1. Roles
MintGen Labs & Infusion Jaba (JabaGraba) is the Data Controller. The Partner is a Data Processor acting on JabaGraba's documented instructions for the personal data shared with them for order fulfilment.
2. Scope of processing
- Subject matter: preparation, packaging and hand-over of JabaJuice orders.
- Data subjects: JabaGraba customers.
- Categories of data: name, phone, order contents, delivery address, order notes.
- Duration: only for as long as needed to fulfil each order.
3. Partner obligations
- Process personal data only on JabaGraba's instructions and to fulfil the order.
- Keep the data confidential; limit access to staff who need it.
- Apply reasonable technical and organisational security measures.
- Not transfer data outside Kenya without written approval and adequate safeguards.
- Assist JabaGraba in responding to data subject requests and regulator queries.
- Notify JabaGraba within 48 hours of any suspected personal data breach.
- Delete or return data at the end of the engagement, except where retention is required by law.
4. Sub-processors
The Partner may not engage sub-processors to handle JabaGraba customer data without JabaGraba's prior written approval.
5. Audits
JabaGraba may audit the Partner's compliance with this DPA on reasonable notice, no more than once per year unless a breach has occurred.
6. Governing law
This DPA is governed by the laws of Kenya and complies with the Kenya Data Protection Act, 2019.
7. Contact
Data protection queries: help@jabagrabba.com.