Data Processing Agreement (DPA)

Last updated: May 2026

1. Parties & Scope

This DPA forms part of the Terms of Service between you ("Customer", acting as the data controller) and KenyaSMS ("Processor"). It applies whenever KenyaSMS processes personal data on your behalf in connection with the messaging services.

2. Subject Matter and Duration

The subject matter of processing is the delivery of SMS and email messages from the Customer to recipients identified by the Customer. Processing continues for the duration of the service agreement and ends on termination, subject to the retention periods below.

3. Categories of Personal Data Processed

• Recipient phone numbers and email addresses provided by the Customer.
• Message content provided by the Customer.
• Delivery receipts (DLRs) and delivery status returned by the upstream operator.
• Opt-out flags raised by recipients.
• Customer-provided contact-list metadata (names, custom fields).

4. Categories of Data Subjects

Recipients of messages sent by the Customer through KenyaSMS — typically the Customer's own customers, employees, or other contacts.

5. Sub-Processors

KenyaSMS engages the following categories of sub-processors:

• Mobile network operators (Safaricom, Airtel, Telkom, Equitel, Faiba, and international aggregators) for SMS delivery.
• Resend for transactional and bulk email delivery.
• Cloud infrastructure (server hosting, managed PostgreSQL, managed Redis) located in or near East Africa.

An up-to-date list of sub-processors is available on request from webzillacreators@gmail.com.

6. Data Location and Retention

Customer data is stored on infrastructure located in or near Kenya. Message logs, delivery receipts, and contact lists are retained for the duration of the agreement and for a reasonable period thereafter for billing reconciliation, regulatory compliance (CAK), and dispute resolution.

7. Security Measures

KenyaSMS implements technical and organisational security measures appropriate to the risk, including:

• Transport encryption (HTTPS/TLS) for all API and dashboard traffic.
• At-rest encryption for credentials and API keys.
• Role-based access control with least-privilege defaults.
• Optional two-factor authentication for all user accounts.
• Audit logging of administrative actions.
• Tenant isolation across customer accounts.

8. Customer Obligations

The Customer warrants that it has a lawful basis (consent, contract, legitimate interest, etc.) to process and to instruct KenyaSMS to process the personal data of each recipient, and that the Customer's recipient lists comply with the Kenya Data Protection Act 2019 and any other applicable law.

9. Data Subject Rights

KenyaSMS will, at the Customer's reasonable request and cost, provide the assistance necessary to enable the Customer to fulfil data-subject access, rectification, erasure, restriction, portability and objection requests. Recipient opt-outs (STOP) are honoured automatically and persisted at the account level.

10. Personal Data Breach Notification

KenyaSMS will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, and will provide the information necessary for the Customer to comply with its own breach-notification obligations.

11. Audits

KenyaSMS will, at the Customer's reasonable request, provide information necessary to demonstrate compliance with this DPA. Where on-site audits are required by enterprise customers, the parties will agree on scope and timing in good faith.

12. Termination & Return of Data

On termination of the service agreement, KenyaSMS will, at the Customer's choice, delete or return the personal data processed on the Customer's behalf, except where retention is required by applicable law or for legitimate business purposes (e.g., tax records).

13. Governing Law

This DPA is governed by the laws of the Republic of Kenya, including the Data Protection Act 2019 and any regulations issued thereunder.

14. Contact

Data Protection enquiries: webzillacreators@gmail.com.