Data Processing Agreement
Processor terms when Pepe processes personal data for an institution.
Last updated: 27 July 2026 · Path: /legal/dpa
1. Roles
The institution is the controller. Pepe is the processor for personal data processed in the tenant workspace on the institution’s documented instructions (configuration, API calls and support tickets).
2. Instructions & confidentiality
Pepe processes data only to provide the service, including hosting, backup, security monitoring and support. Personnel with access are bound by confidentiality.
3. Security measures
Pepe implements access control, encryption in transit, tenant isolation, logging and vulnerability management appropriate to the nature of the data.
4. Subprocessors & international transfers
Pepe may engage subprocessors for infrastructure and communications. A current list is available on request. Transfers outside Kenya use appropriate safeguards where required.
5. Assistance & deletion
Pepe will assist with data subject requests and security incidents as described in our breach policy. On termination, Pepe will delete or return tenant data within the retention schedule unless law requires longer retention.
Questions: info@pepe.co.ke