Data Processing Agreement

This Data Processing Agreement (“DPA”) is between the organization that uses BrieflyLog (the “Customer”) and BrieflyLog (“we”, “us”). It forms part of our Terms of Service (or any other written agreement for the Service), and applies whenever we process personal data in Customer Data on the Customer's behalf.

For that personal data, the Customer is the data controller and we are its data processor. This DPA does not cover account and usage information we control ourselves, which is described in our Privacy Policy.

“Personal data”, “sensitive personal data”, “processing”, “data subject”, “personal data breach”, “data controller” and “data processor” have the meanings given in the Kenya Data Protection Act, 2019 (the “Act”) and its regulations.

“Sub-processor” means a third party we engage to process Customer personal data. Other capitalized terms have the meanings given in the Terms of Service.

• Subject matter and purpose: providing the BrieflyLog operations and reporting platform to the Customer, including hosting, storage, display, exports and any Integrations the Customer enables.
• Nature of processing: collection through the Customer's entries, storage, organization, retrieval, calculation of reports, export, transmission to Integrations the Customer authorizes, and deletion.
• Duration: the term of the Customer's use of the Service, plus the return and deletion period in “Return and deletion” below.
• Categories of data subjects: the Customer's Users and staff (including staff without a BrieflyLog login), staff members' next of kin, clients and their contacts, prospective clients (leads), parking members and vehicle owners, and other individuals the Customer chooses to record.
• Categories of personal data: names, contact details, job and department details, identity and passport numbers, dates of birth, gender, residential details, pay, leave records, next-of-kin details, vehicle registrations, client billing and payment records, lease and membership details, and notes the Customer enters.
• Sensitive personal data: depending on what the Customer records, this may include data the Act treats as sensitive, such as sex or gender, health status (for example, sick or maternity leave) and family details (for example, next of kin).

The Customer is responsible for:

• having a lawful basis under the Act for all personal data it records in the Service and for every Integration it enables, and meeting the Act's additional conditions for sensitive personal data;
• giving data subjects the notices the Act requires, and obtaining any consents required, including any consent the Act requires before sensitive personal data is processed outside Kenya;
• registering with the Office of the Data Protection Commissioner where the law requires, and carrying out any required data protection impact assessment;
• making sure its instructions to us are lawful, and limiting the personal data it records to what it needs.

We will:

• process Customer personal data only on the Customer's documented instructions. These instructions are the Terms of Service, this DPA, the Customer's configuration and use of the Service (including enabling Integrations), and any other written instructions the Customer gives us. If we believe an instruction breaks the law, we will tell the Customer;
• make sure everyone we authorize to process Customer personal data is bound by confidentiality;
• implement and maintain the security measures in Annex A, and update them as risks and technology change, without reducing overall protection;
• assist the Customer, taking into account the nature of the processing, in responding to data subjects exercising their rights under the Act;
• give the Customer reasonable assistance with data protection impact assessments and with consultations with the Data Protection Commissioner relating to the Service;
• not sell Customer personal data or use it to train artificial-intelligence models;
• keep the records of processing the Act requires of a data processor.

The Customer gives general authorization for us to engage sub-processors in the categories listed in Annex B. We will:

• provide a current list of our sub-processors and their locations on request;
• give the Customer at least 14 days' notice before adding or replacing a sub-processor. If the Customer objects on reasonable data protection grounds, we will discuss the objection in good faith. If it cannot be resolved, the Customer may end the Terms without penalty;
• impose data protection obligations on each sub-processor that are at least as protective as this DPA;
• remain responsible to the Customer for our sub-processors' performance.

Third-Party Services that the Customer connects through an Integration are not our sub-processors. They receive data from the Service as recipients chosen by the Customer (see the next section).

• When the Customer creates an API key or otherwise enables an Integration, it instructs us to make the data in the key's scopes and locations available to the Third-Party Service holding that key, until the key is revoked or expires.
• We will make data available only within those scopes, log every API request and show those logs to the Customer, and require API users to accept our Developer Terms.
• The Customer is responsible for its agreement with each Third-Party Service, including that party's own sub-processors (such as AI model providers) and any transfer of data outside Kenya.
• We may suspend an Integration that we reasonably believe threatens the security of Customer personal data. Where practical, we will tell the Customer first.

We and our sub-processors may process Customer personal data outside Kenya. We will do so only with appropriate safeguards as required by the Act and its regulations, and will give the Customer, on request, the information it needs to show that the safeguards exist. The Customer is responsible for obtaining any data subject consent that the Act requires for a transfer, including for sensitive personal data.

We will notify the Customer without delay, and where reasonably practicable within 48 hours, after becoming aware of a personal data breach affecting Customer personal data. As the information becomes available, we will describe:

• the nature of the breach, and the categories and approximate number of data subjects and records affected;
• its likely consequences;
• the measures we have taken or propose to take to address it and limit its effects.

We will cooperate with the Customer so that it can meet its own obligations to notify the Data Protection Commissioner and affected data subjects. Notifying the Customer is not an admission of fault.

On request, we will give the Customer the information reasonably necessary to demonstrate our compliance with this DPA. If that information is not sufficient, the Customer may audit our compliance no more than once a year, at its own cost, with at least 30 days' written notice, during business hours, and under confidentiality. An audit may also take place following a personal data breach, or when the Data Protection Commissioner requires one.

The Customer can export its data from the Service at any time while it uses the Service. For 30 days after the Terms end, we will provide an export on request. We will then delete Customer personal data within 90 days, including from active systems. Backups are overwritten on their normal rolling schedule. This does not apply where the law requires us to keep data, in which case we will keep it protected and use it for no other purpose.

Each party's liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms of Service on a data protection matter, this DPA prevails. This DPA stays in effect for as long as we process Customer personal data.

Execution. This DPA applies automatically under the Terms of Service. A Customer that wants a countersigned copy for its records can email legal@brieflylog.app. We will send one with the Customer's details completed.

• Encryption in transit: all access to the Service and the API uses HTTPS.
• Tenant isolation: every business record is tied to one organization, and every query is restricted to the requesting user's organization on the server.
• Access control: role- and location-based permissions checked on the server for every request. HR data needs a separate HR permission that only a permanent administrator can grant, and temporary admin access never includes it.
• Authentication: passwords stored only as one-way hashes, with sessions that expire.
• API keys: stored only as hashes, shown once, limited to specific data scopes and locations, required to expire, revocable instantly and rate limited. HR data is not available through the API.
• Audit trails: HR changes and every API request are logged.
• Personnel: access to production systems limited to personnel who need it, under confidentiality obligations.
• Resilience: managed database hosting with automated backups.

• Cloud application hosting: runs the BrieflyLog application.
• Managed database hosting: stores Customer Data and backups.
• Transactional email: delivers account emails such as password resets. It receives Users' names and email addresses only.