Data Processing Agreement

1. Parties and roles

This Data Processing Agreement (“DPA”) forms part of the agreement between the customer organisation using Rely Finance (“Controller” or “Customer”) and Rely (“Processor” or “Rely”).

Where Rely processes personal data on behalf of Customer in providing the Service, Customer is the data controller (or a processor itself engaging Rely as a sub-processor) and Rely is the data processor, as those terms are used under the Data Protection Act, 2019 (“DPA Act”).

For Rely’s own account, marketing and platform administration data, Rely acts as an independent controller under the Privacy Policy; that processing is outside the scope of this DPA.

2. Definitions

Terms such as personal data, processing, data subject and data protection officer have the meanings in the DPA Act unless defined here. “Customer Personal Data” means personal data contained in Customer Data processed by Rely on Customer’s behalf via the Service. “Sub-processor” means a third party engaged by Rely to process Customer Personal Data.

3. Subject matter, duration, nature and purpose

• Subject matter: hosting and processing Customer Personal Data in a multi-tenant payroll and finance SaaS platform
• Duration: for the term of Customer’s use of the Service plus any post-termination retention period required for deletion workflows, backups or law
• Nature: collection (via Customer input), storage, retrieval, transmission, structuring, erasure and related technical processing
• Purpose: solely to provide, secure, support and maintain the Service on Customer’s documented instructions
• Types of data subjects: Customer’s employees, contractors, users, customers, vendors and other persons whose data Customer submits
• Types of personal data: identity, contact, employment, payroll, financial operations and documents as configured by Customer

4. Customer instructions

Rely will process Customer Personal Data only on documented instructions from Customer, including configuration and use of the Service, unless required by Kenyan law - in which case Rely will inform Customer before processing where legally permitted.

The agreement (including these Terms of Use and product configuration) constitutes documented instructions. Additional instructions must be agreed in writing and may require a change request.

Customer warrants instructions are lawful under the DPA Act and that Customer has provided required notices to data subjects and established a lawful basis for processing (including for any sensitive personal data).

5. Processor obligations

Rely shall:

• Process Customer Personal Data only as instructed and for the Service purpose
• Ensure persons authorised to process are under confidentiality obligations
• Implement appropriate technical and organisational security measures having regard to the state of the art, cost and risk (including unauthorised access, accidental loss and destruction)
• Assist Customer, taking into account the nature of processing, with data subject requests under the DPA Act, insofar as possible via product features or reasonable support
• Assist Customer with security, breach, impact assessment and prior consultation obligations under the DPA Act, taking into account the nature of processing and information available to Rely
• At Customer’s choice and subject to law, delete or return Customer Personal Data after end of Service provision and delete remaining copies except where retention is required by law
• Make available information reasonably necessary to demonstrate compliance with this DPA and allow audits as described below

6. Security measures

Measures may include encryption of data in transit, access control and authentication, environment segregation, logging and monitoring, secure development practices, backup and recovery processes and vendor security review. Customer is responsible for securing its endpoints, user access governance and classification of data it uploads.

7. Personal data breaches

Rely will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and provide information reasonably available to assist Customer to meet its notification duties under the DPA Act. Rely’s notification is not an admission of fault.

8. Sub-processors

Customer authorises Rely to engage Sub-processors for infrastructure, email, monitoring, authentication, payments and similar functions necessary to operate the Service. Rely will impose written data protection terms on Sub-processors no less protective than this DPA in material respects and remains responsible for their performance as required by law.

Rely will provide information about material Sub-processor changes on request or via reasonable notice channels. Customer may object on reasonable data-protection grounds; if unresolved, Customer may terminate the affected Service as its sole remedy.

9. International transfers

Rely will not transfer Customer Personal Data outside Kenya except in accordance with the DPA Act (including any required safeguards or authorisations) and Customer’s instructions as embodied in Service configuration and this DPA.

10. Audits

Upon reasonable written notice, no more than once per twelve months (unless a breach or regulator requires otherwise), Customer may request information or a remote audit of Rely’s relevant controls for Customer Personal Data. Audits must protect other customers’ confidentiality and Rely’s security. Rely may satisfy audit rights by providing up-to-date security summaries, certificates or third-party reports where available.

11. Liability

Liability under this DPA is subject to the limitations and exclusions in the Terms of Use, except to the extent mandatory provisions of the DPA Act require otherwise.

12. Order of precedence

If there is a conflict between this DPA and other terms regarding processing of Customer Personal Data, this DPA prevails. For Rely controller processing, the Privacy Policy prevails.

13. Governing law

This DPA is governed by the laws of Kenya. Acceptance of the Terms of Use or use of the Service by an authorised Customer representative constitutes acceptance of this DPA.

Questions: support@rely.co.ke

Billing: billing@rely.co.ke

Website: https://finance.rely.co.ke