Client Dashboard Terms of Use

THESE TERMS OF USE ("Terms") CONSTITUTE A LEGALLY BINDING AGREEMENT between the organization that has contracted with Reja Technologies Limited for access to the Reja platform ("Client," "Customer," or "you") and Reja Technologies Limited and its subsidiaries and affiliates (collectively, "Reja," "Provider," "we," "us," or "our"). These Terms govern all access to and use of the Reja Client Dashboard, including all web-based interfaces, portals, administrative consoles, reporting tools, and connected functionality (collectively, the "Dashboard"). By logging in or otherwise accessing the Dashboard, each Authorized User acknowledges and agrees to be bound by these Terms.

1. Contract Hierarchy and Precedence

These Dashboard Terms of Use supplement and are subject to any Master Services Agreement ("MSA"), Order Form, Statement of Work ("SOW"), Data Processing Agreement ("DPA"), or Service Level Agreement ("SLA") executed between Reja and the Client (collectively, "Governing Agreements"). In the event of a conflict between these Terms and any Governing Agreement, the Governing Agreement shall prevail to the extent of the inconsistency. Where no Governing Agreement exists, these Terms constitute the entire agreement governing Dashboard access, and such access is provided on an "as is" basis without warranty or guaranteed service levels.

2. Definitions

For the purposes of these Terms, the following definitions apply:

• "Authorized User" means any individual granted Dashboard access credentials by a Client Administrator within the scope of the Client's subscription.
• "Client Administrator" means the individual(s) designated by Client with administrative privileges to manage user accounts, roles, permissions, and organizational settings.
• "Client Data" means all data, content, records, files, and information uploaded, submitted, created, or processed by or on behalf of the Client through the Dashboard.
• "Confidential Information" means any non-public technical, business, financial, or operational information disclosed by either party.
• "Service Disruption" means any unplanned interruption, degradation, or unavailability of Dashboard functionality.

3. Account Ownership, Administration, and User Lifecycle

Organization accounts on the Dashboard are owned by the contracting Client entity, not by individual employees or users. The Client bears full responsibility for:

• Designating and maintaining at least one (1) Client Administrator at all times;
• Timely provisioning and deprovisioning of Authorized Users, including upon employee termination, role change, or departure;
• Accurate configuration of user roles, permissions, and access levels consistent with the principle of least privilege;
• Ensuring that all Authorized Users are aware of and comply with these Terms and any applicable internal policies;
• All actions performed using valid credentials and authenticated sessions, regardless of whether such actions were authorized by Client.

Reja shall not be liable for any unauthorized access, data exposure, or loss resulting from Client's failure to manage user accounts, credentials, or permissions in a timely and appropriate manner.

4. Access Control, Authentication, and Security

All Authorized Users must:

• Maintain the strict confidentiality of login credentials and not share, transfer, or disclose them to any unauthorized person;
• Use multi-factor authentication where enabled or required by organizational policy;
• Immediately notify the Client Administrator and Reja of any suspected unauthorized access, credential compromise, or security incident;
• Comply with all access control policies, session management rules, and security requirements established by Reja or Client.

Reja reserves the right to: (a) enforce password complexity and rotation requirements; (b) terminate idle sessions; (c) require re-authentication at any time; (d) suspend or disable any user account that Reja reasonably believes has been compromised, is being misused, or poses a security risk, with or without prior notice.

5. Acceptable Use Policy

The Dashboard shall be used solely for legitimate business purposes authorized under the Client's subscription. The following activities are strictly prohibited:

• Processing, uploading, or storing unlawful, defamatory, obscene, threatening, or rights-infringing content;
• Running unauthorized automated scripts, bots, data extraction tools, or load-testing utilities against the Dashboard;
• Attempting to access, probe, or test the vulnerability of the Dashboard or any connected system without prior written authorization;
• Circumventing, disabling, or interfering with any security, rate-limiting, or access control mechanisms;
• Using the Dashboard in any manner that could damage, disable, overburden, or impair Reja's infrastructure or interfere with other clients' use;
• Sublicensing, reselling, or providing access to unauthorized third parties;
• Any use that violates applicable laws, regulations, or industry standards, including data protection and privacy regulations.

6. Data Collection, Categories, and Client Data Responsibilities

6.1 Data Categories Processed Through the Dashboard

The Dashboard collects, processes, and displays the following categories of data:

• User account data: names, email addresses, phone numbers, roles, permissions, login history, and session metadata of Authorized Users;
• Organizational data: company name, structure, department hierarchy, branch/outlet locations, and organizational configuration;
• Operational data: task records, visit logs, route plans, schedule data, stock/inventory records, order and transaction data, form submissions, and workflow states;
• Field evidence: photographs, digital signatures, notes, survey responses, and geo-tagged media uploaded from mobile applications;
• Customer/outlet data: names, addresses, contact details, classifications, purchase histories, and engagement records of the Client's customers or outlets;
• Location and telemetry data: GPS coordinates, check-in/check-out timestamps, route traces, geofence events, and distance/time metrics from field operations;
• Analytics and reporting data: aggregated metrics, KPIs, dashboards, reports, and visualizations derived from the above data categories;
• Integration data: API call logs, webhook payloads, and data exchanged with connected third-party systems;
• Audit and security data: access logs, change histories, permission modifications, login events, and security-related telemetry.

6.2 Client Data Ownership and Responsibilities

• The Client retains all ownership rights in Client Data. Reja acquires no ownership interest in Client Data by virtue of providing the Dashboard.
• The Client is solely responsible for the accuracy, quality, legality, and completeness of all Client Data uploaded, entered, or processed through the Dashboard.
• The Client must ensure a lawful basis exists (under applicable data protection legislation in each jurisdiction where data subjects are located) for all personal data submitted by or on behalf of the Client.
• Reja acts as a data processor (or service provider) with respect to Client Data, as defined in the applicable Governing Agreements and DPA.
• Client shall not upload to the Dashboard any data classified as sensitive or special-category personal data unless expressly permitted under the Governing Agreements and appropriate safeguards are in place.

7. Operational Features, Limitations, and Dependencies

• Dashboard analytics, reports, and visualizations depend on timely data synchronization, completeness of Client Data, and correct system configuration. Reja does not warrant the accuracy of reports derived from incomplete or incorrectly configured data.
• Offline-originated records from mobile or field applications may appear in the Dashboard following synchronization, and may be subject to conflict resolution rules that alter their final accepted state.
• Certain modules, features, or functionality may be subject to feature flags, subscription tier limitations, license entitlements, app version requirements, or environmental dependencies.
• Reja may perform scheduled and emergency maintenance that temporarily affects Dashboard availability. Where possible, advance notice will be provided for scheduled maintenance windows.

8. Integrations, API Use, and Connected Systems

• API keys, authentication tokens, webhook endpoints, and integration credentials must be securely stored by the Client and rotated periodically in accordance with security best practices.
• The Client bears full responsibility for all downstream systems, applications, and processes receiving data exports, webhooks, or API responses from the Dashboard.
• Reja may implement and enforce rate limiting, throttling, and usage quotas on API endpoints to preserve platform stability and fair resource allocation.
• Use of the API is subject to the API documentation and any additional API-specific terms published by Reja. Reja reserves the right to deprecate, modify, or retire API endpoints with reasonable notice.
• The Client shall not use the API to build or contribute to a product or service that competes with Reja's offerings.

9. Audit, Compliance, and Monitoring

Reja maintains comprehensive access logs, audit trails, and security telemetry for the purposes of:

• Fraud prevention and detection;
• Security incident investigation and response;
• Service quality monitoring and performance optimization;
• Compliance with applicable legal and regulatory requirements;
• Enforcement of these Terms and the Acceptable Use Policy.

The Client acknowledges that Reja may monitor Dashboard usage patterns and may use aggregated, de-identified, and anonymized telemetry data for platform improvement, benchmarking, and analytical purposes, provided that such data cannot reasonably be used to identify the Client or any individual.

10. Support and Incident Handling

Support channels, response time targets, severity classifications, escalation paths, and incident communication procedures are governed by the Client's commercial support package and applicable SLA. Reja shall use commercially reasonable efforts to respond to reported incidents in accordance with the agreed severity classifications. Reja's obligation to provide support is contingent on the Client maintaining an active, paid subscription in good standing.

11. Intellectual Property

All intellectual property rights in the Dashboard, including software, algorithms, user interfaces, documentation, designs, and all improvements and derivatives thereof, remain the sole and exclusive property of Reja. The Client is granted a limited, non-exclusive, non-transferable, revocable license to use the Dashboard solely in accordance with the Governing Agreements and these Terms. No right, title, or interest in any Reja intellectual property is transferred to the Client.

12. Confidentiality

Each party shall hold in confidence all Confidential Information received from the other party and shall not disclose such information to any third party except: (a) to employees, contractors, or agents who need to know and are bound by confidentiality obligations no less restrictive than those herein; (b) as required by applicable law, regulation, or court order, provided the disclosing party is given reasonable prior notice where permitted; or (c) with the prior written consent of the disclosing party. These confidentiality obligations shall survive for a period of five (5) years following the termination or expiration of these Terms, except with respect to trade secrets, which shall be protected for as long as they remain trade secrets under applicable law.

13. Suspension and Termination

Reja may immediately suspend or restrict Dashboard access, in whole or in part, without liability, upon the occurrence of any of the following:

• Billing default that remains uncured after the applicable notice and cure period;
• Material breach of these Terms or any Governing Agreement;
• Security incidents, threats, or vulnerabilities that pose a risk to platform integrity or other clients;
• Suspected fraud, abuse, or illegal activity;
• Compliance with applicable laws, regulations, court orders, or government directives;
• Client's insolvency, liquidation, or cessation of business operations.

Reja will use reasonable efforts to provide advance notice before suspension, except where immediate action is necessary to prevent harm. The Client may request termination in accordance with the notice terms specified in the MSA.

14. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, REJA SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES ARISING OUT OF OR IN CONNECTION WITH THE USE OF THE DASHBOARD, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, BUSINESS OPPORTUNITIES, OR GOODWILL. LIABILITY CAPS, EXCLUSIONS, AND INDEMNIFICATION OBLIGATIONS ARE AS DEFINED IN THE GOVERNING AGREEMENTS. WHERE NO GOVERNING AGREEMENTS EXIST, DASHBOARD USE IS ENTIRELY AT THE CLIENT'S OWN RISK, AND REJA'S TOTAL AGGREGATE LIABILITY SHALL NOT EXCEED THE FEES PAID BY CLIENT IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

15. Modifications to Terms

Reja reserves the right to update, modify, or amend these Terms at any time. Material changes will be communicated through the Dashboard or via email to Client Administrators. Continued use of the Dashboard after notification constitutes acceptance of the modified Terms. Where legally required, Reja may require affirmative re-acceptance for continued access.

16. Governing Law and Dispute Resolution

These Terms shall be governed by and construed in accordance with the laws specified in the Governing Agreements. Where no Governing Agreements exist, these Terms shall be governed by the laws of the jurisdiction in which the applicable Reja contracting entity is registered. Where the Client is domiciled in a jurisdiction with mandatory consumer or data protection provisions, those mandatory provisions shall apply to the extent they cannot be contractually excluded. In the absence of a specific jurisdictional designation, the laws of the Republic of Kenya shall apply, and disputes shall be subject to the exclusive jurisdiction of the courts of Nairobi, Kenya, unless otherwise agreed in writing.

17. Cross-Border Data Processing and Regional Compliance

Where the Client operates across multiple African jurisdictions or the Dashboard processes data originating from multiple countries:

• Reja shall process data in accordance with the data protection laws applicable in each relevant jurisdiction, including but not limited to: the Kenya Data Protection Act, 2019; the South Africa Protection of Personal Information Act, 2013 (POPIA); the Nigeria Data Protection Act, 2023 (NDPA); the Rwanda Law Relating to the Protection of Personal Data and Privacy, 2021; the Uganda Data Protection and Privacy Act, 2019; the Ghana Data Protection Act, 2012; the Egypt Personal Data Protection Law No. 151 of 2020; and any other applicable data protection legislation in jurisdictions where the Client or its users are located;
• Cross-border transfers of Client Data between African jurisdictions shall be conducted in compliance with applicable transfer mechanisms, adequacy determinations, or contractual safeguards required by the originating jurisdiction's data protection authority;
• Where local law requires data localization (i.e., that certain categories of data be stored within the borders of a specific country), the Client is responsible for notifying Reja of such requirements. Reja shall use commercially reasonable efforts to accommodate data residency requirements, subject to technical feasibility and the terms of the applicable Order Form;
• The Client is solely responsible for ensuring compliance with local employment, telecommunications, and sector-specific regulations in each jurisdiction where it deploys the Dashboard;
• Reja may designate local representatives, data protection officers, or in-country compliance contacts as required by applicable regulatory frameworks.

18. Severability and Survival

If any provision of these Terms is held invalid or unenforceable, the remaining provisions shall continue in full force and effect. Provisions that by their nature should survive termination (including but not limited to Sections on Confidentiality, Intellectual Property, Limitation of Liability, Indemnification, Cross-Border Data Processing, and Governing Law) shall survive any termination or expiration of these Terms.