Data Processing Agreement
The terms under which Zorvetska processes personal data on behalf of our customers as a data processor.
Effective 6 September 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between Zorvetska Limited (“Zorvetska”, “Processor”) and the customer (“Controller”) that governs the processing of personal data by Zorvetska in the course of providing its products and services, including FinSight, BuzSight AI, and the Zorvetiq suite of applications.
This DPA reflects the requirements of the Kenya Data Protection Act, 2019 and, where applicable, international standards such as the EU General Data Protection Regulation (GDPR). Where a signed, negotiated DPA exists between the parties, that document prevails over this online version.
1. Roles of the Parties
The Controller determines the purposes and means of processing personal data. Zorvetska acts as a Processor, processing personal data only on the documented instructions of the Controller, except where required to do otherwise by applicable law.
2. Scope and Purpose of Processing
- Subject matter: provision of the Zorvetska products and services subscribed to by the Controller.
- Duration: for the term of the underlying service agreement and any agreed retention period thereafter.
- Nature and purpose: hosting, storage, analysis, reporting, and support related to the services.
- Types of data: business contact details, account and usage data, and any data the Controller uploads or configures.
- Categories of data subjects: the Controller’s employees, customers, suppliers, and other individuals whose data the Controller processes through the services.
3. Processor Obligations
- Process personal data only on the Controller’s documented instructions.
- Ensure persons authorised to process personal data are bound by confidentiality.
- Implement appropriate technical and organisational security measures.
- Assist the Controller in responding to data subject rights requests.
- Assist the Controller with security, breach notification, and impact assessment obligations.
- Delete or return personal data at the end of the services, subject to legal retention requirements.
4. Sub-processors
The Controller provides general authorisation for Zorvetska to engage sub-processors to support the delivery of the services. A current list of sub-processors is maintained in our Sub-processor Register. We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance.
5. Security Measures
Zorvetska maintains technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These measures are described in our Security & Data Protection Policy.
6. International Transfers
Where personal data is transferred outside Kenya, Zorvetska ensures an appropriate legal basis and safeguards are in place, consistent with the Kenya Data Protection Act, 2019 and applicable regulations.
7. Personal Data Breach
Zorvetska will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, and will provide reasonable information and cooperation to help the Controller meet its own notification obligations.
8. Audit and Compliance
Zorvetska will make available to the Controller information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, subject to reasonable confidentiality and security safeguards.
9. Return and Deletion of Data
Upon termination of the services, Zorvetska will, at the Controller’s choice, delete or return personal data, and delete existing copies unless retention is required by applicable law. Details are set out in our Data Retention Policy.
10. Contact
For questions regarding this DPA or to request a signed copy, contact our team at [email protected] or [email protected].