Data Processing Agreement

Pinecrest Solutions Ltd · Version 2026-10-20 · Effective October 20, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Pinecrest Solutions Ltd ("Processor", "we") and the customer ("Controller", "you"). It applies when we process personal data in Customer Data on your behalf. It is designed to meet section 42 of the Kenya Data Protection Act, 2019 (the "KDPA"), Article 28 of the EU GDPR and UK GDPR, and the service provider requirements of the CCPA. It takes effect automatically when you accept the Terms. If you need a countersigned copy, email legal@microbooks.io.

1. Definitions

"Data Protection Laws" means the KDPA, the GDPR, UK GDPR, the CCPA and any other privacy law that applies to the processing. "Personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings given in those laws. Capitalised terms not defined here have the meanings in the Terms.

2. Roles and instructions

• You are the controller, and we are the processor, of personal data in Customer Data. You are responsible for having a lawful basis for that processing and for giving data subjects the required notices.
• We process that personal data only on your documented instructions. Those instructions are the Terms, this DPA, and the requests you or your users and Agents make through the Service. The only exception is where the law requires otherwise, in which case we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks Data Protection Laws.
• Under the CCPA, we will not sell or share the personal information, or retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Service.

3. Details of the processing

4. Confidentiality

We ensure that everyone authorised to process the personal data is bound by confidentiality and has access only as far as their role requires.

5. Security

We put in place and maintain the technical and organisational measures described in Annex 1 to protect the personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. We may update these measures, but we will not materially reduce the overall level of protection.

6. Subprocessors

• You give general authorisation for us to use the subprocessors listed on our Subprocessors page.
• We will give at least 30 days' notice of new or replacement subprocessors by updating that page and emailing account holders who have subscribed to updates at legal@microbooks.io. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may terminate the affected Service and receive a refund of prepaid fees for the unused period.
• We impose data protection terms on each subprocessor that are no less protective than this DPA, and we remain liable to you for their performance.

7. Help with data subject requests and compliance

Taking into account the nature of the processing, we will help you, through the API and with reasonable additional help, to respond to data subject requests, including access, correction, deletion and portability. If we receive a request directly, we will pass it to you and will not respond ourselves except to confirm that we have done so. We will also give reasonable help with data protection impact assessments and consultations with supervisory authorities.

8. Personal data breaches

• We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your personal data. This lets you meet the 72-hour notification deadlines under KDPA section 43 and GDPR Article 33.
• The notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. We will send further information as it becomes available.
• We will take reasonable steps to contain the breach and reduce its effects. Notifying you is not an admission of fault.

9. Deletion and return

You can export your Customer Data through the API at any time before you delete your account. When an account is deleted, we delete or anonymise the personal data in it after a period of [6 months], which allows recovery from deletions made in error. Financial records are kept in anonymised form for [7 years] where tax law requires it, and such records no longer identify data subjects. Copies in backups are overwritten in the normal backup cycle of [BACKUP RETENTION PERIOD] and are protected in the meantime.

10. Audits

We will make available the information reasonably needed to demonstrate compliance with this DPA, including our security documentation and the results of independent assessments where we have them. Where that information is not enough, or a supervisory authority requires it, you may audit our compliance once a year, at your cost, with at least 30 days' notice, during business hours, under confidentiality, and in a way that does not disrupt the Service or compromise other customers' data.

11. International transfers

We may process personal data in Kenya and in the countries where our subprocessors operate. Transfers out of Kenya comply with sections 48 to 50 of the KDPA. For transfers of personal data subject to the GDPR to a country without an adequacy decision, the parties incorporate the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), with: clause 7 (docking) included; option 2 (general authorisation) under clause 9 with the notice period in section 6; the optional wording in clause 11 omitted; and clauses 17 and 18 governed by, and disputes resolved in, the courts of Ireland. Annexes I and II are completed by section 3 and Annex 1 of this DPA. For UK transfers, the UK International Data Transfer Addendum applies. Where the transfer mechanism conflicts with this DPA, the transfer mechanism prevails.

12. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not allow them. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.

Annex 1: Technical and organisational measures

• Encryption: TLS for all traffic to the API, MCP server and console. Encryption at rest of databases and backups [CONFIRM WITH HOSTING PROVIDER].
• Authentication: OAuth 2.1 with PKCE, short-lived access tokens with rotating refresh tokens, revocable personal access tokens, scopes limited by account type, hashed passwords, login throttling.
• Tenant isolation: every query on books data is scoped to the authenticated user's entity.
• Integrity: posted transactions are immutable and corrected only by reversal, and ledger entries are hash-chained.
• Availability: rate limiting, request idempotency, [DAILY] backups with periodic restore tests, health monitoring.
• Access control: production access limited to named personnel, with multi-factor authentication on infrastructure and admin accounts, and secrets kept out of source control.
• Logging: request and security logging, and an audit trail for privacy requests, with no personal data logged by privacy tooling.
• Incident response: a documented process for detection, containment, notification and post-incident review.
• Data minimisation: no full card data held (cards are tokenised by the payment provider), retention limits enforced by scheduled purges.
• Vendor management: subprocessors bound by written data protection terms.