Roles
The shop is the data controller for its customers' personal data (names, phone numbers, addresses, orders, debts and WhatsApp messages). Pandesk is the data processor. We process this data only to provide the service and only on your instructions, which are the settings and actions you take in the app.
What we process
Customer names and phone numbers, delivery addresses, order and payment history, debts, and WhatsApp conversations with your customers. We process it for as long as your account is open.
Your duties as controller
You decide why you collect customer data and you need a lawful basis for it, such as the customer's order or consent. Tell your customers you keep their details and message them on WhatsApp. Only message people who expect to hear from you.
Our duties as processor
We keep the data confidential and make sure our staff who can reach it are bound to confidentiality. We keep each shop's data separate from other shops. We use sub-processors (Cloudflare for hosting, Paystack for payments, Meta for WhatsApp) under terms that protect the data, and we will update this page if they change.
We do not use your customers' data for our own purposes or for advertising.
Retention and deletion
WhatsApp messages are deleted after 12 months. You can ask for a customer's data to be deleted by messaging our support WhatsApp line, and we will do it within 7 days unless the law requires us to keep it. When you close your account we delete your shop's data within 30 days and return an export first if you ask.
Customer requests
If a customer asks you for their data, a correction or deletion, you can handle most of it in the app. If you need our help, message support and we will help you meet the deadline.
Breaches
If we learn that personal data we process has been lost or accessed without permission, we tell you without undue delay. Where the breach is likely to harm people, we notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of it, and we tell you what we told them so you can inform your customers where the NDPA requires it.
Audits and transfers
On reasonable request we will give you the information you need to show you are using a compliant processor. Some of our providers store data outside Nigeria; we only use providers that protect it to the standard the NDPA requires.
PanDesk · Data Processing Agreement · Last updated 14 October 2026