Data Processing Addendum

Controller – The Customer who determines the purposes and means of the Processing of Personal Data.

Processor – Recruitment Room, the entity Processing Personal Data on behalf of the Controller.

Personal Data – Any information relating to an identified or identifiable natural person.

Processing – Any operation or set of operations performed on Personal Data.

Data Subject – The natural person to whom the Personal Data relates.

Personal Data Breach – A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

Recruitment Room undertakes to:

• Process Personal Data only on documented instructions from the Controller, including instructions regarding international transfers.
• Ensure all persons authorised to process Personal Data are bound by confidentiality obligations.
• Implement and maintain appropriate technical and organisational measures to ensure data security.
• Assist the Controller in responding to Data Subject rights requests, including access, rectification and erasure requests.
• Notify the Controller of any Personal Data Breach within 48 hours of becoming aware of it.
• Assist with data protection impact assessments and prior consultations with supervisory authorities where required.
• At the Controller's choice, delete or return all Personal Data upon termination of services and delete existing copies unless applicable law requires retention.
• Make available information necessary to demonstrate compliance with applicable processor obligations.

The Controller provides general written authorisation for Recruitment Room to use the following subprocessors:

Recruitment Room will notify the Controller of any intended addition or replacement of subprocessors, giving the Controller a reasonable opportunity to object.

Personal Data may be transferred to and processed in countries outside Kenya. Where such transfers occur to jurisdictions not deemed adequate under applicable law, Recruitment Room will ensure appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by relevant authorities.
• Additional supplementary measures when necessary.
• Regular review of transfer mechanisms in light of applicable legal and regulatory developments.

Recruitment Room maintains an information security program incorporating technical and organisational measures designed to protect Personal Data against unauthorised access, disclosure, alteration, loss or destruction.

These measures include, but are not limited to:

• Encryption of data at rest and in transit.
• Strict access controls and multi-factor authentication.
• Regular security testing, vulnerability scanning and penetration testing.
• Incident response and business continuity procedures.
• Personnel training and confidentiality agreements.

Upon reasonable advance notice and not more than once per year, unless a material breach is suspected, the Controller or its appointed auditor may conduct an audit of Recruitment Room's compliance with this DPA during normal business hours.

Any audit must be conducted in a manner that does not unreasonably interfere with Recruitment Room's operations.