Data Processing Agreement (DPA)

This Data Processing Agreement ("Agreement") forms part of the contract between Neptunes Solutions Limited ("Processor") and the customer ("Controller") for the provision of Leasystream services.

1. Definitions

• Controller: The entity determining purposes of data processing
• Processor: Neptunes Solutions Limited
• Personal Data: Any information relating to an identifiable person

2. Scope of Processing

The Processor shall process personal data solely for the purpose of providing the contracted SaaS services.

3. Processor Obligations

• Process data only on documented instructions
• Ensure confidentiality of authorized personnel
• Implement appropriate technical and organizational safeguards
• Assist with data subject requests where applicable

4. Data Security

Measures include access control, encryption in transit, audit logging, and regular backups.

5. Sub-processors

The Controller authorizes the use of sub-processors for hosting, communications, and payment services, subject to equivalent data protection obligations.

6. Data Breach Notification

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach.

7. Data Retention & Deletion

Upon termination, personal data shall be deleted or returned unless retention is required by law. An account suspended for non-payment is kept for up to 24 months from suspension. It is closed about 90 days before that time is up, so that deletion is complete by month 24, and its owners are warned 60 and 7 days before the closing. The data is deleted 90 days after closing, unless a legal hold applies. If a warning goes out late, the closing and the deletion move later so that the full notice is kept; that is the one exception. While suspended, its owners can download the raw data. This does not apply to an account that our staff suspended for a reason other than non-payment.

8. Governing Law

This Agreement is governed by the laws of Uganda.