This addendum explains how Inventorygram processes personal data on behalf of customers and partners.
This comprehensive Data Processing Addendum defines the terms under which Inventorygram processes personal data on behalf of customers as a data processor under applicable data protection laws including GDPR, UK GDPR, and Swiss privacy legislation.
Personal Data: Any information relating to an identified or identifiable natural person, as defined under GDPR and applicable data protection legislation.
Processing: Any operation performed on personal data, such as collection, recording, organization, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.
Controller: The natural or legal person, public authority, agency, or other body that alone or jointly with others determines the purposes and means of processing.
Processor: The natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.
Subprocessor: A processor engaged by Inventorygram to perform specific processing activities on behalf of the customer.
Data Subject: Any individual to whom personal data relates.
Competent Authority: Any regulatory authority with jurisdiction over data protection matters in the relevant jurisdiction.
The Customer (you) is the data controller responsible for determining the purposes and means of processing personal data through Inventorygram. Inventorygram is a data processor acting on documented instructions from the Customer.
This Data Processing Addendum supplements the Master Service Agreement and other agreements between the parties. In the event of conflict, this DPA prevails on data protection matters.
The Customer is responsible for ensuring that processing complies with all applicable data protection laws and that all legal bases for processing are established before submitting personal data to Inventorygram.
The Customer shall:
Inventorygram shall:
Inventorygram may engage third-party subprocessors to perform specific functions necessary to deliver the service. The current list of authorized subprocessors is available at our Subprocessors page.
Notification of Changes: Inventorygram will notify the Customer of any addition or replacement of subprocessors at least 30 days in advance. If the Customer objects to the use of a new subprocessor, the Customer may terminate the affected services without penalty.
Subprocessor Obligations: All subprocessors are contractually bound to process personal data only on Inventorygram's instructions and must implement security measures equivalent to those in this DPA.
Liability: Inventorygram remains fully liable to the Customer for the performance of subprocessor obligations.
The Customer has the right to:
Inventorygram will cooperate with audit requests, subject to reasonable limitations to protect trade secrets and confidential information. Audits shall occur no more than once per calendar year unless required by law or in response to a data protection incident.
Inventorygram processes data in the Federal Republic of Nigeria and other jurisdictions as necessary to deliver services. If personal data originating from the European Economic Area, United Kingdom, or Switzerland is transferred to jurisdictions without an adequacy decision, Inventorygram uses appropriate safeguards, including:
The Customer acknowledges that transfers outside the EEA, UK, or Switzerland may involve different levels of data protection. By submitting personal data, the Customer authorizes such transfers under the approved safeguards.
For processing of EU residents' personal data, Inventorygram complies with GDPR and acts as a processor under Article 28 of the GDPR. The Customer is responsible for establishing a lawful basis for processing and providing data subject rights notices.
For processing of UK residents' personal data, Inventorygram complies with the UK Data Protection Act 2018 and UK GDPR. This DPA incorporates the International Data Transfer Agreement as required by UK law.
For processing of Swiss residents' personal data, Inventorygram complies with the Swiss Federal Act on Data Protection (FADP). Inventorygram acknowledges the rights of data subjects under Swiss law and will cooperate with Swiss authorities as required.
For processing in Nigeria, Inventorygram complies with the Nigeria Data Protection Regulation (NDPR). Processing is conducted in accordance with NDPR requirements and principles of data minimization, purpose limitation, and security.
Upon termination of services:
Each party's liability under this DPA is limited to direct damages caused by a proven breach. Liability is further limited to the fees paid by the Customer during the 12 months preceding the incident.
Neither party is liable for indirect, incidental, consequential, or punitive damages, including lost profits or data loss, except to the extent prohibited by applicable law.
These limitations do not apply to either party's liability for data protection violations, breaches of confidentiality, or breaches of security obligations.
If any provision of this DPA is found to be invalid, illegal, or unenforceable by a competent authority, the provision will be modified to the minimum extent necessary to make it enforceable while preserving intent, or if necessary, severed from this DPA.
All other provisions remain in full force and effect. If severing a provision materially alters the parties' intended relationship, the parties will negotiate in good faith to reach a replacement provision.
Inventorygram may update this Data Processing Addendum to reflect changes in legal requirements, security practices, or service offerings. Material changes will be communicated to the Customer with at least 30 days' notice.
The Customer may object to changes by providing written notice within 30 days. If the Customer objects to changes that significantly reduce data protection, the Customer may terminate affected services without penalty.
Continued use of Inventorygram after the notice period constitutes acceptance of updated terms.
Inventorygram implements a comprehensive information security program including:
Inventorygram acknowledges that transferring personal data from the EEA, UK, or Switzerland to Nigeria or other jurisdictions requires appropriate legal safeguards. Inventorygram executes Standard Contractual Clauses with all parties involved in cross-border processing.
The Customer acknowledges that jurisdictions outside the EEA, UK, and Switzerland may not provide equivalent data protection. By submitting personal data to Inventorygram, the Customer consents to transfers under this DPA's approved mechanisms.
For customers in the United Kingdom, Inventorygram complies with the International Data Transfer Agreement (IDTA) as required under the UK GDPR. This DPA incorporates the terms of the IDTA and establishes appropriate safeguards for transfers outside the UK.
Inventorygram will provide the Customer with copies of transfer documentation and cooperate with UK Information Commissioner's Office inquiries regarding transfer mechanisms.
For questions about this Data Processing Addendum, data processing practices, or to exercise data subject rights, please contact:
Last Updated: May 20, 2026
This Data Processing Addendum is effective as of the date of the Customer's first use of Inventorygram and remains in effect until termination of services.