Data processing agreement

Version 2026-09-22 · Last updated 22 September 2026

This agreement is between:

• the Customer: the landlord, owner or managing agent whose organisation uses Lease Lion, and who accepts this agreement in the app. The Customer is the data controller.
• the Provider: the operator of Lease Lion. The Provider is the data processor.

It forms part of the terms under which the Customer uses Lease Lion. If this agreement and those terms conflict on the handling of personal data, this agreement prevails.

1. Definitions

Words such as personal data, data subject, processing, data controller, data processor and personal data breach have the meanings given in the Data Protection Act, 2019 (the Act) and its regulations. Customer Data means personal data the Provider processes for the Customer through Lease Lion. Sub-processor means another processor the Provider engages to process Customer Data.

2. What is processed and why

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1. The Provider processes Customer Data only to provide Lease Lion to the Customer, and for no other purpose.

3. The Provider's obligations

The Provider will:

1. Follow instructions. Process Customer Data only on the Customer's documented instructions. The Customer's use and configuration of Lease Lion (including its retention settings) are its instructions. If the Provider believes an instruction breaks the Act, it will say so.
2. Keep it confidential. Ensure that everyone it authorises to access Customer Data is bound by confidentiality, and gives access only where needed.
3. Keep it secure. Maintain the technical and organisational measures in Annex 2, and improve them as risks and technology change, so the level of security is not reduced.
4. Use sub-processors only as agreed. The Customer authorises the sub-processors in Annex 3. The Provider will give at least 30 days' notice in the app or by email before adding or replacing one. The Customer may object on reasonable data protection grounds; if the parties cannot resolve it, the Customer may end the subscription without penalty. The Provider will bind each sub-processor to data protection terms at least as protective as these, and remains responsible for them.
5. Help with requests from data subjects. Provide tools, and reasonable further help, so the Customer can respond to people exercising their rights under the Act (s.26): finding a person's records, exporting a copy and erasing them. If a request reaches the Provider directly, it will pass it to the Customer without undue delay and will not respond itself unless the Customer asks.
6. Report breaches quickly. Tell the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Data, so the Customer can notify the Data Commissioner within the 72 hours the Act requires (s.43). The notice will describe what happened, the data and people likely affected, the likely consequences and the steps taken, and the Provider will update it as more becomes known.
7. Help with assessments. Give reasonable help with data protection impact assessments (s.31) and consultations with the Data Commissioner that relate to Lease Lion.
8. Transfer data abroad only with safeguards. Where Customer Data is transferred out of Kenya (see Annex 3), do so only in line with the Act (ss.48–50), under contracts that require appropriate safeguards.
9. Delete at the end. When the Customer's subscription ends, keep Customer Data available for export for 30 days, then delete it, including from active backups within a further 90 days, unless the law requires it to be kept.
10. Show compliance. Make available the information reasonably needed to demonstrate compliance with this agreement, and allow audits by the Customer or an auditor it appoints, no more than once a year, with 30 days' notice, during business hours, at the Customer's cost, and subject to confidentiality.

4. The Customer's obligations

The Customer will:

1. Have a lawful basis for the processing it instructs, and use Lease Lion in line with the Act.
2. Tell data subjects how their data is used. Lease Lion provides a privacy notice, and asks residents to confirm they have told their guests. The Customer should also display a notice at each gate.
3. Set retention periods no longer than it needs, and keep the information it enters accurate.
4. Register with the Office of the Data Protection Commissioner where the Act requires it (s.18).
5. Handle data-subject requests and notify the Data Commissioner and affected people of breaches where the Act requires.
6. Keep its staff's sign-in details secure and remove access promptly when someone leaves.

5. Liability

Each party's liability under this agreement is subject to the limits in the terms under which the Customer uses Lease Lion. [For legal review: set the liability cap and any carve-outs.]

6. Term

This agreement applies for as long as the Provider processes Customer Data, and its deletion and confidentiality obligations survive its end.

7. Law

This agreement is governed by the laws of Kenya. The courts of Kenya have jurisdiction over any dispute.

Annex 1: Details of the processing

Annex 2: Security measures

• Separation: each customer's data is logically separated; every request is authorised on the server against the user's organisation and role.
• Encryption: all traffic is encrypted with TLS; data is encrypted at rest by the hosting providers; national ID and passport numbers are additionally encrypted with AES-256-GCM using a key held outside the database.
• Gate codes: QR tokens and PINs are stored only as salted one-way hashes; QR codes carry an opaque, expiring token and no personal data.
• Minimisation: guards' live screens do not carry ID numbers; a pass link shows only the last four digits of an ID; the fields a resident fills in are optional unless the estate requires them.
• Access control: sign-in through a dedicated identity provider; role-based permissions; staff logins can be reset and sessions revoked at once.
• Accountability: an append-only, time-stamped audit trail of every change, and a log of every data-subject request.
• Retention: an automatic nightly job removes ID numbers, anonymises and finally deletes records on the Customer's schedule.
• Abuse protection: rate limits on scanning, booking, payments and alerts.
• Web security: strict transport security, content security policy and anti-framing headers.
• People: access to production data is limited to named personnel who need it, under confidentiality obligations.
• Incidents: a documented breach-response procedure (detect, contain, assess, notify, review).

Annex 3: Sub-processors