Draft for review by an advocate before go-live (pending input 9.1).

This agreement forms part of the terms of service. It applies to personal data that the customer (the controller) keeps in Octonerv ERP, which [the operator's legal name] ("we", the processor) processes for it, under section 42 of the Data Protection Act, 2019 and its regulations.

1. Instructions

We process the customer's personal data only to provide the service and on the customer's documented instructions (these terms, its settings and its requests), unless the law requires otherwise. In that case we tell the customer first, unless the law forbids it.

2. Confidentiality

Everyone at our end who can reach the data is bound to keep it confidential, and reaches it only as their work needs.

3. Security

• Each customer's data is kept in its own database, apart from every other customer's.
• Secrets are encrypted at rest. Connections use TLS, passwords are hashed with Argon2, and two-factor sign-in is required for high-risk work.
• Every change to money is recorded in a tamper-evident audit trail.
• Backups are taken daily, encrypted, verified and kept apart from the database.
• We review the measures at least once a year against OWASP ASVS level 2.

4. Sub-processors

The customer authorises the sub-processors listed in the privacy notice. We tell the customer of a new one 30 days before it starts, and the customer may object. Each sub-processor is bound to protections no weaker than these.

5. Helping the customer

We help the customer answer data-subject requests (the service has the tools), assess impact, and consult the Data Commissioner where needed.

6. Breaches

We tell the customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting its data. We say what happened, what data and whose, and what we have done, so that the customer can notify the Data Commissioner within 72 hours.

7. Transfers

Data is hosted in [the hosting country, pending input 9.7]. Any transfer outside Kenya follows Part VI of the Act.

8. At the end

When the agreement ends, the customer may export its data for 30 days. We then delete it, and its backups as they age out, unless the law requires us to keep it.

9. Audit

We make available the information needed to show we meet this agreement, and allow reasonable audits on 30 days' notice, no more than once a year unless there has been a breach.