Data Processing Agreement

This agreement forms part of the Terms of Service between REATECH Technologies(“REATECH”) and the club. It applies to personal data that the club puts into Rotary Management System.

• The club is the data controller. It decides whose data is kept and why, and it is responsible for having a lawful basis under the Kenya Data Protection Act 2019.
• REATECH is the data processor. We handle the data only to run the service for the club and only on the club’s documented instructions, which are these terms and the club’s use of the service.

Depending on the features the club uses, the data includes:

• identity and contact details: names, email addresses, phone numbers, photos;
• membership details: classification, sponsor, join date, offices held, attendance;
• financial records: dues invoiced and paid, M-Pesa and card payment references, donations;
• dates of birth where the club records them (age is worked out, never stored);
• messages sent through the service.

The data is processed for as long as the club uses the service, to provide membership, meetings, payments, communications and reporting for the club.

• We process club data only to provide the service and never sell it or use it for advertising.
• Everyone at REATECH who can reach club data is bound by confidentiality and sees only what their work needs.
• We help the club answer requests from members exercising their rights, such as access, correction or deletion.
• We help the club with data protection impact assessments and with questions from the Office of the Data Protection Commissioner.
• We keep a record of processing activities and make the information needed to show compliance available to the club.

• Each club’s data is kept apart in the database by a club identifier, and the database itself enforces that one club’s queries cannot read another club’s records.
• Connections are encrypted in transit. Passwords are stored as one-way hashes. Payment credentials and sign-in secrets are encrypted at rest.
• REATECH staff accounts use two-step sign-in, and every change staff make to a club is recorded in an activity log.
• Backups are taken daily and access to production systems is limited and logged.

We use the providers below to run the service. Each is bound by written terms that protect the data at least as well as this agreement. We will tell clubs at least 30 days before adding or replacing one, and a club may object.

If data is stored or processed outside Kenya, we will only do so where the Data Protection Act 2019 and its regulations allow it, with appropriate safeguards, and we will list the country in the table above.

If we become aware of a breach affecting a club’s data, we will tell the club’s admins without delay and in any case within 48 hours, so that the club can notify the Data Protection Commissioner within the 72 hours the law requires. We will share what we know, what we are doing about it, and help the club tell affected members where needed.

Where a club records data about people under 18, for example members of an Interact club, the club must have the consent of a parent or guardian and should record only what it needs. Such records are marked in the service and are not used in public directories.

The club can export its data at any time. When the agreement ends, the club has 30 days to export it. After that we delete the club’s data from live systems within 30 days and from backups within 90 days, unless the law requires us to keep something longer, such as financial records.

Questions about this agreement go to our data protection contact at [email protected].