Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service (/legal/terms-of-service) between Ustawi ("Processor", "Ustawi") and the Customer identified in the applicable order form ("Controller"), and applies where Ustawi processes Personal Data on Controller's behalf in connection with the Service.

"Personal Data," "Processing," "Controller," "Processor," "Sub-processor," "Data Subject," and "Personal Data Breach" have the meanings given in Tanzania's Personal Data Protection Act, 2022. These terms are used here consistently with the definitions in that Act (indicative reference — the specific defining provisions should be confirmed against the Act as enacted).

Controller is the data controller for all Personal Data of its borrowers, guarantors, employees, and agents processed via the Service (each tenant is itself a regulated financial institution or employer and determines the purposes of processing). Ustawi is the data processor, processing Personal Data solely on Controller's documented instructions, which include the instructions embedded in Controller's own platform configuration (e.g. which apps are enabled, what data fields are collected).

Subject matter: provision of the Ustawi microfinance platform. Duration: for the term of the underlying Terms of Service, plus the data-return/deletion window in Section 10. Nature of processing: collection, storage, retrieval, structuring, and secure transmission of Personal Data within the platform's per-tenant isolated database. Categories of data subjects: borrowers, guarantors, collateral owners, Controller's staff and field agents. Categories of Personal Data: identity/KYC data, financial/loan data, AML screening results, insurance data, payroll/check-off data, device and location data captured by the mobile field-collection app — as further described in the Privacy Policy (/legal/privacy-policy). Purpose: to provide, maintain, and support the Service as described in the Terms of Service.

Ustawi will: (a) process Personal Data only on Controller's documented instructions, including regarding cross-border transfers, unless required otherwise by law; (b) ensure personnel authorized to process Personal Data are bound by confidentiality; (c) implement the technical and organizational security measures set out in Annex 2 (see /legal/security-and-data-protection-statement for the full statement) — including per-tenant database isolation and role- and branch-scoped access controls; (d) assist Controller in responding to data subject rights requests; (e) assist Controller in meeting its own data-breach notification and data-protection-impact-assessment obligations; (f) make available information necessary to demonstrate compliance with this DPA.

Ustawi may engage sub-processors listed at /legal/sub-processors to help deliver the Service. Ustawi will: notify Controller of any intended addition or replacement of a sub-processor with at least 30 days' notice, giving Controller the opportunity to object on reasonable data-protection grounds; and impose data-protection obligations on each sub-processor no less protective than this DPA.

Where Personal Data is transferred outside Tanzania (e.g. to a cloud hosting or sub-processor location), Ustawi will ensure an appropriate transfer mechanism is in place. Ustawi's primary hosting is within the East Africa region; where a sub-processor processes data outside Tanzania, Ustawi relies on a transfer mechanism permitted under the Personal Data Protection Act, 2022 (such as standard contractual clauses or Controller's documented authorisation) and identifies the relevant jurisdictions in the sub-processor list at /legal/sub-processors.

Summarized here with a cross-reference to the full statement at /legal/security-and-data-protection-statement; Annex 2 lists, at minimum: per-tenant database-level isolation, encrypted document storage for KYC files/signed agreements/collateral evidence, role- and branch-scoped access controls, device-trust/device-binding for staff and field-agent authentication, full audit logging of sensitive actions, and dual-control (maker-checker) approval on sensitive role grants.

Ustawi will notify Controller without undue delay, and in any case within 72 hours of becoming aware of a Personal Data Breach affecting Controller's data, providing sufficient information to allow Controller to meet its own regulatory notification obligations, including any applicable Suspicious Transaction Report or other statutory clock.

Controller may request evidence of Ustawi's compliance with this DPA (e.g. security certifications, audit summaries) no more than once in any 12-month period, and, where reasonably necessary and subject to confidentiality safeguards, conduct or commission an on-site or remote audit with reasonable advance notice.

On termination of the Service, Ustawi will, at Controller's election, return or delete all Personal Data within 30 days, except where retention is required by applicable law (e.g. AML/audit record-keeping obligations), in which case Ustawi will continue to protect the retained data and limit processing to the retention purpose only.

Each party's liability under this DPA is subject to the limitation of liability provisions in the Terms of Service (/legal/terms-of-service), except as otherwise required by applicable data protection law.

Annex 3 — Approved Sub-processors: see the live, current list at /legal/sub-processors (not duplicated here to avoid drift between the two pages).