Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Agreement between the client ("Controller") and Kikavu Tech Solutions ("Processor") wherever Kikavu Tech Solutions processes personal data on the Controller's behalf in the course of providing hosting, software, GPS tracking, School Management System, AI automation, or related Services.

1.Subject Matter & Duration

This DPA applies for the duration of the underlying Agreement and continues to apply to any residual personal data until it is deleted or returned in accordance with Section 6.

2.Nature & Purpose of Processing

Processing consists of hosting, storage, transmission, backup, and technical support of personal data submitted by the Controller for the purpose of operating the contracted software, platform, or service — including websites, ERP/CRM systems, GPS tracking platforms, School Management Systems, and AI-enabled tools.

3.Categories of Data & Data Subjects

Depending on the Service, personal data may include: names and contact details of employees, customers, students, parents/guardians, or drivers; login credentials; payment and billing information; location/GPS data; academic and attendance records; and content uploaded by the Controller.

4.Processor Obligations

• Process personal data only on documented instructions from the Controller, unless required to do otherwise by law;
• Ensure personnel authorised to process data are bound by confidentiality obligations;
• Implement appropriate technical and organisational security measures (see Information Security Policy);
• Assist the Controller, insofar as reasonably possible, in responding to data subject rights requests;
• Notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data;
• Delete or return all personal data to the Controller at the end of the Service provision, unless retention is required by law.

5.Sub-processors

The Controller authorises Kikavu Tech Solutions to engage sub-processors necessary for Service delivery, which may include cloud/hosting infrastructure providers, payment gateways, SMS/email delivery services, and AI infrastructure providers. Kikavu Tech Solutions will impose data protection obligations on sub-processors materially equivalent to those in this DPA and will notify the Controller of material changes to sub-processors where reasonably practicable.

6.International Transfers

Where personal data is transferred outside Tanzania, Kikavu Tech Solutions will ensure appropriate safeguards are in place, such as contractual data protection obligations with the receiving provider consistent with the Tanzania Personal Data Protection Act and, where applicable, GDPR-recognised transfer mechanisms.

7.Security Measures

Kikavu Tech Solutions maintains security measures including encryption in transit, access controls, regular backups, vulnerability monitoring, and incident response procedures, as further detailed in our Information Security Policy.

8.Data Breach Notification

In the event of a confirmed personal data breach affecting Controller data, Kikavu Tech Solutions will notify the Controller without undue delay and, where feasible, within 72 hours of becoming aware, providing available details of the nature of the breach, affected data categories, and mitigation steps taken.

9.Audits

Upon reasonable written notice, the Controller may request information demonstrating Kikavu Tech Solutions' compliance with this DPA, which may be satisfied through security documentation, certifications, or a mutually scheduled review.

10.Liability

Liability under this DPA is subject to the limitation of liability provisions set out in the Terms & Conditions and the underlying Agreement.

11.Term & Termination

This DPA remains in effect for as long as Kikavu Tech Solutions processes personal data on behalf of the Controller under the Agreement.

12.Governing Law

This DPA is governed by the laws of the United Republic of Tanzania.