1. Roles of the parties
For resident, household member, visitor, guard and other estate operational data processed through XTEREA, the estate is the data controller and XTEREA is the data processor. The estate decides the purposes and essential means of that processing. XTEREA processes it only on the estate's documented instructions, including through the settings and actions administrators take in the Service.
XTEREA remains an independent controller for its own website analytics (where consented), sales enquiries, estate subscription billing, security logs of the platform, and administrator accounts used to operate the Service, as described in the Privacy Policy.
2. Subject matter and duration
XTEREA processes personal data to provide gated-estate management features: visitor access, gate logs, resident and household records, levies and receipts, notices, complaints and maintenance, polls and elections, and related support.
Processing continues for as long as the estate has an active subscription and for the retention periods in the Privacy Policy after the subscription ends, unless the estate instructs earlier deletion where the law allows.
3. Nature and purpose of processing
| Category | Examples | Purpose |
|---|---|---|
| Residents and administrators | Name, contact details, house address, role, permissions, resident code | Account access, gate security, levies, communication |
| Household members | Name, relationship, optional phone or email | Household access and communication |
| Visitors | Name, party size, host address, notes, code, entry and exit times | Gate check-in and estate security records |
| Guards | Name, contact details, check-in actions | Operate the gate |
| Estate activity | Complaints, maintenance (including images), notices, votes (as totals), levy receipts | Day-to-day estate management |
4. Estate instructions
XTEREA will:
- process personal data only as needed to provide the Service and as the estate configures it;
- not sell estate personal data or use it for third-party advertising;
- tell the estate if an instruction appears to breach the Nigeria Data Protection Act 2023, unless the law forbids that notice;
- treat the estate's use of the Service (adding people, inviting visitors, verifying receipts, running elections) as documented instructions.
The estate warrants that it has a lawful basis to collect and instruct processing of the personal data it puts into XTEREA, and that it has given people the information the law requires, including visitors where practical (for example by sharing the notice at xtereasecurity.com/visitor-privacy).
5. Security
XTEREA will implement appropriate technical and organisational measures to protect personal data, including the measures listed in the Privacy Policy (encryption in transit, hashed passwords, role-based access, session controls and device enrolment for gate kiosks). The estate is responsible for choosing strong administrator passwords, managing who has access, and securing any gate hardware on site.
6. Sub-processors
The estate authorises XTEREA to use the sub-processors needed to run the Service. The current list includes Amazon Web Services (hosting, storage, email), Paystack (subscription payments), Africa's Talking and Termii (SMS), Resend, Amazon SES and Mailgun (email), and Google (sign-in, and website analytics only where a visitor to our marketing site has consented).
XTEREA will impose data-protection terms on sub-processors that are no less protective than this DPA. If we add or replace a material sub-processor that processes estate personal data, we will update the Privacy Policy and give estate administrators at least 14 days' notice where practical. The estate may object on reasonable data-protection grounds; if we cannot accommodate the objection, the estate may stop using the affected feature or cancel under the Terms of Service.
7. International transfers
Where personal data is transferred outside Nigeria, XTEREA will ensure a lawful transfer mechanism under the Nigeria Data Protection Act 2023, such as adequacy, Standard Contractual Clauses or equivalent contractual safeguards with the sub-processor, as summarised in the Privacy Policy. Further detail is available to estate administrators on request to the Data Protection Officer.
8. Assistance with requests and compliance
Taking into account the nature of the processing, XTEREA will help the estate:
- respond to data subject requests (access, correction, deletion, objection and related rights);
- meet security, impact-assessment and consultation duties where they reasonably relate to the Service;
- investigate and notify personal data breaches. XTEREA will inform the estate without undue delay after becoming aware of a breach affecting the estate's personal data, and will notify the NDPC within 72 hours where XTEREA itself is required to do so as controller or as otherwise required by law.
9. Return and deletion
Administrators can export estate records while the subscription is active. When the estate leaves XTEREA, we keep data available for export for 30 days, then delete or anonymise it within 90 days, except records we must keep by law (for example certain payment records). Certified confirmation of deletion is available on written request after that period.
10. Information and audits
On reasonable written notice, and no more than once per year unless a competent authority or a confirmed breach requires it, XTEREA will provide the estate with information reasonably necessary to demonstrate compliance with this DPA. Audits are limited to documents and questionnaires in the first instance. Any on-site or deeper technical review must be agreed in advance, protect other customers' confidentiality, and be at the estate's expense unless a material breach by XTEREA is found.
11. Liability
Liability under this DPA is subject to the limitations in the Terms of Service, except where the Nigeria Data Protection Act 2023 does not allow liability to be limited.