Data processing agreement
How mfileads processes personal data on behalf of the institutions that use it.
Last updated 2 November 2026
This agreement forms part of the terms of service between mfileads (the “processor”) and each institution using mfileads (the “controller”). It reflects the requirements of Kenya’s Data Protection Act 2019 and comparable laws including Uganda’s Data Protection and Privacy Act, Nigeria’s NDPA 2023, Ghana’s Data Protection Act, South Africa’s POPIA and the EU GDPR.
1. Subject matter
The processor stores and processes personal data of the controller’s prospects, members and staff to provide lead management software. Categories of data: names, phone numbers, e-mail addresses, location, occupation, product interest, requested amounts, income bands, notes, consent records and message history. Sensitive categories (health, religion, ethnicity, biometrics) must not be stored.
2. Instructions
The processor processes personal data only on the controller’s documented instructions, which are given through the use and configuration of the service.
3. Confidentiality and security
Staff with access are bound by confidentiality. The processor maintains the technical and organisational measures described on its security page, including isolation between institutions, role-based access, encryption in transit, rate-limited sign-in and audit logging.
4. Sub-processors
The processor uses hosting, e-mail delivery and, where the controller enables SMS, Africa’s Talking (Africa) or Twilio (elsewhere). The processor will inform controllers of changes to sub-processors.
5. Data-subject rights
The service lets the controller export a person’s data and erase it permanently. The processor will assist with requests it receives directly by forwarding them to the controller.
6. Breaches
The processor will notify the controller without undue delay, and in any case within 48 hours, after becoming aware of a personal-data breach affecting the controller’s data.
7. Deletion
When a workspace is deleted by the controller, its data is deleted immediately; when a subscription ends, within 30 days, except where law requires retention.
8. Transfers
Where data is processed outside the controller’s country, the processor relies on appropriate safeguards as required by applicable law.