification: Correcting inaccurate or incomplete Employee Data as directed by the Client.

• Right to Erasure (Right to be Forgotten): Securely deleting or anonymising an employee's Personal Data upon direction from the Client.

• Right to Restrict Processing: Suspending processing of an employee's Personal Data as directed by the Client.

• Right to Data Portability: Providing Employee Data in a structured, commonly used, and machine-readable format upon request.

• Right to Object: Ceasing to process an employee's Personal Data as directed by the Client where an employee exercises their right to object.

6.9 Data Retention and Deletion

GiftFlow shall retain Employee Data only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable Nigerian law. Specifically:

• Active Subscription: GiftFlow will retain Employee Data only for the duration of the Client's active Subscription term.

• Post-Termination: Within thirty (30) days of the termination or expiration of this Agreement, GiftFlow shall securely delete, destroy, or completely anonymise all Client Employee Data, at the Client’s election. GiftFlow will provide written confirmation upon completion.

• Legal Retention: Notwithstanding the above, GiftFlow may retain minimal data (such as transaction records) for up to seven (7) years where retention is strictly required under Nigerian tax law (Federal Inland Revenue Service Act), accounting standards, or other mandatory legal obligations. Such retained data shall be anonymised to the extent possible.

6.10 Cross-Border Data Transfers

GiftFlow shall not transfer Employee Data outside the Federal Republic of Nigeria except:

• With the prior written consent of the Client; or

• Where adequate data protection safeguards are in place as required by Section 43 of the NDPA 2023, including standard contractual clauses approved by the NDPC; or

• Where the transfer is strictly necessary for the performance of this Agreement and the Client has been notified.

7. Intellectual Property Rights

7.1 GiftFlow's Intellectual Property

GiftFlow retains all right, title, and interest in and to the Platform, including all associated Intellectual Property rights, software, algorithms, design elements, branding, and documentation. Nothing in this Agreement transfers any ownership of GiftFlow's Intellectual Property to the Client.

7.2 Client's Intellectual Property

The Client retains all right, title, and interest in and to any data, content, logos, and materials uploaded to or processed through the Platform by the Client. The Client grants GiftFlow a limited, non-exclusive licence to use such materials solely to provide the Platform services.

7.3 Feedback

If the Client provides GiftFlow with any feedback, suggestions, or recommendations regarding the Platform, GiftFlow may use such feedback freely without any obligation to the Client, and the Client assigns all rights in such feedback to GiftFlow.

8. Service Levels and Availability

8.1 Uptime Commitment

GiftFlow shall use commercially reasonable efforts to ensure that the Platform is available to Authorised Users with an uptime of at least 99.5% in any given calendar month, excluding scheduled maintenance windows.

8.2 Scheduled Maintenance

GiftFlow will provide the Client with at least forty-eight (48) hours' advance notice of any scheduled maintenance that may result in Platform downtime. GiftFlow shall endeavour to schedule maintenance during off-peak hours.

8.3 Support

GiftFlow provides technical support to Clients via:

• Email support: support@giftflow.ng (response within 24 hours on business days)

• Live chat support: available on the Platform during business hours (Monday to Friday, 8am – 6pm WAT)

• Priority support: available to Enterprise-tier subscribers as specified in the applicable Order Form

8.4 Service Credits

In the event that GiftFlow fails to meet the 99.5% uptime commitment in any calendar month, the Client may request a service credit equivalent to a pro-rata reduction of the monthly Subscription Fee for each hour of excess downtime. Service credits shall be the Client's sole remedy for any breach of this Section 8.

9. Confidentiality

9.1 Confidential Information

Each party agrees to hold the other’s Confidential Information in strict confidence and to use it solely for the purposes of performing its obligations under this Agreement. "Confidential Information" means any information designated as confidential or which ought reasonably to be treated as confidential, including pricing, business plans, technical specifications, Employee Data, and Intellectual Property.

9.2 Permitted Disclosures

A party may disclose Confidential Information:

• To its employees, directors, or professional advisers who have a legitimate need to know and are bound by equivalent confidentiality obligations.

• Where required by Nigerian law, court order, or regulatory authority, provided that the disclosing party gives the other party reasonable prior notice to the extent permitted by law.

9.3 Survival

Confidentiality obligations under this Section shall survive the termination or expiry of this Agreement for a period of five (5) years.

10. Limitation of Liability

10.1 Exclusion of Consequential Loss

To the maximum extent permitted under Nigerian law, GiftFlow shall not be liable to the Client for any:

• Loss of profits or revenue

• Loss of business or contracts

• Loss of anticipated savings

• Loss of goodwill or reputation

• Indirect, special, or consequential loss or damage

arising out of or in connection with this Agreement, even if GiftFlow has been advised of the possibility of such losses.

10.2 Cap on Liability

GiftFlow's total aggregate liability to the Client under or in connection with this Agreement (whether in contract, tort, negligence, breach of statutory duty, or otherwise) shall not exceed the total Subscription Fees paid by the Client in the twelve (12) months immediately preceding the event giving rise to the claim.

10.3 Exclusions

Nothing in this Agreement limits or excludes liability for:

• Death or personal injury caused by negligence.

• Fraud or fraudulent misrepresentation.

• Any liability that cannot be lawfully limited or excluded under applicable Nigerian law.

• A party's wilful misconduct or gross negligence.

11. Indemnification

11.1 Client's Indemnity

The Client shall indemnify, defend, and hold harmless GiftFlow, its directors, officers, employees, and agents from and against any claims, losses, damages, liabilities, costs, and expenses (including reasonable legal fees) arising from:

• The Client's breach of any representation, warranty, or obligation under this Agreement.

• The Client's failure to obtain the necessary consents or establish a lawful basis for processing Employee Data before sharing it with GiftFlow.

• Any infringement of a third party's rights by Client-uploaded content or data.

• Any misuse of the Platform by the Client or its Authorised Users.

11.2 GiftFlow's Indemnity

GiftFlow shall indemnify, defend, and hold harmless the Client from and against any claims that the Platform, as provided by GiftFlow, infringes a third party's Intellectual Property rights under Nigerian law.

12. Dispute Resolution

12.1 Amicable Resolution

The parties shall first attempt to resolve any dispute, controversy, or claim arising out of or in connection with this Agreement through good-faith negotiation. Either party may initiate this process by providing written notice to the other party detailing the nature of the dispute. The parties shall have thirty (30) days to resolve the dispute amicably.

12.2 Mediation

If the dispute is not resolved through negotiation within thirty (30) days, either party may refer the matter to mediation administered by the Lagos Court of Arbitration (LCA) or the Lagos Multi-Door Courthouse (LMDC) as agreed between the parties.

12.3 Arbitration

If mediation fails, the dispute shall be finally resolved by binding arbitration in accordance with the Arbitration and Mediation Act 2023 of Nigeria. The seat of arbitration shall be Lagos, Nigeria. The proceedings shall be conducted in English. The decision of the arbitrator(s) shall be final and binding on both parties.

12.4 Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria, including but not limited to the Companies and Allied Matters Act (CAMA) 2020, the Nigeria Data Protection Act 2023, and the Nigeria Data Protection Regulation 2019.

13. Representations and Warranties

13.1 Mutual Representations

Each party represents and warrants to the other that:

• It has full legal capacity and authority to enter into this Agreement.

• This Agreement constitutes a valid and binding obligation enforceable against it.

• Entering into this Agreement does not conflict with any other agreement, law, or obligation to which it is bound.

13.2 GiftFlow's Warranties

GiftFlow represents and warrants that:

• The Platform will perform materially in accordance with its documentation under normal use.

• GiftFlow will comply with all applicable Nigerian laws and regulations in the provision of the Platform.

• GiftFlow holds all necessary licences, registrations, and permits required to provide the Platform services in Nigeria.

13.3 Client's Warranties

The Client represents and warrants that:

• All information provided during registration and onboarding is accurate and up to date.

• The Client will use the Platform solely in compliance with this Agreement and applicable Nigerian law.

• The Client has obtained all necessary consents from its employees prior to sharing their Personal Data with GiftFlow.

14. Force Majeure

Neither party shall be in breach of this Agreement or liable for any failure or delay in performance of its obligations to the extent such failure or delay is caused by a Force Majeure Event. The affected party shall promptly notify the other party in writing and shall use reasonable efforts to mitigate the impact. If the Force Majeure Event continues for more than sixty (60) days, either party may terminate this Agreement on written notice without liability.

15. Amendments and Modifications

GiftFlow reserves the right to amend these Terms and Conditions at any time. Material changes will be notified to the Client via email or an in-Platform notification at least thirty (30) days before the effective date of such changes. The Client's continued use of the Platform after the effective date constitutes acceptance of the revised Terms. If the Client does not accept the changes, the Client may terminate the Agreement in accordance with Section 5.3.

16. General Provisions

16.1 Entire Agreement

This Agreement, together with any applicable Order Form and GiftFlow's Privacy Policy, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements, representations, and understandings.

16.2 Severability

If any provision of this Agreement is found to be invalid, illegal, or unenforceable by a competent Nigerian court or arbitral tribunal, the remaining provisions shall continue in full force and effect.

16.3 Waiver

No failure or delay by either party to exercise any right or remedy under this Agreement shall constitute a waiver of that right or remedy. No waiver of any breach shall be deemed a waiver of any subsequent breach.

16.4 Assignment

The Client may not assign or transfer any of its rights or obligations under this Agreement without GiftFlow's prior written consent. GiftFlow may assign this Agreement in connection with a merger, acquisition, or sale of all or substantially all of its assets, provided the assignee assumes all of GiftFlow's obligations hereunder.

16.5 Notices

All notices under this Agreement shall be in writing and delivered by email (with confirmation of receipt) or registered post to the addresses specified during registration or in the applicable Order Form.

16.6 Relationship of Parties

The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, employment relationship, or agency between the parties.

16.7 Anti-Corruption and Compliance

Each party shall comply with all applicable anti-bribery and anti-corruption laws, including the Corrupt Practices and Other Related Offences Act (ICPC Act) 2000 and the Economic and Financial Crimes Commission (EFCC) Act 2004. Neither party shall offer, pay, request, or receive any bribe, improper payment, or kickback in connection with this Agreement.

16.8 Consumer Protection

This Agreement is intended for business-to-business (B2B) use. The parties acknowledge that the Federal Competition and Consumer Protection Act (FCCPA) 2018 may impose certain minimum consumer protection standards. Nothing in this Agreement is intended to exclude any rights that cannot be excluded under Nigerian law.

17. Contact Information

For any questions, complaints, or requests regarding these Terms and Conditions or data protection matters, please contact:

• GiftFlow Technologies Limited

• Data Protection Officer (DPO): dpo@giftflow.ng

• Legal & Compliance: legal@giftflow.ng

• General Support: support@giftflow.ng

• Website: www.giftflow.ng

• Nigeria Data Protection Commission (NDPC): www.ndpc.gov.ng