Skip to main content

Legal

Data Processing Addendum (DPA)

THIS DATA PROCESSING ADDENDUM ("DPA") forms part of and is incorporated into the applicable Client Services Agreement, Master Services Agreement, and/or Order Form between Reja Technologies Limited or the relevant Reja Affiliate ("Processor") and the Client entity identified in the applicable Order Form ("Controller"). This DPA applies where Processor processes Personal Data on behalf of Controller in connection with the Services.

1. Scope and Order of Precedence

This DPA governs Processing of Personal Data by Processor for the purposes of providing the Services. In case of conflict between this DPA and the main services agreement, this DPA prevails with respect to Personal Data Processing obligations.

2. Definitions

  • Controller, Processor, Processing, Data Subject, Personal Data, and Special Category Data have the meanings under applicable data protection laws.
  • Applicable Data Protection Laws include relevant laws in jurisdictions where Controller operates or Data Subjects are located, including as applicable: Kenya Data Protection Act, 2019; South Africa POPIA; Nigeria NDPA; Rwanda data protection law; Uganda Data Protection and Privacy Act; Ghana Data Protection Act; Egypt Personal Data Protection Law; GDPR where applicable; and successor legislation.

3. Roles of the Parties

  • Controller determines the purposes and means of Processing of Personal Data submitted through the Services.
  • Processor Processes Personal Data solely on behalf of Controller and in accordance with documented instructions, this DPA, and applicable law.

4. Processing Instructions

Processor shall:

  • Process Personal Data only on documented instructions from Controller, including transfers to third countries unless required by applicable law;
  • Promptly notify Controller if, in Processor's opinion, an instruction violates Applicable Data Protection Laws;
  • Ensure authorized personnel are subject to confidentiality obligations.

5. Subject Matter, Duration, Nature, and Purpose

The subject matter, duration, nature, and purpose of Processing are as described in the applicable Order Form and Services documentation. Unless otherwise agreed, Processing continues for the term of the services agreement and any transition/export period.

6. Categories of Data Subjects and Personal Data

Data Subjects may include Controller employees, field representatives, customers, prospects, suppliers, and other contacts uploaded by Controller. Personal Data categories may include identity/contact data, account and role data, operational records, location telemetry, evidence media, transaction/order data, and audit/security logs, as configured by Controller.

7. Security Measures

Processor shall implement and maintain appropriate technical and organizational measures considering the state of the art, implementation costs, nature/scope/context of Processing, and risk to individuals. Measures include, as appropriate:

  • Encryption in transit and at rest;
  • Access controls and least-privilege policies;
  • Authentication and session protections;
  • Logging, monitoring, and incident response controls;
  • Backups and availability safeguards;
  • Periodic vulnerability and security testing.

8. Sub-Processors

  • Controller authorizes Processor to engage sub-processors for hosting, infrastructure, support, and service delivery.
  • Processor shall impose data protection obligations on sub-processors no less protective than those in this DPA.
  • Processor remains responsible for sub-processor performance of data protection obligations.
  • Processor shall maintain an up-to-date sub-processor list and provide reasonable notice of material changes where required.

9. Cross-Border Data Transfers

Where Personal Data is transferred across borders, Processor shall apply legally recognized safeguards as required by Applicable Data Protection Laws, including standard contractual clauses, adequacy mechanisms, binding corporate rules, or equivalent lawful mechanisms.

10. Data Subject Rights Assistance

Taking into account the nature of Processing, Processor shall provide reasonable assistance to Controller to respond to Data Subject requests (access, rectification, erasure, restriction, portability, objection, and similar rights), to the extent Controller cannot fulfill these requests through the Services directly.

11. Security Incident and Breach Notification

Processor shall notify Controller without undue delay after becoming aware of a Personal Data breach affecting Controller Personal Data and, where reasonably practicable, within forty-eight (48) hours, or sooner where the main agreement or applicable law requires. Notification shall include available facts, likely impact, and remediation measures and may be provided in phases. Processor shall cooperate with Controller on containment, investigation, and regulatory or data-subject notifications; Controller remains responsible for determining whether and when its notifications are required.

12. Data Protection Impact Assessments and Regulatory Cooperation

Processor shall provide reasonable assistance to Controller for data protection impact assessments, prior consultations, and regulator inquiries related to Processing under this DPA, taking into account the nature of Processing and information available to Processor.

13. Audit and Compliance Evidence

Processor shall make available information reasonably necessary to demonstrate compliance with this DPA and allow audits or inspections by Controller (or an independent auditor mandated by Controller), subject to reasonable notice, scope limitations, confidentiality protections, and security requirements. Existing third-party audit reports and certifications may be used to satisfy audit obligations where appropriate.

14. Deletion and Return of Data

Upon termination or expiry of services, Processor shall, at Controller's choice and subject to technical/legal constraints, delete or return Personal Data and delete existing copies unless retention is required by law. Retained data remains protected under this DPA until deletion.

15. Confidentiality and Liability

Confidentiality obligations and liability allocation are governed by the main services agreement unless mandatory law requires otherwise. For confidentiality duration, obligations survive for five (5) years after termination/expiry, and trade secrets remain protected as long as they qualify as trade secrets.

16. Governing Law and Jurisdiction

This DPA is governed by the governing law set in the main services agreement or Order Form. Mandatory local privacy law provisions apply where required and cannot be contractually excluded.

17. Annexes (to be completed per engagement)

  1. Annex I: Parties and Contact Details
  2. Annex II: Description of Processing (subject matter, duration, purpose, categories)
  3. Annex III: Technical and Organizational Measures (TOMs)
  4. Annex IV: Approved Sub-Processors
  5. Annex V: International Transfer Mechanisms (where applicable)

Execution of the main services agreement and/or Order Form that references this DPA constitutes acceptance of this DPA unless a separately negotiated DPA is executed by the Parties.