Data Processing Agreement

This Data Processing Agreement (the “DPA”) applies between Mobile Enterprises (Pty) Ltd t/a M.E Smart Communications (the “Processor”) and each client of KYC.me.co.bw (the “Controller”) whenever the Processor processes personal data on the Controller’s behalf through the Platform. It forms part of, and is incorporated into, the Terms of Service, and is intended to satisfy the written processing-agreement requirements of the Botswana Data Protection Act, 2024 (Act No. 18 of 2024).

1. Subject matter, duration, nature and purpose

Subject matter: provision of the KYC.me.co.bw KYC/KYB verification service.
Duration: the term of the Controller’s subscription, plus any retention or deletion period described in this DPA.
Nature and purpose: hosting campaign forms, verifying respondents’ mobile numbers by SMS OTP, storing submitted identity data and documents, and making them available to the Controller for review and export.
Categories of data subjects: the Controller’s customers, prospective customers, members, students, employees or other individuals the Controller invites to a campaign.
Categories of personal data: identity data (names, date of birth, Omang/passport numbers), contact data (mobile, email, addresses), photographs/selfies, identity and proof-of-address documents, consent records, and technical metadata (IP address, user agent, timestamps).
Special categories: campaign configuration may cause collection of sensitive data; the Controller is responsible for having a lawful basis for any such collection.

2. Processor obligations

The Processor will:

Process personal data only on the Controller’s documented instructions, including as configured through the Platform, unless Botswana law requires otherwise (in which case we will inform you unless prohibited).
Ensure persons authorised to process the data are bound by confidentiality.
Implement the technical and organisational measures described in our Security Policy, including TLS encryption in transit, hashed credential storage, role-based access control, and audit logging.
Assist the Controller, taking into account the nature of processing, in responding to data subject requests (access, rectification, erasure, restriction, objection, portability).
Assist the Controller in meeting its obligations regarding security, breach notification and data protection impact assessments, to the extent the assistance is reasonable and within our control.
Make available information reasonably necessary to demonstrate compliance with this DPA.

3. Controller obligations

The Controller warrants that it has, and will maintain, a lawful basis for the collection and processing of respondent data, will provide all required notices to respondents, and that its instructions to the Processor comply with the DPA and other applicable law.

4. Sub-processors

The Controller authorises the use of the following categories of sub-processors:

SMS gateway infrastructure — delivery of OTP messages (mobile numbers only).
Hosting/infrastructure providers — servers, storage and backups.
Email delivery provider — transactional email (Google SMTP).
Analytics (optional, consent-based) — Google Analytics, only where the data subject has consented via the cookie banner.

Optional add-ons such as AI-assisted document reading are engaged only at the Controller’s request and will be disclosed before activation. We will notify the Controller of any intended new sub-processor, giving the Controller the opportunity to object on reasonable data protection grounds. We remain fully liable for our sub-processors’ performance of their data protection obligations.

5. International transfers

Where processing involves transfer of personal data outside Botswana (for example offshore data centres or email/analytics providers), the Processor will ensure appropriate safeguards are in place as required by the DPA, including contractual protections with recipients.

6. Personal data breach notification

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, and will provide reasonable information and cooperation so the Controller can meet its own obligations to notify the Information and Data Protection Commission (IDPC) and affected data subjects within the timeframes required by law.

7. Deletion and return of data

During the subscription, the Controller may export its data (CSV) at any time.
On termination, at the Controller’s choice communicated within 30 days, the Processor will return or delete the Controller’s campaign data, unless retention is required by Botswana law.
Residual copies in backups are deleted on the normal backup cycle (no later than 30 days), and audit logs are retained per the Data Retention Policy.

8. Audits

The Processor will allow and contribute to reasonable audits, including inspections conducted by the Controller or an auditor it mandates, subject to reasonable notice, confidentiality, and no more than once per 12-month period unless a breach or regulator request justifies otherwise. The Processor may satisfy audit requests through written responses, documentation, and third-party reports where available.

9. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms of Service. If there is a conflict between this DPA and the Terms on the subject of data protection, this DPA prevails.

10. Governing law

This DPA is governed by the laws of the Republic of Botswana, and the courts of Botswana have exclusive jurisdiction.

Questions about this DPA: [email protected].