Legal and data use
Data Processing Terms
Last updated 8 November 2026
These terms apply when a business client sends Revia files or information that contain personal data. Section 29 of the Nigeria Data Protection Act requires a written agreement for this work. They form part of the agreement between you and Revia.
1. Parties and roles
The client is the data controller. Vorbtech Innovative Solutions, which runs Revia, is the data processor. The parties' names and addresses are those given in the order or agreement, which is the principal agreement for these terms.
Revia remains the data controller for its own client relationship, billing and website data, as the Privacy Policy explains.
2. Purpose and scope
| Item | Detail |
|---|---|
| Purpose | Producing, reviewing and delivering the creative work you order |
| Types of personal data | Contact details in instructions, and any people, names or personal items visible in your files |
| Data subjects | Your staff, property owners, occupants and anyone else appearing in your materials |
| Sensitive data | Not expected. You agree not to send it |
| Duration | The length of the order or plan, plus the retention periods in section 9 |
| Location | Nigeria and the countries where our providers operate, as section 7 explains |
3. Your responsibilities
You confirm that you have a lawful basis for sharing the personal data, have given people the information the Act requires, and have removed personal details the work does not need. You are responsible for your instructions being lawful.
4. What Revia will do
Revia will:
- process personal data only on your documented instructions, including these terms, unless the law requires otherwise;
- comply with the principles and obligations in the Act that apply to it;
- keep the data confidential and limit access to people bound by confidentiality;
- apply appropriate technical and organisational measures, as listed in section 6;
- help you respond to data subject requests;
- give you information reasonably needed to show compliance;
- tell you if an instruction appears to break the law.
5. Other processors
You authorise Revia to use the categories of provider listed in the Data Use Policy. Revia will tell you when a new processor is engaged, so you can object on reasonable grounds. Revia will bind each processor in writing to equivalent obligations and remains accountable for its work.
6. Security measures
Revia applies these measures: encrypted connections, access limited by role, separate accounts with strong authentication, deletion on schedule, and human review of AI output.
7. Transfers outside Nigeria
Revia will transfer personal data out of Nigeria only on a basis permitted by sections 41 to 43 of the Act, and will record that basis.
8. Personal data breaches
Revia will notify you on becoming aware of a breach affecting your data. The notice will describe its nature and, where possible, the categories and approximate numbers of people and records concerned. Revia will answer your information requests, so you can meet your duty to notify the Commission within 72 hours where that duty applies.
9. Deletion and return
At the end of the retention period in the Data Use Policy, or sooner if you ask, Revia will delete or return personal data. It may keep what the law requires. Copies in backups and at providers expire on their own schedules.
10. Risks and assessments
The main risks are unnecessary personal details in files and sending files to AI providers. We reduce these by asking you to remove such details, limiting what we send and reviewing results. If you need to complete a data privacy impact assessment, Revia will provide reasonable information about its processing.
11. Other terms
The Terms of Service apply to confidentiality, tenure, responsibility, events outside a party's control and disputes. Each party is responsible for its own breach of the Act, within the limits in the Terms of Service and as the law allows. If these terms conflict with the Terms of Service on data protection, these terms apply.