1. Parties and Scope

This DPA applies where DXHUBX processes personal data on behalf of the client under the applicable service agreement, Statement of Work (SOW), or SLA. "Personal data," "data controller," and "data processor" have the meanings given in the Tanzania Personal Data Protection Act, 2022 (PDPA) and any applicable regulations.

This DPA governs all personal data processing performed by DXHUBX on behalf of the client under the service agreement.

2. Roles of the Parties

• Client (data controller): The client determines the purposes and means of processing personal data within its systems and is responsible for its own compliance with the PDPA, including registering with the Office of the Data Protection Commissioner (ODPC) where required.
• DXHUBX (data processor): DXHUBX processes personal data only on documented instructions from the client and only to the extent necessary to perform the services.
• If the client is a processor on behalf of a further controller, the client warrants that it has the authority to instruct DXHUBX in respect of that processing.

3. Instructions and Lawfulness

DXHUBX will process personal data only in accordance with the documented instructions of the client, as set out in the service agreement and this DPA. DXHUBX will inform the client if, in its opinion, an instruction infringes applicable data protection law, unless it is prohibited from doing so by law. The client remains responsible for ensuring that its instructions and processing activities are lawful.

4. Categories of Data and Data Subjects

Where not specified in the service agreement, the categories of personal data and data subjects will be determined by the nature of the client's system. Typical examples include:

• Data subjects: customers, employees, end-users, suppliers, and other individuals whose data is processed through the client's system
• Categories of data: identity, contact, business/professional, financial, technical/device, and any other categories necessary to operate the system, as defined in the client's own records and privacy notices

DXHUBX does not intentionally process sensitive personal data unless necessary for the agreed services and lawful.

5. Client Responsibilities

The client must:

• Ensure that its processing of personal data complies with applicable law
• Provide data subjects with the notices and obtain the consents required by law
• Provide DXHUBX with lawful and documented instructions
• Respond to data subject requests, with DXHUBX's reasonable assistance where required
• Take reasonable steps to ensure the accuracy of the data it provides

6. DXHUBX Obligations

DXHUBX will:

• Process personal data only in accordance with the client's documented instructions
• Ensure that persons authorized to process personal data are bound by appropriate confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the client, to the extent reasonably possible, in complying with data subject rights and its obligations under the PDPA
• Make available information necessary to demonstrate compliance with this DPA
• Not sell, rent, or use personal data for purposes unrelated to the services

7. Subprocessing

DXHUBX may engage subprocessors (such as hosting, cloud, email, SMS, payment, or other service providers) to assist in delivering the services. A current list of subprocessors is available on request. DXHUBX will impose data protection obligations on subprocessors that are at least as protective as those in this DPA, and remains responsible to the client for the performance of its subprocessors. The client may reasonably object to a new subprocessor, and the parties will discuss an alternative arrangement.

8. Security Measures

DXHUBX will implement appropriate technical and organizational measures appropriate to the risks of the processing, including where relevant access controls, encryption in transit, secure development practices, patch management, monitoring and logging, and incident-response procedures. The specific measures applicable to an engagement are described in the service agreement, SOW, or SLA.

9. Confidentiality

DXHUBX personnel who have access to personal data are subject to confidentiality obligations and may access personal data only as needed to perform the services. This obligation survives termination of this DPA.

10. Data Subject Rights

Taking into account the nature of the processing, DXHUBX will assist the client by appropriate technical and organizational measures, insofar as possible, to fulfil the client's obligation to respond to requests from data subjects exercising their rights (access, correction, deletion, restriction, objection, portability, and others provided by law). The client is responsible for responding to data subject requests, and DXHUBX will notify the client if it receives a request directly.

11. Personal Data Breach

DXHUBX will notify the client without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA. DXHUBX will provide reasonable assistance to the client in assessing the breach and meeting its notification obligations to regulators or data subjects, where required by law.

12. International Transfers

Personal data may be transferred to and processed in locations outside Tanzania through cloud or other service providers. Where required by applicable law, DXHUBX will take steps designed to ensure an appropriate level of protection for such transfers. The client acknowledges that cloud-based services may involve storage outside Tanzania and consents where required.

13. Return and Deletion

At the end of the services, and at the client's choice, DXHUBX will return or securely delete personal data processed under this DPA, unless applicable law requires retention. Information may continue to exist in secure backups for a reasonable period and will be overwritten or destroyed in accordance with DXHUBX's backup lifecycle.

14. Term and Survival

This DPA remains in effect for as long as DXHUBX processes personal data on behalf of the client. Clauses that by their nature should survive termination (including security, confidentiality, return and deletion, liability, and governing law) continue to apply after termination.

15. Liability

Liability arising from or relating to data processing is subject to the limitation of liability provisions in the service agreement and our Terms of Service. Nothing in this DPA limits or excludes liability that cannot be limited or excluded by law.

16. Governing Law and Disputes

This DPA is governed by the laws of the United Republic of Tanzania. Disputes will be handled in accordance with the dispute resolution provisions of the service agreement and Terms of Service. In the event of a conflict between this DPA and the service agreement, the DPA governs data processing matters to the extent of the conflict.

17. Contact Information

Company: DXHUBX ICT LIMITED
Email: info@dxhubx.co.tz
Support: roseevanskyara@dxhubx.co.tz
Phone / WhatsApp: +255 753 587 561
Location: Dar es Salaam, Tanzania