Data Processing Agreement (DPA)

Tenari — by InfraWatchKenya · under the Data Protection Act, 2019 (Kenya) · Last updated: 23 September 2026

In short: when your organisation uses Tenari, you decide what tenant/guest/owner data to enter (you are the data controller) and Tenari processes it only to run the service on your instructions (we are the data processor). This DPA sets out how we protect that data, who our sub-processors are, and what happens to the data when you leave. It applies across all seven Tenari plans — Rentals, Service Charge, Utilities, Hotel & Resort, Hotel Lite, Furnished Apartments and Short Stay / Airbnb — and any future plans, features, integrations or markets.

1. Parties & roles

This Agreement is between the subscribing organisation ("Customer / Controller") and InfraWatchKenya, operator of Tenari ("Processor"). It forms part of, and is governed by, the Tenari Terms of Service and Privacy Policy. For account and website data, InfraWatchKenya is the controller; for the customer records described below, the Customer is the controller and InfraWatchKenya is the processor.

2. Subject-matter & details of processing

Item	Detail
Subject-matter	Processing personal data to provide the Tenari property & hospitality management service.
Duration	For the term of the Customer's subscription, plus any legally required retention period.
Nature & purpose	Storing, organising, computing, transmitting receipts/reminders/notices, reconciling payments, and generating statements — as instructed by the Customer through the app.
Categories of data subjects	The Customer's tenants, owners, guests, clients, staff and contacts.
Categories of personal data	Names, phone numbers, emails, unit/lease/booking details, payment records and balances, communications. No special-category (sensitive) data is intended.

3. Processor obligations

Instructions: process personal data only on the Customer's documented instructions (which include normal use of the app), except where law requires otherwise.
Confidentiality: ensure personnel with access are bound by confidentiality.
Security: implement appropriate technical and organisational measures — TLS in transit, access controls, row-level tenant isolation, hashed passwords, least-privilege access.
Data-subject requests: assist the Customer to respond to access, correction, deletion, restriction, objection and portability requests.
Breach notification: notify the Customer without undue delay after becoming aware of a personal-data breach affecting its data, with the information needed to meet its obligations.
Deletion/return: on termination, delete or return the Customer's personal data (Customer's choice) except where retention is legally required.
Records & audits: maintain records of processing and, on reasonable request and notice, make available information needed to demonstrate compliance.

4. Sub-processors

The Customer authorises Tenari to engage the following sub-processors, each under contract and only to provide the service. We will give notice of any intended change so the Customer may object on reasonable data-protection grounds.

Sub-processor	Function
Supabase	Database hosting & authentication
Meta Platforms (WhatsApp Business Cloud API)	WhatsApp message delivery
Africa's Talking	SMS delivery
Safaricom (Daraja / M-Pesa)	Mobile-money payment processing & reconciliation
Google	Sign-in with Google (only if the user chooses it)
Netlify	Application & website hosting

5. International transfers

Some sub-processors process data outside Kenya. Where that occurs, Tenari relies on the sub-processors' recognised safeguards and contractual data-protection commitments, consistent with the Data Protection Act, 2019 and the Data Protection (General) Regulations.

6. Liability & law

Liability under this DPA is subject to the limitations in the Terms of Service. This DPA is governed by the laws of the Republic of Kenya and, in the event of conflict on data-protection matters, prevails over the Terms of Service.

7. Acceptance

By subscribing to and using Tenari, the Customer accepts this DPA. Organisations that require a countersigned copy for their records may request one at info@tenariventures.com.

Note for InfraWatchKenya: this is a solid controller–processor template aligned to Kenya's DPA 2019, not legal advice. Have a Kenyan advocate/DPA practitioner review it, confirm the sub-processor list stays current, and add your ODPC registration details before relying on it commercially.