Data Processing Terms

Last updated: 16 October 2026. Items in [[double square brackets]] must be completed, and this document reviewed by a Kenyan advocate, before publication.

These terms form part of the Agreement between OurPay ("Processor") and the Client ("Controller") and apply to personal data the Processor handles for the Controller. They are intended to meet the requirements of the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, and the equivalent laws of Uganda, Tanzania and Rwanda where they apply.

1. Roles

The Client is the data controller and OurPay is the data processor. OurPay processes personal data only on the Client's documented instructions, which are the Agreement and the Client's reasonable written instructions for each payroll cycle, unless the law requires otherwise. OurPay will tell the Client if it believes an instruction breaches data protection law.

2. Details of processing

3. Confidentiality

Only specialists assigned to the Client's account may access its payroll data. Each signs a confidentiality agreement before starting work on the account, and access is limited to what they need.

4. Security measures

OurPay applies appropriate technical and organisational measures. These include: segregation of each client's data from other clients' data; access limited to assigned specialists, with the Client controlling who may approve and see what on its side; a secure intake route for salary and personal data, separate from website forms; and [[ADD CONFIRMED TECHNICAL MEASURES, e.g. encryption in transit and at rest, access logging, backups, MFA]].

5. Sub-processors

The Client gives general authorisation for the sub-processors listed in Annex A. OurPay will give the Client at least [[14]] days' notice of any addition or replacement, and the Client may object on reasonable data protection grounds. OurPay stays responsible for its sub-processors and will bind them to terms no less protective than these.

6. Data subject requests

OurPay will pass any request it receives from an employee to the Client promptly and will not respond except on the Client's instructions. OurPay will give reasonable help so the Client can meet its obligations on access, correction, deletion and portability.

7. Personal data breaches

OurPay will notify the Client without undue delay and in any event within [[48]] hours of becoming aware of a breach affecting the Client's personal data, with the information then available, and will cooperate in investigation, containment and any notification the Client must make to the Office of the Data Protection Commissioner or data subjects.

8. Assistance

OurPay will reasonably help the Client with data protection impact assessments and consultations with regulators where they relate to this processing.

9. International transfers

OurPay will process personal data in the countries where the Client's employees are located and in [[LOCATIONS OF HOSTING / SUB-PROCESSORS]]. Any transfer out of those countries will be made only where the applicable law permits it and with the safeguards it requires.

10. Return and deletion

On termination, OurPay will return the Client's payroll records in an agreed format and then delete the personal data within [[60]] days, unless a law requires OurPay to keep it, in which case it will keep it only as long as required and protect it under these terms. Payroll records are otherwise retained as long as statutory record-keeping rules in each country require.

11. Audits

OurPay will make available the information needed to show compliance with these terms and will allow reasonable audits by the Client or its appointed auditor, on [[30]] days' notice, during business hours, and subject to confidentiality.

12. Client obligations

The Client confirms it has a lawful basis and has given employees any required notices for OurPay to process their data, and will register as a controller where the law requires.

Annex A - Sub-processors