This agreement forms part of the Terms of Service between the customer (the controller) and TACEGATE (the processor). It sets out how we process personal data on the customer's behalf under the Data Protection Act No. 3 of 2021 of Zambia (the Act). Where it conflicts with the Terms of Service on personal data, this agreement prevails.
1. Roles
The customer is the controller of personal data in its customer data. We are its processor.
We are registered with the Data Protection Commission as a data processor, registration number [DPC registration number].
The customer confirms it has a lawful basis for the personal data it puts into the service and has given the people concerned the notices the law requires.
2. Subject matter and duration
Subject matter: hosting and processing customer data so the customer can use Tacegate.
Duration: for as long as the Terms of Service apply, and after that until the data is deleted under section 11.
3. Nature and purpose
We store, organise, retrieve, calculate on, display, export, email and delete personal data, and back it up, only to provide, secure and support the service the customer uses.
4. Categories of data subjects
The customer's users; its employees and former employees; contacts at its customers, suppliers and carriers; drivers and technicians; delivery recipients; and any other people the customer records.
5. Categories of personal data
Identity and contact details: names, email addresses, phone numbers and addresses.
Employment and payroll data: job details, leave, attendance, salary, deductions and payslips.
Sensitive personal data: NRC or passport numbers, TPIN, NAPSA and NHIMA numbers, dates of birth, bank account details, and drivers' medical documents where the customer uploads them.
Transaction data that names people: invoices, orders, payments and similar records.
Location data: addresses, coordinates and trip routes; proof of delivery signatures and photos.
Usage data: sign-in records, IP addresses and audit records.
The customer decides what it puts into the service and must not put in special categories of data the service is not designed for, such as biometric or genetic data.
6. Instructions
We process personal data only on the customer's documented instructions. The Terms of Service, this agreement and the customer's use of the service and its settings are those instructions.
If the law requires us to process data otherwise, we tell the customer first unless the law forbids it.
We tell the customer if we believe an instruction breaks the Act.
7. Confidentiality
Everyone we authorise to process customer data is bound by confidentiality.
Our staff never join a customer's organisation. They see its records only in a support session that the customer's Owner approves, which is time-limited to at most 8 hours, read-only unless write access is approved, excludes sensitive personal data and high-risk permissions, can be revoked at any time, and is recorded in the customer's audit log.
8. Security
We keep appropriate technical and organisational measures, including: encryption in transit and at rest, with extra encryption for sensitive personal data; separation of each organisation's data in the application and the database; role-based access denied by default; multi-factor authentication for administrators and high-risk actions; an audit log ordinary users cannot change; continuous, tested backups; and limited, recorded staff access to production systems.
We review these measures regularly and may improve them, but not reduce the overall level of protection.
9. Where data is stored and sub-processors
We store customer data with the hosting provider named in this section. Any transfer of personal data outside Zambia is made under sections 70 and 71 of the Act.
The customer authorises these sub-processors: [Hosting provider name], [Hosting location], for hosting. Resend, Inc., United States of America, for email delivery: recipient email addresses and names and the content of emails. Google LLC (Google Maps Platform), United States of America, for address lookup and route planning: address text and coordinates of locations and trip stops.
Transfers to the hosting provider, Resend and Google are made under section 71 of the Act, on the basis of consent and contractual safeguards.
We impose data protection duties on each sub-processor that are no less protective than this agreement, and we remain responsible for their work.
We give the customer at least [30] days notice by email before adding or replacing a sub-processor. The customer may object on reasonable data protection grounds within that time. If we cannot address the objection, the customer may end the subscription without penalty and receive a prorated refund of prepaid fees.
10. Assistance
We help the customer answer requests from data subjects to exercise their rights, mainly through the service's own tools for finding, correcting, exporting and deleting records. If a data subject contacts us directly about customer data, we pass the request to the customer and do not answer it ourselves unless the customer asks us to.
We give reasonable help with the customer's security, breach notification, data protection impact assessments and consultations with the Data Protection Commission, taking into account the information available to us.
11. Personal data breaches
We notify the customer of a personal data breach affecting its data without undue delay, and in any case within 24 hours of becoming aware of it.
The notice describes, as far as then known: what happened; the categories and approximate number of people and records affected; the likely consequences; the measures taken or proposed; and a contact. We send further details as we learn them.
We also notify the Data Protection Commissioner within 24 hours where the Act requires it of us.
12. Return and deletion
The customer can export all its data at any time during the subscription and for 90 days after it ends, as described in the Terms of Service.
After those 90 days we delete the customer data. Deleted data leaves our backups within 35 days.
We keep only what the law requires or the Terms of Service describe: a minimal deletion record, our billing records with the customer, and the audit archive, kept in write-once storage for 7 years. That retained data stays protected under this agreement.
13. Audits
We make available the information needed to show we meet this agreement, including a summary of our security measures and of our latest independent security test, when one exists.
The customer, or an independent auditor bound by confidentiality, may audit our compliance once a year, or after a breach, with at least [30] days written notice, during business hours, at the customer's cost, and without access to other customers' data.
14. Liability and law
The limits of liability in the Terms of Service apply to this agreement.
This agreement is governed by the laws of the Republic of Zambia, and the courts of Zambia have jurisdiction.