Data processing terms
How we handle the personal data you keep in our software — the agreement required by section 42 of the Data Protection Act, 2019.
1. Roles
These terms apply when Webresource Hub Ltd (the processor) hosts or runs software for a client (the controller) and that software holds personal data — for example customers, learners and parents, members, patients or staff. They form part of our terms of service and any proposal or contract we sign with you. Where a signed agreement says otherwise, the signed agreement wins.
2. Only on your instructions
We process your personal data only to provide, support and secure the service you ordered, and otherwise only on your documented instructions. We tell you if we believe an instruction breaks the law. We never sell it, use it for our own purposes or use it to train AI models.
3. Confidentiality
Only staff who need access to support or maintain your system may see your data, and all of them are bound to confidentiality.
4. Security
We protect your data with measures suited to the risk (s.41): encrypted connections, separate databases per client, role-based access, hashed passwords, audit logs, regular backups and prompt security updates. Children's and other sensitive data receive the same protection as the most sensitive data we hold.
5. Sub-processors
We use a small number of providers to run the service — mainly hosting, email, SMS and payment processors — each bound by terms that protect your data. We keep a list and will tell you before adding or replacing one, so you can object. Where data is held outside Kenya, we rely on the safeguards in sections 48–50 of the Act.
6. Helping you meet your duties
We help you answer requests from the people whose data you hold (access, correction, deletion, portability), carry out impact assessments, and answer the Data Protection Commissioner. If someone sends such a request to us directly, we pass it to you promptly.
7. Breaches
If we become aware of a breach affecting your data, we tell you within 48 hours, with what we know: what happened, the data and people affected, the likely consequences and what we are doing. This lets you notify the Commissioner within the 72 hours the Act requires.
8. When the service ends
We give you a full export of your data on request and, 90 days after the service ends, delete it from our systems and backups unless the law requires us to keep it. We confirm deletion in writing on request.
9. Information and audits
We give you the information you need to show that these terms are met and allow reasonable audits, with reasonable notice and at reasonable times.
10. Contact
Data protection questions: info@webresourcehub.com. To sign these terms as a separate agreement, ask your account manager.