Data Processing Agreement (DPA) - Duka Intelligence

1. Definitions

2. Scope of Processing

Duka Intelligence provides a governed enterprise knowledge platform and Duka Agents that support search, retrieval, summaries, recommendations, dashboards, APIs, chat interfaces, and approved workflow actions based on Customer Data integrated from authorized sources.

Processing activities may include:

• Ingestion and storage of Customer Data from business systems, documents, communications, social channels, cloud storage, and APIs
• Processing of structured, relational, unstructured, document, message, and conversation data
• Entity extraction, data normalization, enrichment, indexing, and knowledge object creation
• Search, retrieval, summarization, recommendations, answer generation, response drafting, and approved workflow support
• Generation of dashboards, reports, citations, freshness indicators, lineage, audit logs, and operational views
• Integration with third-party systems and communication channels authorized by the Controller

Personal data processed may include:

• Names, email addresses, phone numbers, roles, identifiers, and organization details
• Customer, member, employee, supplier, or contact records
• Message, document, transaction, task, workflow, or communication records
• Device, technical, usage, query, or audit data

The Controller determines the type of data shared with or connected to the Platform.

3. Roles and Responsibilities

Controller Responsibilities

The Customer agrees that:

• They have the legal right to process and share personal data.
• Data collected complies with applicable data protection laws.
• Appropriate notices, permissions, and consents have been provided to individuals where required.
• Connected systems, channels, files, APIs, and social accounts are authorized for the intended processing.

Processor Responsibilities

Akili Data agrees to:

• Process personal data only in accordance with the Customer's instructions.
• Maintain appropriate technical and organizational safeguards.
• Ensure confidentiality of personnel accessing personal data.
• Support reasonable data protection requests where technically feasible and legally required.

4. Security Measures

Akili Data implements appropriate safeguards including:

• Encrypted data transmission
• Secure cloud infrastructure
• Role-based access control
• Tenant or workspace separation where applicable
• Monitoring and logging of system activity
• Regular security updates

While we apply industry-standard protections, no system can guarantee absolute security.

5. Sub-processors

Akili Data may use third-party service providers to operate the Platform, including:

• Cloud hosting providers
• AI processing services
• Data infrastructure, storage, monitoring, and security providers
• Communication, messaging, social channel, and integration providers

All sub-processors are required to implement appropriate security and confidentiality measures.

The Customer authorizes Akili Data to engage such sub-processors for the purposes of operating the Platform.

6. Data Transfers

Where personal data is transferred outside Kenya, Akili Data ensures appropriate safeguards are in place to protect personal data in accordance with applicable data protection laws.

7. Data Breach Notification

In the event of a confirmed personal data breach affecting Customer Data, Akili Data will:

• Notify the Customer without undue delay
• Provide reasonable information about the breach
• Take steps to mitigate the impact

8. Data Retention and Deletion

Personal data is retained only as long as necessary to provide the Platform services.

Upon termination of the Customer's account:

• Data may be deleted, anonymized, or returned where technically feasible
• Certain data may be retained where required for legal, security, dispute resolution, or compliance purposes

9. Audit and Compliance

Akili Data maintains internal security and operational controls designed to protect personal data.

Customers may request reasonable information regarding these safeguards where necessary for compliance with applicable data protection laws.

10. Liability

Each party remains responsible for compliance with applicable data protection laws.

Akili Data's liability relating to personal data processing is subject to the limitations described in the Terms and Conditions.

11. Governing Law

This Data Processing Agreement shall be governed by the laws of Kenya.

Any disputes arising from this Agreement shall be subject to the jurisdiction of the courts of Kenya.

12. Contact

For questions regarding this Data Processing Agreement:

Akili Data
38286-00100 Nairobi
Kenya
Email: tsah@dukaintelligence.co.ke