Data Processing Addendum

1. Introduction

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other agreement between Call Center Solutions Africa ("we," "us," "our," or "Processor") and you ("you," "your," or "Controller") governing the processing of personal data in connection with our services.

This DPA sets out the terms and conditions under which we will process personal data on your behalf in compliance with applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR), the Kenya Data Protection Act, and other applicable data protection legislation.

2. Definitions

• "Controller" means the entity that determines the purposes and means of the processing of personal data.
• "Processor" means the entity that processes personal data on behalf of the Controller.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• "Data Protection Laws" means all applicable laws and regulations relating to the processing, privacy, and use of personal data.
• "Data Subject" means the natural person to whom the personal data relates.

3. Scope and Purpose of Processing

We will process personal data on your behalf solely for the purpose of providing our call center and customer service solutions as described in our service agreement. The types of personal data we may process include:

• Customer contact information (names, email addresses, phone numbers)
• Customer service interaction records
• Account and billing information
• Any other personal data you provide to us in connection with our services

We will not process personal data for any purpose other than those specified in our service agreement or as instructed by you, except where required by applicable law.

4. Our Obligations as Processor

We agree to:

• Process personal data only in accordance with your documented instructions, unless required by applicable law
• Ensure that persons authorized to process personal data are subject to appropriate confidentiality obligations
• Implement and maintain appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage
• Assist you in responding to requests from data subjects to exercise their rights under applicable data protection laws
• Notify you without undue delay if we become aware of a personal data breach
• Assist you in ensuring compliance with your obligations under applicable data protection laws
• Make available to you all information necessary to demonstrate compliance with this DPA

5. Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit and at rest
• Regular security assessments and vulnerability testing
• Access controls and authentication mechanisms
• Employee training on data protection and security
• Incident response and breach notification procedures
• Regular backups and disaster recovery procedures
• Physical security measures for our facilities

6. Sub-Processors

We may engage sub-processors to assist in providing our services. We will:

• Inform you of any intended changes concerning the addition or replacement of sub-processors
• Ensure that any sub-processor is bound by data protection obligations that are substantially similar to those set out in this DPA
• Remain fully liable for the performance of sub-processors under this DPA

If you object to our use of a sub-processor, you may terminate the relevant service agreement in accordance with its terms.

7. Data Subject Rights

We will assist you in responding to requests from data subjects to exercise their rights under applicable data protection laws, including:

• Right of access to personal data
• Right to rectification of inaccurate personal data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing

We will provide reasonable assistance to enable you to respond to such requests within the timeframes required by applicable law.

8. Data Breach Notification

In the event of a personal data breach, we will:

• Notify you without undue delay after becoming aware of the breach
• Provide you with all relevant information about the breach, including the nature of the breach, categories of data affected, and number of data subjects concerned
• Assist you in meeting your obligations to notify supervisory authorities and data subjects, where required
• Take reasonable steps to mitigate the effects of the breach

9. International Data Transfers

If we transfer personal data outside the European Economic Area (EEA) or other jurisdictions with data protection laws, we will ensure that appropriate safeguards are in place, such as:

• Standard contractual clauses approved by relevant authorities
• Adequacy decisions by relevant authorities
• Other legally recognized transfer mechanisms

10. Return or Deletion of Data

Upon termination of our services or upon your request, we will:

• Return all personal data to you in a structured, commonly used, and machine-readable format, or
• Delete all personal data, unless we are required by applicable law to retain it

We will complete the return or deletion within 30 days of termination or your request, unless a longer retention period is required by applicable law.

11. Audits

We will make available to you all information necessary to demonstrate compliance with this DPA. You may conduct audits or inspections of our data processing activities, subject to:

• Reasonable advance notice (at least 30 days)
• Confidentiality obligations
• Limitation to business hours
• Your bearing the costs of such audits

12. Contact Us

If you have any questions about this Data Processing Addendum, please contact us at:

Email: hello@callcentersolutionsafrica.com

Address: 7th floor, Mitsumi Business Park, Nairobi, Kenya