Terms of Service

KLARI TECHNOLOGIES LIMITED

Effective date: 18 September 2026

Important notice

These Terms of Service (the "Terms") govern access to and use of the Klari platform and the related services supplied by Klari Technologies Limited ("Klari", "we", "our", "us"), a private company limited by shares incorporated under the laws of the Federal Republic of Nigeria with registration number RC 9542173 and its registered office in Lagos, Nigeria.

These Terms constitute a binding agreement between Klari and the organisation that accesses, registers for, subscribes to or uses the Service (the "Customer", "you", "your"). By doing any of those things, the Customer confirms that it has read and understood these Terms and agrees to be bound by them, together with the Privacy Notice, the Cookie Policy and the Data Processing Agreement, each of which is incorporated into these Terms by reference.

Where the Customer and Klari have executed an Order Form or a Master Services Agreement, that document governs to the extent of any conflict with these Terms.

If the Customer does not agree to these Terms, it must not access or use the Service.

Customers requiring a separately executed copy of these Terms may contact Klari at hello@klari.ng.

1. Definitions

In these Terms, the following expressions have the following meanings:

"Authorised User" means an individual whom the Customer permits to access the Service under the Customer's account.

"Customer Data" and "Tenant Data" mean data that the Customer or an Authorised User uploads to, or generates within, the Service, including organisation records, Records of Processing Activities, Data Protection Impact Assessments, evidence files, generated dossiers and the audit log.

"GAID" means the General Application and Implementation Directive 2025 issued by the Commission.

"NDPA" means the Nigeria Data Protection Act 2023.

"NDPC" or the "Commission" means the Nigeria Data Protection Commission.

"Order Form" means a document signed by both parties that records the subscription term, the fees and any agreed services.

"Personal Data" has the meaning given to it in the NDPA.

"Service" means the Klari software platform made available by Klari, together with any onboarding, implementation or support services described in an applicable Order Form.

"Subscription Term" means the period stated in the Order Form during which the Customer is licensed to use the Service.

2. The Service

Klari supplies compliance-documentation software for organisations subject to the NDPA and GAID, together with related implementation and support services.

The Service enables an organisation to maintain Records of Processing Activities, prepare Data Protection Impact Assessments, retain evidence, preserve an append-only audit log, and compile a Compliance Audit Return dossier and other exportable materials for its own review and use.

Klari may modify, improve, update, replace or discontinue a feature of the Service where reasonably necessary for operational, legal, regulatory, security or business reasons. Klari shall not make a change that materially reduces the core functionality of the Service during a Subscription Term without giving the Customer reasonable prior notice.

3. Eligibility and authority

The Customer must have the legal capacity to enter into a binding agreement.

Any person accepting these Terms on behalf of an organisation represents and warrants that they are authorised to bind that organisation, and the term "Customer" refers to that organisation.

The Customer shall ensure that every Authorised User accessing the Service under its account is authorised to do so and complies with these Terms. The Customer is responsible for the acts and omissions of its Authorised Users as if they were its own.

4. Accounts and credentials

Access to the Service requires an account.

The Customer shall provide accurate, complete and current registration information and shall keep it up to date.

The Customer is responsible for maintaining the confidentiality of account credentials and for all activity conducted through its account. The Customer shall notify Klari immediately at security@klari.ng of any unauthorised access to, compromise of, or suspected misuse of its account.

Klari is not liable for loss or damage arising from unauthorised use of the Customer's account where that use results from the Customer's failure to maintain adequate security over its own credentials.

5. Licence to use the Service

Subject to these Terms and to payment of the applicable fees, Klari grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable and revocable licence to access and use the Service during the Subscription Term, solely for the Customer's internal compliance operations.

This licence transfers no ownership of any software, technology or intellectual property. All rights not expressly granted are reserved.

6. Acceptable use

The Customer shall not, and shall not permit any Authorised User or third party to:

1. use the Service for an unlawful purpose or in breach of applicable law;

2. upload or transmit malicious code, including viruses, ransomware, spyware or any other harmful software;

3. attempt to gain unauthorised access to any system, network, account or data;

4. reverse engineer, decompile, disassemble or otherwise attempt to derive the source code of the Service, except to the extent that restriction is prohibited by applicable law;

5. circumvent or attempt to circumvent any security control, access restriction or usage limit;

6. interfere with or disrupt the integrity or performance of the Service;

7. use the Service in a manner that infringes the intellectual property or other rights of any person;

8. upload content that is unlawful, defamatory, fraudulent or deceptive; or

9. use the Service in breach of applicable data protection or privacy law, or in breach of clause 8 below.

Klari may suspend access under clause 19 where it reasonably suspects a breach of this clause.

7. What Klari is not

This clause exists because the Service is sold to Data Protection Officers, and the boundary matters to them personally. It mirrors clause 3A of Klari's Master Services Agreement.

What Klari provides. Klari provides compliance-support technology and implementation assistance: software for maintaining Records of Processing Activities, Data Protection Impact Assessments, an append-only audit log and evidence, together with onboarding, data mapping and preparation support as set out in the applicable Order Form.

What Klari does not assume. Klari does not assume the Customer's statutory responsibilities under applicable data protection law, and does not act as the Customer's Data Protection Officer, Data Protection Compliance Organisation, statutory auditor, regulator-facing filing agent or legal adviser, unless expressly agreed in writing and permitted by law. Specifically, Klari is not:

• a licensed Data Protection Compliance Organisation ("DPCO") under NDPA s.33, and does not hold itself out as one;
• the party that files the Customer's Compliance Audit Return or any other submission with the Commission. Klari prepares records and exportable materials; the Customer, or the Customer's own licensed DPCO, files where the applicable rules require it;
• the Customer's Data Protection Officer under NDPA s.32, and does not perform that function. The Customer appoints and retains its own Data Protection Officer;
• a law firm, and nothing Klari or its personnel supplies is a legal opinion given in the capacity of a legal practitioner.

Klari does not verify, certify, attest to or otherwise vouch for the Customer's compliance with the NDPA or any other law. Documents the Service generates are the Customer's records, compiled from data the Customer supplied, for the Customer to review, approve and rely on at its own discretion. Where the Service prints a classification, tier, licence number or figure supplied by the Customer, it prints it as supplied and does not independently verify it.

Responsibility for the Customer's compliance with the NDPA rests with the Customer.

No appointment by implication. Nothing in the Service, these Terms or any Order Form appoints Klari or any Klari personnel as the Customer's Data Protection Officer, Data Protection Compliance Organisation, auditor, statutory compliance officer or legal adviser.

The Customer remains responsible for: appointing and maintaining its own Data Protection Officer; determining its own legal obligations under the NDPA and any sector regulation; the accuracy and completeness of the information it submits; its own regulatory classification; all legal and compliance decisions; reviewing and approving its own Data Protection Impact Assessments and Records of Processing Activities; submitting its own regulatory returns; and appointing a licensed Data Protection Compliance Organisation where one is required.

8. Data the Customer must not submit to the Service

The Service is a compliance-documentation system. It is designed to hold records about processing activities, not the underlying operational data those activities concern. The distinction matters, and the Customer is responsible for observing it.

This is appropriate content: "The organisation processes customer payment transactions through its mobile banking application."

This is not: "Transaction 728281, account 0123456789, ₦1,500,000 paid by John Doe."

The Customer shall not submit to the Service, whether in a free-text field, an uploaded evidence file or otherwise:

1. payment transaction records, payment references, settlement or routing data;

2. payment card numbers, CVV/CVC values, PINs or one-time passcodes;

3. authentication credentials, tokens or secrets for any system;

4. full bank account details beyond what is strictly necessary to describe a processing activity; or

5. any sensitive or special category Personal Data that is not necessary for the compliance record being created.

Why this clause exists, stated plainly. Klari cannot rely on this prohibition alone. If the Customer uploads such data and the Service stores it, Klari is processing it, and the prohibition does not undo that. The clause exists so that both parties are clear the Service is not the right place for operational payment data, and so that the Customer's own sector-specific localisation, security and retention obligations are not inadvertently engaged by putting such data into the Service.

Minimisation. Where a compliance record needs to describe a payment process, the Customer shall describe it — "the organisation's payment processing system" — rather than placing the underlying transaction data into the Service.

Klari's remedy. Where Klari becomes aware that prohibited data has been submitted, Klari may, where technically practicable and proportionate, quarantine it, restrict access to it, redact it or delete it, and shall notify the Customer where reasonably practicable. Klari does not systematically monitor Customer content, gives no undertaking to detect every instance, and — because prohibited data may be embedded in arbitrary uploaded files — gives no undertaking that any particular item can be reliably redacted.

The Customer remains responsible for removing prohibited data from its own records and for any consequence arising from its submission to the Service.

9. Fees and billing

Fees are payable annually in advance in Nigerian Naira to Klari Technologies Limited, by bank transfer against an invoice, unless an Order Form states otherwise.

Unless otherwise stated in an Order Form:

1. fees are exclusive of value added tax, withholding tax and any other applicable tax or levy, which the Customer shall pay in addition or account for as the law requires;

2. fees are non-refundable once the Subscription Term has begun, except where these Terms expressly provide otherwise;

3. invoices are payable within thirty (30) days of the invoice date; and

4. Klari may charge interest on an undisputed overdue amount at the rate of one and a half per cent (1.5%) per month, accruing daily from the due date until payment.

Klari operates manual invoicing. Klari may introduce automated subscription billing on at least thirty (30) days' written notice to the Customer.

The Customer shall notify Klari of a disputed invoice within fifteen (15) days of receipt, and the parties shall resolve the dispute under clause 22. Klari shall not suspend the Service for non-payment of an amount that is the subject of a good-faith dispute notified in accordance with this clause.

10. Customer Data and data protection

As between the parties, the Customer retains all right, title and interest in and to its Customer Data.

The Customer grants Klari a non-exclusive, worldwide, royalty-free licence to host, process, transmit and display Customer Data solely as necessary to provide the Service and to comply with the Customer's documented instructions under the Data Processing Agreement.

The Customer represents and warrants that it has all rights, permissions and lawful bases necessary to submit Customer Data to the Service, and that its Customer Data and the processing of it through the Service do not breach applicable law or the rights of any person.

Klari acts as Data Processor for Customer Data and as Data Controller for the account, billing and security data described in the Privacy Notice. The Data Processing Agreement approved for the Customer's engagement forms part of these Terms unless a signed Master Services Agreement provides otherwise.

11. Intellectual property

Klari intellectual property. Klari and its licensors retain all right, title and interest in and to the Service, including the software, source code, databases, user interface, design, documentation, brand and any improvement, derivative or update to any of them. No rights are granted to the Customer except the limited licence expressly set out in clause 5.

The Customer shall not remove, alter or obscure any proprietary notice contained within the Service.

Feedback. If the Customer or an Authorised User provides Klari with a suggestion, idea, enhancement request or other feedback regarding the Service ("Feedback"), the Customer assigns to Klari all right, title and interest in that Feedback and agrees that Klari may use, incorporate and exploit it without restriction or obligation. Feedback confers no ownership, licence or other interest in the Service on the Customer.

No implied licences. Except as expressly stated in these Terms, neither party grants the other any licence, by implication, estoppel or otherwise, in or to its intellectual property.

12. Security

Klari implements technical and organisational measures appropriate to the risks presented by its processing. The measures agreed for a Customer's engagement are those set out in the Data Processing Agreement and its annexes.

Klari's current public security description, including its stated limitations, is available at https://klari.ng/security. That description is explanatory; it does not replace the measures agreed in the Data Processing Agreement or an Order Form, and where they differ the agreed measures govern.

No security measure can guarantee absolute security.

13. Confidentiality

Each party may receive information belonging to the other that is marked confidential or that a reasonable person would understand to be confidential ("Confidential Information").

Each party shall protect the other's Confidential Information with at least the degree of care it applies to its own, and no less than a reasonable degree of care, and shall use it only for purposes connected with the Service.

Confidential Information does not include information that is or becomes public through no breach of these Terms, was lawfully known to the receiving party without restriction before disclosure, or is independently developed without reference to it.

A party may disclose Confidential Information where required by law, court order or a regulator, and shall, where lawful and practicable, give the other party advance notice so that it may seek protective relief.

The obligations in this clause survive termination of these Terms.

14. Third-party services

The Service depends on third-party infrastructure and may integrate with third-party software, platforms or services. The sub-processors Klari engages are disclosed in accordance with the Data Processing Agreement.

Klari remains responsible for its sub-processors as set out in the Data Processing Agreement. Klari is not responsible for a third-party service that the Customer separately procures or connects to the Service, and use of such a service may be subject to that provider's own terms.

15. Service availability

Klari shall use commercially reasonable efforts to maintain the availability and performance of the Service.

Klari publishes no service level agreement and commits to no uptime percentage or service credit. The Customer acknowledges that no technology service can be guaranteed to be uninterrupted or error-free, and that scheduled maintenance, emergency maintenance, third-party service failures, network disruption and events beyond Klari's reasonable control may affect availability.

Where Klari and the Customer agree a service level in an Order Form, that Order Form governs.

16. Warranties and disclaimers

Klari warrants that the Service will perform materially as described in the applicable Order Form and the approved customer documentation during the Subscription Term.

Except as expressly stated in these Terms, the Service is provided "as is" and "as available", and Klari disclaims all other warranties to the maximum extent permitted by law, including the implied warranties of merchantability, fitness for a particular purpose and non-infringement.

For the avoidance of doubt, and consistently with clause 7, Klari does not warrant that use of the Service will achieve or maintain the Customer's compliance with the NDPA, GAID or any other law, or that it will eliminate regulatory or operational risk. The Customer remains responsible for its own legal, regulatory, governance and compliance decisions.

17. Indemnification

By the Customer. The Customer shall indemnify, defend and hold harmless Klari, its directors, officers, employees and contractors from and against any third-party claim, and any resulting liability, loss, damage, penalty, cost or reasonable expense, arising from:

1. the Customer's breach of clause 6 or clause 8;

2. the Customer's Customer Data, including a claim that it infringes a third-party right or was submitted without a lawful basis; or

3. the Customer's breach of applicable law in its use of the Service.

By Klari. Klari shall indemnify, defend and hold harmless the Customer from and against any third-party claim that the Service, as supplied by Klari and used in accordance with these Terms, infringes that third party's intellectual property rights, together with any resulting liability, loss, damage, cost or reasonable expense.

Klari's obligation under this clause does not apply to a claim arising from Customer Data, from the Customer's use of the Service in breach of these Terms, or from a modification of the Service that Klari did not make.

Procedure. The party seeking indemnity shall notify the other promptly in writing, give the indemnifying party sole control of the defence and settlement (provided that no settlement imposes a non-monetary obligation on the indemnified party without its consent, not to be unreasonably withheld), and provide reasonable cooperation at the indemnifying party's expense.

18. Limitation of liability

This clause mirrors clause 12 of the Master Services Agreement. Where a Customer is under a signed Master Services Agreement, that document governs.

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, goodwill, anticipated savings or business opportunity, however arising.

(a) General cap. Except as stated in (b) and (c), each party's aggregate liability arising out of or relating to these Terms is limited to the fees paid or owed by the Customer in the twelve (12) months preceding the event giving rise to the claim.

(b) Enhanced cap. For breach of confidentiality under clause 13, a personal data breach caused by Klari's breach of the Data Processing Agreement, Klari's breach of its data protection obligations, and either party's indemnification obligations under clause 17, the aggregate cap is three (3) times the annual fees payable, unless an Order Form states otherwise.

(c) No cap. Neither party's liability is limited for fraud, fraudulent misrepresentation, wilful misconduct, or any liability that cannot be limited or excluded under applicable Nigerian law.

The Customer's obligation to pay fees properly due is not subject to the caps in (a) or (b).

19. Term, suspension and termination

Term. Subscriptions run for the Subscription Term stated in the Order Form (typically twelve months) and renew for successive twelve-month terms unless either party gives written notice of non-renewal at least thirty (30) days before the renewal date.

Suspension. Klari may suspend access to the Service, in whole or in part, where:

1. an undisputed invoice remains unpaid more than thirty (30) days after written notice of non-payment;

2. the Customer's use presents a material security risk to the Service or to another customer; or

3. suspension is required by law or by a competent authority.

Klari shall give the Customer as much notice of a suspension as is reasonably practicable, shall limit the suspension to what is necessary, and shall restore access promptly once the cause is resolved.

Termination. Either party may terminate these Terms for a material breach that remains uncured thirty (30) days after written notice of it.

Effect of termination. On termination, Klari shall keep the Customer's account active in read and export mode for thirty (30) days, during which the Customer may export its Customer Data using the export functions the Service provides: Records of Processing Activities and Data Protection Impact Assessments as PDFs, the audit log as CSV, evidence files individually by signed download link, and any generated dossier as a PDF. On written request within that window Klari shall additionally supply a complete copy of the Customer's Customer Data as a machine-readable archive, at no charge, within thirty (30) days of the request.

After the export window closes, Customer Data is deleted in accordance with the Data Processing Agreement, subject to the retention periods disclosed in the Privacy Notice.

Outstanding fees properly due become payable on termination. Clauses 10, 11, 13, 17, 18, 22 and 23 survive termination.

20. Force majeure

Neither party is liable for a delay in or failure of performance caused by an event beyond its reasonable control, including natural disaster, war, civil unrest, terrorism, epidemic, industrial action, failure of telecommunications or power infrastructure, or an act of government.

The affected party shall notify the other as soon as reasonably practicable and shall use reasonable efforts to mitigate the effect. This clause does not excuse an obligation to pay a sum properly due.

If a force majeure event continues for more than sixty (60) consecutive days, either party may terminate these Terms on written notice.

21. Changes to these Terms

Klari may amend these Terms from time to time.

Where a change is material and adverse to the Customer, Klari shall give at least thirty (30) days' written notice before it takes effect, and the Customer may terminate the affected subscription without penalty by written notice before the effective date. In that event Klari shall refund a pro-rata portion of any fee paid for the unexpired part of the Subscription Term.

Continued use of the Service after a change takes effect constitutes acceptance of it. Every version of these Terms is published in the Trust Centre at https://klari.ng/trust/terms, each pinned to the SHA-256 of the text in force, so the Customer can verify what applied on any given date.

22. Governing law and dispute resolution

These Terms are governed by the laws of the Federal Republic of Nigeria.

The parties shall first attempt to resolve any dispute through good-faith negotiation between senior representatives, within thirty (30) days of written notice of the dispute.

Where negotiation fails, the parties shall attempt mediation under the Arbitration and Mediation Act 2023 before commencing proceedings.

A dispute not resolved through negotiation or mediation is subject to the exclusive jurisdiction of the courts of Lagos State, Nigeria. Nothing in this clause prevents either party from seeking urgent injunctive or other interim relief from a court of competent jurisdiction.

23. General

Entire agreement. These Terms, together with the documents incorporated by reference and any Order Form, constitute the entire agreement between the parties on their subject matter and supersede all prior understandings on it.

Assignment. Neither party may assign these Terms without the other's prior written consent, except that either party may assign to a successor in connection with a merger or a sale of substantially all of its assets, on written notice.

Severability. If any provision is held unenforceable, the remainder continues in full force and that provision is to be read down to the minimum extent necessary to make it enforceable.

No waiver. A failure or delay in exercising a right is not a waiver of it.

Notices. Notices to Klari must be sent to hello@klari.ng with a copy to the registered office of Klari Technologies Limited in Lagos, Nigeria. Notices to the Customer are sent to the administrative contact on its account.

No partnership. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship between the parties.

24. Contact

Klari Technologies Limited (RC 9542173)

Contract enquiries: hello@klari.ng Privacy enquiries: privacy@klari.ng Security reports: security@klari.ng