Data Processing Agreement (DPA) - Duka Intelligence

1. Definitions

2. Scope of Processing

Duka Intelligence provides analytics, reporting, and data insights based on business data integrated from external systems.

Processing activities may include:

• Storage of business transaction data
• Analysis of sales and operational metrics
• Generation of dashboards and analytics
• Processing of AI-generated insights
• Data integration with third-party systems

Personal data processed may include:

• Customer names
• Email addresses
• Purchase records
• Transaction identifiers
• Device or technical data

The Controller determines the type of data shared with the Platform.

3. Roles and Responsibilities

Controller Responsibilities

The Customer agrees that:

• They have the legal right to process and share personal data.
• Data collected complies with applicable data protection laws.
• Appropriate notices and consents have been provided to individuals where required.

Processor Responsibilities

Akili Data agrees to:

• Process personal data only in accordance with the Customer's instructions.
• Maintain appropriate technical and organizational safeguards.
• Ensure confidentiality of personnel accessing personal data.

4. Security Measures

Akili Data implements appropriate safeguards including:

• Encrypted data transmission
• Secure cloud infrastructure
• Role-based access control
• Monitoring and logging of system activity
• Regular security updates

While we apply industry-standard protections, no system can guarantee absolute security.

5. Sub-processors

Akili Data may use third-party service providers to operate the Platform, including:

• Cloud hosting providers
• AI processing services
• Data infrastructure providers

All sub-processors are required to implement appropriate security and confidentiality measures.

The Customer authorizes Akili Data to engage such sub-processors for the purposes of operating the Platform.

6. Data Transfers

Where personal data is transferred outside Kenya, Akili Data ensures appropriate safeguards are in place to protect personal data in accordance with applicable data protection laws.

7. Data Breach Notification

In the event of a confirmed personal data breach affecting Customer data, Akili Data will:

• Notify the Customer without undue delay
• Provide reasonable information about the breach
• Take steps to mitigate the impact

8. Data Retention and Deletion

Personal data is retained only as long as necessary to provide the Platform services.

Upon termination of the Customer's account:

• Data may be deleted, anonymized, or returned where technically feasible
• Certain data may be retained where required for legal or security purposes

9. Audit and Compliance

Akili Data maintains internal security and operational controls designed to protect personal data.

Customers may request reasonable information regarding these safeguards where necessary for compliance with applicable data protection laws.

10. Liability

Each party remains responsible for compliance with applicable data protection laws.

Akili Data's liability relating to personal data processing is subject to the limitations described in the Terms and Conditions.

11. Governing Law

This Data Processing Agreement shall be governed by the laws of Kenya.

Any disputes arising from this Agreement shall be subject to the jurisdiction of the courts of Kenya.

12. Contact

For questions regarding this Data Processing Agreement:

Akili Data
38286-00100 Nairobi
Kenya
Email: tsah@dukaintelligence.co.ke