1. Definitions

Capitalized terms used in this DPA shall have the meanings set out in the Kenya Data Protection Act, 2019 ("KDPA"), the General Data Protection Regulation ("GDPR"), and the Master Services Agreement ("Agreement").

2. Scope of Processing & Documented Instructions

2.1. Processing Solely on Documented Instructions: Processor shall process Church Personal Data solely on documented instructions from Controller (including with respect to transfers of personal data to a third country or international organization), unless required to do so by applicable law to which Processor is subject. In such a case, Processor shall inform Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

2.2. Notice of Infringing Instructions: Processor shall immediately notify Controller if, in its opinion, an instruction infringes the KDPA, the GDPR, or other applicable data protection laws.

3. Confidentiality Obligations

3.1. Processor ensures that persons authorized to process the Personal Data have committed themselves to strict confidentiality or are under an appropriate statutory obligation of confidentiality.

4. Technical and Organizational Security Measures (TOMs)

4.1. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing (including the ecclesiastical and sensitive nature of religious affiliation records), Processor shall implement and maintain the Technical and Organizational Measures set out in Annex 2 to ensure a level of security appropriate to the risk.

4.2. In evaluating the appropriate level of security, Processor considers the risks of accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise processed.

5. Authorized Sub-Processors

5.1. Controller provides general written authorization to Processor to engage Sub-processors. The current approved Sub-processors are:

• Safaricom PLC: M-Pesa Daraja Payment API (Nairobi, Kenya);
• Africa's Talking Limited / MSpace Solutions: Transactional SMS broadcasting gateway (Nairobi, Kenya);
• Cloud Infrastructure Providers: Bare-metal tier-3 hosting providers with enterprise firewall isolation.

5.2. Where Processor engages a Sub-processor, Processor shall impose data protection obligations no less onerous than those in this DPA. Processor remains fully liable to Controller for the performance of the Sub-processor's obligations.

6. Assistance with Data Subject Rights Requests

6.1. Taking into account the nature of processing, Processor shall assist Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Controller's obligation to respond to requests for exercising Data Subject rights under Part IV of the KDPA and Chapter III of the GDPR (including rights of access, rectification, erasure, and portability).

7. Personal Data Breach Notification (48 Hours)

7.1. Processor shall notify Controller without undue delay and in any event within forty-eight (48) hours after becoming aware of a confirmed Personal Data Breach affecting Church Personal Data.

7.2. The notification shall contain at least: (a) description of the nature of the breach; (b) categories and approximate numbers of data subjects concerned; (c) contact details of the Data Protection Officer; (d) likely consequences of the breach; and (e) remediation measures taken or planned.

8. Return and Deletion of Personal Data

8.1. At the choice of Controller, Processor shall delete or return all Personal Data to Controller after the end of the provision of services relating to processing, and delete existing copies unless applicable law requires continued storage.

9. Audits and Inspections

9.1. Processor shall make available to Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA, and allow for and contribute to audits, including inspections, conducted by Controller or an independent auditor mandated by Controller, upon reasonable advance notice during standard business hours.

Annex 1: Description of Processing Activities

• Categories of Data Subjects: Church members, congregants, communicants, catechumens, visitors, children in Sunday School, tithe contributors, church ministers, and clergy.
• Categories of Personal Data: Names, contact details, tithe amounts, attendance check-in timestamps, ministry registrations, prayer requests, matrimonial register records, bereavement records.
• Special Categories: Religious beliefs and church affiliation (processed under Section 45 KDPA and Article 9(2)(d) GDPR).
• Duration of Processing: Duration of Church subscription plus statutory retention for financial audits.

Annex 2: Technical and Organizational Measures (TOMs)

• Cryptographic Safeguards: TLS 1.3 encryption in transit with forward secrecy; AES-256 encryption at rest for sensitive keys and credentials.
• Tenant Isolation: Logical schema isolation preventing multi-tenant data contamination.
• Access Control: Granular Role-Based Access Control (RBAC) separating administrative, pastoral, treasury, and congregant permissions.
• Disaster Recovery: Real-time hot-standby replication between primary and secondary failover server nodes with automated HMAC health checks.
• Audit Logging: Comprehensive audit logs tracking user authentications, export events, and administrative profile modifications.