Data Processing Agreement

Last updated 2 October 2026 · Workfolio is published by Form and Function Works Ltd, Kenya. Applies where the vendor hosts an institution's online portal or receives its backups. Print

This agreement forms part of the Terms and Conditions between Form and Function Works Ltd (“the Processor”) and the licensed institution (“the Controller”) whenever the Processor hosts the Controller's online portal, receives the Controller's database backups, or otherwise stores or handles personal data on the Controller's behalf (“the Service”). It gives effect to section 42 of the Data Protection Act, 2019 (Kenya).

1. Subject matter and instructions

1. The Processor processes personal data only to provide the Service as described in the Terms and the software's documentation, and on the Controller's documented instructions. Using the software's portal and backup settings is an instruction.
2. Categories of data subjects: applicants, trainees, guardians, staff, suppliers and other persons the Controller records. Categories of data: identity, contact, academic, financial, employment, welfare and, where the Controller uses the clinic module, health data. Duration: the term of the license plus the deletion period in clause 7.

2. Processor obligations

1. Process the data only as instructed; tell the Controller if an instruction would, in the Processor's opinion, breach the Act.
2. Ensure every person with access is bound by confidentiality and has access only to the extent needed.
3. Implement the technical and organisational measures in clause 4.
4. Assist the Controller, by appropriate means, in responding to data subjects' requests and in meeting its obligations on security, breach notification and impact assessments.
5. Keep records of its processing and make available the information needed to demonstrate compliance, and allow audits by the Controller or an auditor it appoints, on reasonable notice and no more than once a year unless a breach has occurred.

3. Controller obligations

The Controller warrants that it has a lawful basis for the data it enters, has given the notices and obtained the consents the Act requires, keeps its accounts and keys secure, and decides which categories of user may work on the portal. The Controller remains responsible for the content of its records.

4. Security measures

• Separate database and file store per institution; no shared tables between institutions.
• Transport over HTTPS; the institution's server and the portal authenticate with a per-institution secret key compared in constant time; a portal accepts a database only after its administrator has allowed it.
• Passwords stored as one-way hashes; HTTP-only, same-site session cookies; sign-in rate limiting; role-based access; an activity log of changes.
• Backups stored outside web reach; limited retention; server access restricted to named staff; software kept up to date.
• Uploads restricted to document and image types; no executable content served from upload folders.

5. Sub-processors

The Controller authorises the Processor's use of its hosting provider, email delivery service and, where the Controller enables SMS, the SMS gateway, each bound by equivalent obligations. The Processor will inform the Controller of any intended change, giving it the opportunity to object within 14 days.

6. Personal data breach

The Processor will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting the Controller's data, with the information the Controller needs to meet its own 72-hour obligation to the Data Commissioner and to data subjects, and will co-operate in containing and remedying it.

7. Return and deletion

During the term the Controller can export its database and files at any time (the software's backup and the portal's own dump). On termination the Processor deletes the portal, its database, files and received backups within 90 days, or sooner on request, unless the law requires retention, and confirms deletion in writing on request.

8. Transfers

Data is hosted in Kenya where practicable. Where a hosting provider stores data outside Kenya, the Processor ensures the safeguards required by section 48 of the Act and informs the Controller of the location on request.

9. Liability and term

The liability provisions of the Terms apply. This agreement lasts as long as the Processor holds any of the Controller's data.

Questions: contact Form and Function Works Ltd through the Workfolio website.