Legal · DPA 2019 · Controller–Processor

Data Processing Agreement

Last updated: October 2026 · Applies to kazily, a product of GRSL Recruitment Ltd, Nairobi, Kenya

The short version: your agency is the controller, kazily is the processor. We process only on your instructions, sub-processors are listed openly, breaches are reported within 72 hours, and audits are welcome.

1. Purpose and roles

This Data Processing Agreement ("DPA") forms part of the kazily Terms of Service. For candidate data processed in your workspace: the Agency is the Data Controller; GRSL Recruitment Ltd is the Data Processor, processing only on your documented instructions. Both parties are registered with the ODPC as required by the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.

2. Subject matter, duration, nature

Item	Detail
Subject matter	Candidate, client-contact and user data processed in the kazily ATS
Duration	The subscription term, plus the 90-day post-cancellation archive window
Nature of processing	Storage, structuring, transmission (stage emails, client portal, job-board syndication), scoring, reporting, deletion
Data subjects	Job candidates, agency recruiters, client contacts
Special categories	Only where a role lawfully requires them and explicit consent is recorded (e.g. disability accommodation, work-permit status)

3. Processor obligations

Process personal data only on the Controller's documented instructions, including this DPA and in-product actions.
Ensure staff are bound by confidentiality and trained on the DPA annually.
Maintain the technical and organisational measures in Annex I (below).
Assist the Controller with data-subject requests (access, correction, deletion, portability) via self-serve tools, or manually within 10 business days.
Notify the Controller of any personal-data breach without undue delay and within 72 hours, with the information the Controller needs for its own ODPC notification.
Make available audit information demonstrating compliance, and allow audits (remote, once yearly, on 14 days' notice).
On termination, return and then delete Controller data per the schedule in the Terms of Service, save for statutory retention (tax records, consent logs).

4. Sub-processors

Sub-processor	Function	Location
Cloud hosting provider	Infrastructure, database, backups	Cloud region serving Kenya
SMTP / email delivery	Stage feedback and system email	As configured by the Agency
Google / Microsoft / Apple / CalDAV	Calendar sync (only when connected)	Global, safeguarded contracts
WhatsApp Business (Meta)	Candidate messaging (only when enabled)	Global, safeguarded contracts
Postiz	Social posting of job ads (no candidate data)	As configured

We give 14 days' notice of new sub-processors via the platform admin notice; the Controller may object on reasonable data-protection grounds.

5. International transfers

Transfers outside Kenya occur only to sub-processors above, under contracts incorporating appropriate safeguards per DPA s.48–49, and never for candidate data beyond what the enabled integration requires.

6. Annex I — Security measures

TLS 1.2+ in transit; AES-256 at rest; encrypted daily backups with 30-day retention.
Workspace-level data segregation; role-based access with per-user credentials; lead-recruiter approval gate for record deletion.
Immutable audit log of stage changes, messages, exports, consent signatures (with IP and wording version) and deletion approvals.
Annual third-party penetration test; vulnerability patching SLA of 72 hours for critical issues.
Access to production data restricted to named engineers under NDA, logged and reviewed quarterly.

7. Signatures

This DPA is accepted electronically when a workspace is created or upgraded; an executed PDF copy is available on request from ops@kazily.africa.