Data Processing Terms

In respect of personal information about a customer's own contacts that the customer enters into KENEK, the customer is the responsible party and KENEK acts as an operator (processor) under POPIA and as controller and processor respectively where comparable applicable law uses those terms. KENEK processes such information only on the customer's documented instructions through the Service.

KENEK will process customer personal information only as necessary to provide the Service and as instructed by the customer through the platform's functionality. Processing covers hosting, storage, retrieval, calculation, communication, support, authorised integrations and deletion for the duration of the service and lawful retention. Data may include names, contact details, job and transaction records, photos, submitted audio and transcripts relating to customers, staff, suppliers and contacts. Do not upload sensitive information unnecessary for the service. KENEK will notify the customer if an instruction appears unlawful and will not follow unlawful instructions. Processing required by law will be notified where legally permitted.

KENEK ensures that personnel authorised to process customer personal information are subject to confidentiality obligations.

KENEK maintains reasonable technical and organisational security measures appropriate to the risk, including access controls and isolation of customer workspaces.

KENEK uses subprocessors (operators) such as hosting, authentication and email providers to deliver the Service. The customer gives general authorisation for necessary subprocessors subject to applicable law. KENEK must require written data-protection obligations appropriate to the processing and remains responsible for their processing obligations to the extent required by law. Contact info@letskenek.co.za for current subprocessor details. Material additions must be notified in advance where required, with an opportunity for a reasonable data-protection objection.

Where subprocessors process data outside South Africa, KENEK must use safeguards required by applicable law, including POPIA and, where applicable, GDPR Chapter V. These terms alone do not establish a lawful transfer mechanism or promise a particular hosting country.

KENEK will notify the customer of a personal-information compromise affecting customer data without undue delay, and will take reasonable steps to assist with any required reporting.

Where a data subject (e.g. one of the customer's clients) makes a request that KENEK receives, KENEK will refer the request to the customer unless law requires otherwise. Taking account of the processing and available information, KENEK will reasonably assist the customer with rights requests, security obligations, impact assessments and regulator consultations required by applicable law. KENEK will make necessary compliance information available and permit proportionate audits as required by law, with safeguards for other customers' data and system security.

Customer personal information is retained for the duration of use and any applicable legal/retention period, after which it may be deleted or anonymised.

On termination, the customer may export its data. At the customer's choice, KENEK will return or delete customer personal information and existing copies as required by applicable law, except information subject to lawful retention. Contact support to arrange the process and timing; retained records remain protected and restricted to the lawful purpose.