A division of Jiranisoko Market Ltd
Investor & Group
Jiranisoko Tech
Request Proposal

Legal

Data processing addendum

This addendum governs our processing of personal data on a client's behalf. It attaches to the engagement contract and takes precedence over it on any question of data protection. Where an engagement involves no personal data at all, Annex 1 records that and the operative clauses have nothing to bite on.

Version
1.0, effective 9 September 2026. Superseded versions are kept and quoted by version number in each engagement.
Contracting entity
Jiranisoko Market Ltd (PVT-YQ195JQY), a company incorporated in the Republic of Kenya, acting through its Jiranisoko Tech Solutions division. The division is not a separate legal person and does not contract in its own name.
Applies to
Every engagement in which we process personal data for which the client is the controller. It does not govern personal data we collect for our own purposes, which is covered by the privacy notice.

Terms

Definitions and interpretation

  1. Data Protection Law means the Kenya Data Protection Act 2019 and the regulations made under it, including the Data Protection (General) Regulations 2021; and, where the processing falls within its scope, Regulation (EU) 2016/679 (the GDPR) and the equivalent United Kingdom legislation. Where two regimes apply to the same processing, the stricter obligation governs.
  2. Controller, Processor, Data Subject, Personal Data, Processing and Personal Data Breach carry the meanings given to them in Data Protection Law.
  3. Controller in this addendum means the client named in the engagement contract. Processor means the contracting entity named above. Sub-processor means any third party engaged by the Processor to process Personal Data on the Controller's behalf.
  4. Commissioner means the Data Commissioner appointed under the Kenya Data Protection Act 2019, and Supervisory Authority means the Commissioner or any other competent authority for the processing.
  5. Annex means an annex to this addendum. Annexes 1 and 2 are completed for each engagement and form part of it. Annex 3 is the register published at https://jiranisokotech.co.ke/legal/sub-processors as it stands from time to time.

Roles of the parties

  1. The Controller determines the purposes and means of the Processing. The Processor processes only on the Controller's behalf. Nothing in an engagement makes the Processor a controller of the Personal Data, and the Processor does not process it for any purpose of its own.
  2. The Controller warrants that it has a lawful basis for the Processing, that the required information has been given to Data Subjects, and that its instructions do not require the Processor to act unlawfully.
  3. The Processor does not aggregate, anonymise, derive statistics from, or train any model on the Controller's Personal Data for its own benefit. Where such processing is wanted, it is an instruction recorded in Annex 1 and not an assumed liberty.

Subject matter, duration, nature and purpose

  1. The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subject are set out in Annex 1, completed for each engagement before Processing begins.
  2. Processing continues for the term of the engagement and for the period in clause 10 that follows its end. It does not continue past that period for any reason not stated in this addendum.
  3. An engagement whose Annex 1 records that no Personal Data is processed is governed by this addendum only to the extent that the position later changes. A change is a variation to Annex 1, made in writing before the first Processing.

Processing on documented instructions

  1. The Processor processes Personal Data only on the Controller's documented instructions, including as to transfers, unless required to do otherwise by a law to which it is subject. Where a law requires it, the Processor informs the Controller of that requirement before Processing, unless the law forbids that notice on important grounds of public interest.
  2. This addendum, the engagement contract and Annex 1 are the Controller's initial documented instructions. Further instructions are given in writing to the engagement's named contact and are recorded against the engagement.
  3. The Processor informs the Controller without delay if, in its opinion, an instruction infringes Data Protection Law, and may suspend the affected Processing until the instruction is confirmed, varied or withdrawn. Suspension on this ground is not a breach of the engagement contract.

Confidentiality of personnel

  1. Access to Personal Data is limited to personnel who need it to deliver the engagement. Access is granted by named post, reviewed when a person's role changes, and withdrawn on the day an engagement or an employment ends.
  2. Every person authorised to process Personal Data is bound by a written confidentiality obligation that survives the end of their engagement or employment. Where a statutory duty of confidence already binds them, that duty is in addition to and not in place of the written one.
  3. Personnel are instructed on their obligations under this addendum before they are given access, and the instruction is recorded.

Security of processing

  1. The Processor implements the technical and organisational measures set out in Annex 2, having regard to the state of the art, the cost of implementation, and the nature, scope, context and purposes of the Processing as against the risk to Data Subjects.
  2. Annex 2 states the measures actually in operation. It is not a statement of intent, and a measure is removed from it on the day it stops being true rather than at the next review.
  3. The Processor may change a measure, but not so as to lower the overall level of security. A material change to Annex 2 is notified to the Controller in the same way as a change of Sub-processor.
  4. Where the engagement requires a control that Annex 2 does not list, it is recorded in Annex 1 as a specific obligation and priced accordingly. The Controller should not assume a control merely because it is common.

Sub-processors

  1. The Controller gives general written authorisation for the Processor to engage the Sub-processors listed as engaged in Annex 3 at the date the addendum is signed.
  2. A party listed in Annex 3 as conditional is not authorised by that listing. It is engaged only where the Controller authorises it in writing for that engagement, and the authorisation is recorded in Annex 1.
  3. The Processor imposes on every Sub-processor, by written contract, data protection obligations no less protective than those in this addendum. The Processor remains fully liable to the Controller for a Sub-processor's performance as if it were its own.
  4. The Processor gives the Controller at least 30 days' written notice before a new Sub-processor begins Processing, or before an existing one takes on a materially different role. Within that period the Controller may object on reasonable data protection grounds.
  5. On an objection the parties work in good faith to find an alternative. If none is available within a reasonable period, the Controller may terminate the affected part of the engagement without penalty, on notice, and clause 10 applies to the Personal Data. The Processor does not engage the objected-to Sub-processor for that Controller's Personal Data in the meantime.

Transfers outside Kenya

  1. Personal Data is processed in Kenya unless Annex 1 or Annex 3 records otherwise. The Processor does not transfer Personal Data out of Kenya without the Controller's documented instruction and a lawful transfer mechanism in place before the transfer.
  2. Where a transfer is instructed, it is made on one of: a finding by the Commissioner that the destination affords adequate protection; appropriate safeguards recognised by the Kenya Data Protection Act 2019, including binding contractual clauses; or another basis permitted by that Act. Where the GDPR also applies, the transfer additionally relies on a mechanism under Chapter V of the GDPR, ordinarily the European Commission's standard contractual clauses.
  3. The mechanism relied upon for each Sub-processor is stated in Annex 3. Where an entry records that a location is not yet confirmed in writing, the Processor does not treat the favourable answer as given: it obtains confirmation, and if the answer places Processing outside Kenya it notifies the Controller under clause 7.4 before Processing continues.

Assistance to the controller

  1. Data subject rights. Taking account of the nature of the Processing, the Processor assists the Controller by appropriate technical and organisational measures, so far as possible, to respond to requests to exercise Data Subject rights. Where the Processor receives such a request directly, it does not respond to it itself but forwards it to the Controller without undue delay and in any event within three business days.
  2. Personal data breach. The Processor notifies the Controller without undue delay and in any event within twenty-four hours of becoming aware of a Personal Data Breach affecting the Controller's Personal Data. The notification states, so far as known:
    1. the nature of the breach, including the categories and approximate number of Data Subjects and records concerned;
    2. the likely consequences;
    3. the measures taken or proposed to address it, including to mitigate its effects; and
    4. a contact point for further information.
  3. Information not available at the time of notification is provided in phases as it is established, without further delay. The Processor does not withhold an initial notification because the picture is incomplete, and it assists the Controller in meeting the Controller's own deadline for notifying the Commissioner, which the Kenya Data Protection Act 2019 sets at seventy-two hours from awareness.
  4. Impact assessments. The Processor assists the Controller with data protection impact assessments and with any prior consultation with a Supervisory Authority, to the extent the assistance relates to Processing by the Processor and taking account of the information available to it.
  5. Assistance under this clause is provided at no additional charge where it is proportionate to the engagement. Where a request is repetitive or requires material engineering effort, the Processor may charge at the rates in the engagement contract, having first told the Controller and agreed the scope. Cost is never a reason to delay a breach notification under clause 9.2.

Deletion or return

  1. At the Controller's election, the Processor deletes or returns all Personal Data at the end of the engagement, and deletes existing copies, unless a law to which the Processor is subject requires it to be kept. Where retention is required by law, the Processor tells the Controller what is retained, on what basis, and for how long.
  2. The Controller states its election in writing before the end of the engagement. Absent an election, the Processor returns the Personal Data in a structured, commonly used, machine-readable format and then deletes it.
  3. Deletion is completed within thirty days of the end of the engagement or of the return, whichever is later. The Processor issues a written confirmation of deletion on request.
  4. Personal Data held in backups is not individually deleted. It is isolated from active Processing, protected by the measures in Annex 2, and deleted when the backup expires on its ordinary cycle. The Processor states that cycle on request.

Records, audit and inspection

  1. The Processor keeps a record of the categories of Processing carried out on the Controller's behalf, as required of processors by Data Protection Law, and makes it available to the Controller on request.
  2. The Processor makes available to the Controller all information necessary to demonstrate compliance with this addendum, and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor it mandates.
  3. An audit may be conducted once in any twelve-month period on thirty days' written notice, during business hours, without unreasonable disruption, and subject to confidentiality obligations. This limit does not apply to an audit following a Personal Data Breach, or where a Supervisory Authority requires one, and neither is subject to the notice period in this clause.
  4. The auditor may not be a competitor of the Processor. Access is not given to another client's data, to personnel data unrelated to the engagement, or to material subject to legal professional privilege.
  5. Each party bears its own costs, save that the Controller bears the Processor's reasonable costs of an audit it requests more than once in a twelve-month period.

Liability, term and precedence

  1. This addendum begins when the engagement contract begins, or on the day it is signed if later, and continues for as long as the Processor holds the Controller's Personal Data. Clauses 5, 10, 11 and this clause survive its termination.
  2. Liability under this addendum is subject to the limitations and exclusions in the engagement contract, save that nothing limits a liability that Data Protection Law does not permit to be limited, including liability to a Data Subject.
  3. Where this addendum conflicts with the engagement contract or with any other agreement between the parties, this addendum prevails on data protection matters. Where it conflicts with a Sub-processor's terms, this addendum prevails as between the Controller and the Processor.
  4. This addendum is governed by the laws of the Republic of Kenya. Disputes are resolved by the procedure in the engagement contract, and failing one, by the courts of Kenya. Nothing here affects a Data Subject's right to complain to the Commissioner or to any other Supervisory Authority.

Annex 1 — Details of the processing

Completed for each engagement before Processing begins, and varied in writing if the position changes. An engagement that has not completed this annex has not been instructed, and the Processor does not begin.

ItemTo be recorded for the engagement
Subject matter The system or service being built, operated or supported, identified by the engagement reference.
Duration The engagement term, plus the deletion period in clause 10.3.
Nature and purpose What is actually done to the data — for example storage and hosting, migration from a legacy system, support access to a production database, or processing under test with production data. Each carries a different risk and is named separately.
Categories of personal data Listed by field group, not by system. Any special category data, and any data relating to children, is called out expressly.
Categories of data subjects For example the Controller's customers, members, patients, employees or citizens dealing with a public body.
Processing locations Where Processing takes place, and any location outside Kenya with the clause 8 mechanism relied upon.
Conditional sub-processors authorised Any party from the conditional list in Annex 3 that the Controller authorises for this engagement, in writing.
Named contacts The Controller's contact for instructions and for breach notification, and the Processor's engagement lead.
Additional controls Any control required beyond Annex 2, under clause 6.4.

Annex 2 — Technical and organisational measures

These are the measures in operation, stated specifically as Article 32 requires. A measure we do not operate is not listed, however ordinary it may be elsewhere — a controller assessing us is better served by a short accurate list than a long aspirational one. Measures marked engagement-dependent exist where the engagement's own infrastructure provides them and are recorded in Annex 1.

AreaMeasure in operation
Transport security All connections to our systems are served over TLS. Plain HTTP is redirected at the web server and no service is offered on an unencrypted port.
Authentication Account passwords are stored only as bcrypt hashes, never reversibly. Sign-in is rate limited. There is no self-registration on any internal system: accounts are created by named leadership posts.
Access control Role-based access on the principle of least privilege, enforced in application code rather than by convention, and covered by an automated test suite that fails the build if a role gains authority it should not have.
Segregation of duties No person may approve their own work. Information security review can halt a release independently of delivery. The Data Protection Officer sits outside delivery, holds no delivery work, and cannot be assigned any.
Auditability State changes to delivery records are written to an append-only activity trail. The application refuses to update or delete an entry, so the record of who accepted what, and when, cannot be edited after the fact.
Change control All source is held in version control. Every change is attributable to a named author, documented before review, and reviewed by someone other than its author before release.
Third-party exposure Our own web properties load no third-party analytics, advertising, content-delivery or error-tracking service. Fonts and assets are served from our own domain, so a visitor's IP address is not disclosed to any third party by these sites as built.
Mail authentication SPF, DKIM and DMARC are published for our sending domain, so mail purporting to come from us can be verified by the receiving system.
Backups A database backup is taken at each release and retained on the host. Backups are covered by clause 10.4. Backup encryption is engagement-dependent and recorded in Annex 1 where the engagement requires it.
Personnel Written confidentiality obligations surviving the end of employment; access granted by named post and withdrawn on the last day; instruction on these obligations recorded before access is given.
Data minimisation in support Production data is not copied to development or test environments unless Annex 1 records it as instructed, with the controls that apply to it.
Encryption at rest Engagement-dependent. Where the engagement's infrastructure provides encryption at rest it is used and recorded in Annex 1. We do not represent it as a general measure across all engagements.
Multi-factor authentication Not yet in operation on our own internal systems. It is listed here because a controller is entitled to know what is absent, and because clause 6.2 requires this annex to state the position as it is.

Annex 3 — Sub-processors

Annex 3 is the register published at https://jiranisokotech.co.ke/legal/sub-processors, as it stands from time to time. It is maintained separately so that a change can be published and notified under clause 7.4 without reopening the signed addendum. The register carries its own version number and change log, and the version in force at signature is recorded in Annex 1.

Execution

This addendum takes effect on signature by both parties, or on the date the engagement contract incorporating it takes effect, whichever is earlier. A copy for signature is available from the engagement desk. Requests and questions about these terms go to privacy@jiranisokotech.co.ke.

For the Processor

Signature
Name
Post
Date

Jiranisoko Market Ltd (PVT-YQ195JQY), acting through its Jiranisoko Tech Solutions division.

For the Controller

Signature
Name
Post
Date

The client named in the engagement contract, as controller of the Personal Data described in Annex 1.