E
EvidLens Back to Login

Data Processing Agreement

Last Updated: April 26, 2026 | KDPA 2019 Compliant | Processor: EvidLens Ltd

This DPA forms part of Terms between EvidLens Ltd (“Processor”) and Customer (“Controller”) per Kenya Data Protection Act 2019.

1. Subject & Duration

Processing of Account, Usage, Payment data to provide Decision Intelligence OS. Duration = subscription term + 7 years for tax records.

2. Nature & Purpose

Collection, storage, analysis, AI inference, reporting, payment processing via M-Pesa, email delivery.

3. Types of Personal Data

Name, email, phone, county, sector, IP, device, M-Pesa transaction IDs. No sensitive data per Sec 2 KDPA processed unless explicitly provided.

4. Obligations of Processor

  1. Process only on documented instructions from Controller
  2. Ensure staff confidentiality and 2FA
  3. Implement AES-256 at rest, TLS 1.3 in transit, RBAC, audit logs
  4. Assist Controller with Data Subject Requests within 21 days
  5. Notify breach within 72 hours to dpo@evidlens.co.ke and ODPC
  6. Delete/return data within 30 days of termination except legal hold

5. Sub-Processors

NamePurposeLocation
Render / AWSHosting, PostgresSouth Africa
Safaricom PLCM-Pesa paymentsKenya
Groq IncLLM inferenceUSA - anonymized prompts only
ResendEmail deliveryUSA/EU

All sub-processors under DPA. Customer may object within 14 days.

6. Security Measures - Sec 41 KDPA

Encryption, pseudonymization, VPC isolation, WAF via Cloudflare, daily backups, least-privilege IAM, annual penetration test.

7. Data Transfers

Primary storage South Africa. Where transfer outside Kenya required (AI, email), we apply adequacy safeguards and anonymization per Sec 49 KDPA.

8. Audit Rights

Controller may audit once per year with 30 days notice. Processor provides SOC2 report and ODPC registration cert.

9. Contact

DPO: dpo@evidlens.co.ke • Legal: info@evidlens.co.ke • Address: Kimathi House, 2nd Floor, Nyeri 10100

Sign & Return

For Enterprise & Government procurement, signed DPA available on request. Email dpo@evidlens.co.ke with subject: SIGNED DPA REQUEST - [Company Name]

© 2026 EvidLens Ltd • Privacy • Terms