Data Processing Agreement

Effective: 1 September 2026 · Protech Concepts Limited · Nairobi, Kenya · legal@protechconcepts.co.ke

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Protech Concepts Limited ("Processor") and the Customer ("Controller") and governs the processing of personal data as defined in the Kenya Data Protection Act 2019 ("KDPA").

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person that you submit to the Service. "Processing" has the meaning given in the KDPA.

2. Roles

You (Customer) are the Controller of the personal data you enter into the Service. Protech Concepts Limited is the Processor acting on your documented instructions.

3. Processor Obligations

We will:

Process personal data only on your documented instructions (operating the Service).
Ensure persons authorised to process the data are bound by confidentiality.
Implement appropriate technical and organisational security measures (encryption at rest and in transit, access controls, audit logging).
Assist you in meeting your obligations to data subjects regarding access, correction, erasure and portability requests.
Delete or return all personal data on termination of the agreement.
Make available all information necessary to demonstrate compliance with this DPA.

4. Sub-processors

We use the following sub-processors:

Sub-processor	Purpose	Location
Safaricom PLC	M-Pesa payment processing	Kenya
Kenya Revenue Authority	eTIMS tax invoice transmission	Kenya
Africa's Talking Ltd	SMS notification delivery	Kenya

We will notify you of any intended changes to sub-processors at least 30 days in advance.

5. Data Transfers

All personal data is stored and processed in Kenya. No transfers outside Kenya are made except to KRA (required by law) and to sub-processors whose infrastructure is Kenya-based.

6. Security Incidents

We will notify you without undue delay (and within 72 hours where feasible) of any personal data breach affecting your data, including the nature of the breach, categories of data affected, and remediation steps taken.

7. Audit Rights

You may request an audit of our processing activities once per calendar year on 30 days' written notice. We may propose a third-party audit in place of a direct audit to protect other customers' confidential information.

8. Term and Termination

This DPA is effective for the duration of the Terms of Service. On termination, we will delete your personal data within 90 days and provide written confirmation on request.

9. Governing Law

This DPA is governed by Kenyan law and the KDPA 2019.

10. Contact

Data Protection Officer: legal@protechconcepts.co.ke