B2B ComplianceVersion: v1.0Updated: October 2026
Data Processing Agreement
Contractual processor terms governing Kairo's processing of customer personal data on behalf of business controllers.
Audience: Enterprise and business customers subject to statutory data protection laws
Developer: Zambezi Digital
Official Policy Publication — Enforced Standards
This document is an active, binding operational policy published by Zambezi Digital governing the security, data privacy, and usage regulations of Kairo OS across all jurisdictions.
On this page
1. Scope, Subject Matter & Statutory Roles
This Data Processing Agreement (“DPA”) governs Kairo's processing of Customer Personal Data on behalf of Customer. Customer acts as Data Controller and Kairo acts as Data Processor under applicable data protection legislation (including Zimbabwe DPA 2021, Botswana DPA 2018, UAE Federal Decree-Law 45/2021, and GDPR where applicable).
Key takeaway: Defines statutory controller/processor roles under international privacy laws.
2. Processor Obligations & Documented Instructions
Processor shall:
• Process Customer Personal Data solely on documented instructions from Controller.
• Ensure personnel authorized to process data are bound by formal confidentiality agreements.
• Implement technical and organizational measures (TOMs) appropriate to the risk.
• Promptly notify Controller of any legally binding disclosure request unless prohibited.
Key takeaway: We process data strictly on your instructions with strict staff confidentiality.
3. Subprocessors & Advance Notification
Controller grants general authorization for the engagement of subprocessors listed in the Subprocessor Register. Processor shall provide at least 14 days advance written notice before onboarding any new subprocessor. Controller may object on reasonable data protection grounds.
Key takeaway: Subprocessor changes are announced with advance notice and right to object.
4. Security Breach Notification
In the event of a confirmed Personal Data Breach affecting Customer Personal Data, Processor shall notify Controller without undue delay (within 48 to 72 hours) and provide ongoing incident reports, mitigation summaries, and assistance with regulatory filings.
Key takeaway: Rapid 48-72 hour notification upon confirmation of any personal data breach.
5. Deletion or Return of Data
Upon termination of services, Processor shall, at Controller's election, securely return or permanently delete all Customer Personal Data within the verified retention period, retaining only copies strictly required by applicable law.
Key takeaway: Complete return or secure purging of your business data upon account closure.
Have questions about this policy?
Our legal and privacy desk is available for corporate inquiries.