Data Processing Agreement

1.Scope and roles#

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Avitech Solutions Ltd ("Avitech", the processor) and the ISP using CoreSync (the "ISP", the controller). It applies whenever we process personal data on the ISP's behalf, and meets section 42 of the Data Protection Act, 2019 (the "Act") and the Data Protection (General) Regulations, 2021.

If this DPA and the Terms differ on how personal data is handled, this DPA wins.

2.What we process#

3.Acting on the ISP's instructions#

We process personal data only on the ISP's documented instructions. The Terms, this DPA, and the ISP's settings and actions in CoreSync are those instructions. We won't process it for any other purpose unless Kenyan law requires us to, in which case we'll tell the ISP first, unless the law forbids that.

If we believe an instruction breaks the Act, we'll tell the ISP.

We may use personal data to keep CoreSync secure, and to produce statistics that don't identify the ISP, its subscribers or any person.

4.The ISP's responsibilities#

The ISP is responsible for having a lawful basis to collect and process its subscribers' data, giving them the information section 29 of the Act requires, keeping the data accurate, and registering with the Office of the Data Protection Commissioner where required.

5.Confidentiality#

Everyone at Avitech who can access the ISP's personal data is bound to confidentiality by an employment contract or written agreement, and gets access only as their work requires.

6.Security#

We apply the technical and organisational measures in Annex A, as section 41 of the Act requires, and review them as risks and technology change. We may update them, provided the overall protection isn't reduced.

7.Sub-processors#

The ISP authorises us to use the sub-processors listed on our Sub-processors page.

We'll give at least 14 days' notice before adding or replacing a sub-processor, by email to the account owner or in the admin portal. If the ISP objects on reasonable data protection grounds, we'll discuss alternatives in good faith. If we can't resolve the objection, the ISP may end the Terms without penalty before the change takes effect.

Each sub-processor is bound by written terms that protect personal data at least as well as this DPA. We remain responsible to the ISP for their work.

8.Transfers outside Kenya#

We store the ISP's personal data on infrastructure in Kenya. We transfer it outside Kenya only to the sub-processors listed for that purpose, and only as Part VI of the Act and the Regulations allow.

The AI assistant sends the questions users ask, and the records it needs to answer them, to the AI model provider on the Sub-processors page. The ISP decides whether its users use the assistant.

9.Helping with data subject requests#

If a subscriber or other data subject asks us directly to exercise their rights, we'll pass the request to the ISP without undue delay, and won't answer it ourselves unless the ISP asks us to.

The ISP can view, correct and delete subscriber data in CoreSync itself. For anything else, such as a full copy of one person's data, we'll help on request.

10.Personal data breaches#

If we become aware of a breach of security affecting the ISP's personal data, we'll notify the ISP without undue delay and, where reasonably practicable, within 48 hours, as section 43 of the Act requires. We'll explain what happened, the data and people likely affected, the likely consequences and what we're doing about it, and update the ISP as we learn more.

The ISP is responsible for notifying the Data Protection Commissioner within 72 hours, and affected subscribers, where the Act requires. We'll give it the help and information it reasonably needs to do so.

11.Impact assessments#

We'll give the ISP the information it reasonably needs about CoreSync to carry out a data protection impact assessment under section 31 of the Act, or to consult the Data Protection Commissioner.

12.Deleting and returning data#

When the Terms end, we lock the ISP's account and set a deletion date at least 14 days ahead. Before that date, we make a complete copy of the ISP's data, which the ISP can download. On that date, we delete the ISP's data from CoreSync's live systems.

We keep the copy for one year, so the ISP can still retrieve it, and then delete it. We also keep our own invoices and payment records with the ISP, and anything else the law requires us to keep, for as long as it's required.

The ISP can ask us to delete specific data sooner.

13.Information and audits#

We'll make available the information reasonably needed to show that we meet this DPA. If that isn't enough, the ISP, or an independent auditor bound to confidentiality, may audit our relevant processing once a year, with at least 30 days' notice, during business hours, at the ISP's cost, and in a way that doesn't expose other ISPs' data.

14.Liability#

Each side's liability under this DPA is subject to the limits in the Terms.

Annex A: security measures#

• Each ISP's data is kept separate from every other ISP's, and every request to CoreSync is checked against the ISP it belongs to.
• Users sign in individually. Passwords for signing in to CoreSync are stored only as one-way hashes.
• Access within an ISP's account is controlled by roles and fine-grained permissions. Sensitive actions, such as extending service or giving credit, can require a second person's approval.
• Actions in CoreSync are recorded in activity logs that show who did what, and when.
• Traffic to our websites, portals and APIs is encrypted in transit with TLS.
• CoreSync reaches the ISP's network equipment through private, encrypted tunnels (WireGuard or OpenVPN).
• Bulk export of subscriber data is off for ISP users by default, and the number of subscriber records an account can view can be capped, limiting what any one login can extract.
• CoreSync's servers run in Nairobi on infrastructure we operate, with access limited to authorised Avitech staff.
• We keep the platform and its servers patched, and we fix reported vulnerabilities as a priority.