This Data Processing Addendum (“DPA”) forms part of and supplements the Hafinen Terms of Service (“Agreement”) entered into between Hafinen Limited (“Hafinen”, “Processor”, “we”, “us”) and the Customer (“Controller”).
This DPA applies where Hafinen processes Personal Data on behalf of Customer in connection with Hafinen’s Services.
If there is any conflict between this DPA and the Agreement regarding Personal Data processing, this DPA shall prevail.
For purposes of this DPA:
“Applicable Data Protection Laws” means all applicable privacy and data protection laws, including but not limited to Kenya Data Protection Act 2019, General Data Protection Regulation (GDPR), UK GDPR, Data Protection Act 2018 (UK), California Consumer Privacy Act (CCPA) where applicable, South Africa POPIA, and any similar applicable laws.
“Personal Data” means any information relating to an identified or identifiable natural person processed by Hafinen on behalf of Customer.
“Data Subject” means the individual to whom Personal Data relates.
“Processing” means any operation performed on Personal Data.
“Subprocessor” means any third party engaged by Hafinen to process Personal Data.
“Security Incident” means unauthorized access, acquisition, disclosure, loss, alteration, or destruction of Personal Data.
For Customer Data processed under the Services, Customer acts as Data Controller and Hafinen acts as Data Processor.
Customer determines the purposes of processing, categories of Personal Data, retention instructions, and access rights.
Hafinen shall process Personal Data only in accordance with documented instructions from Customer unless required by law.
Including names, contact information, employment records, job titles, department data, compensation records, attendance records, leave balances, performance records, training records, disciplinary records, and termination records.
Including resumes, CVs, applications, interview records, assessments, recruiter notes, and hiring decisions.
Including salaries, deductions, allowances, tax identifiers, payroll records, statutory contributions, and banking information.
Including contracts, policies, acknowledgements, legal documents, and certifications.
Hafinen supports attendance events linked to fingerprint and facial recognition systems.
Hafinen does not store raw biometric images.
Integrated biometric systems store encrypted templates or tokens.
Hafinen may process timestamps, attendance logs, authentication outcomes, and employee-device linkage records.
Including workflow approvals, meeting records, task records, internal communication records, knowledge records, and analytics activity.
Hafinen processes Personal Data for workforce administration, recruitment workflows, payroll processing, compliance tracking, attendance tracking, shift scheduling, employee lifecycle management, performance reviews, training programs, asset management, internal workflow management, analytics, reporting, API operations, integrations, customer support and security.
Future processing may include AI-assisted workflows.
Hafinen shall process Personal Data during the active subscription term, for up to ninety (90) days following termination, and longer only where legally required, necessary for disputes, fraud prevention, backups, or compliance.
Customer warrants that it has lawful authority to process Personal Data, it has provided legally required notices, it has obtained necessary consents where required, its instructions are lawful, its collection of biometric data complies with applicable law, and it will respond to Data Subject rights requests where acting as Controller.
Customer remains solely responsible for employment law compliance.
Hafinen shall process Personal Data only on Customer instructions, maintain confidentiality, implement security measures, assist with Data Subject rights requests, assist with compliance obligations where reasonably necessary, notify Customer of Security Incidents and manage Subprocessors responsibly.
Hafinen maintains appropriate technical and organizational measures, including encryption in transit, encrypted credential storage, role-based access controls, audit logging, DDoS protection, network segmentation, backup procedures, API authentication, webhook security controls, access monitoring, and vulnerability management.
Customer remains responsible for user access permissions, account credential management, and internal access governance.
Customer authorizes Hafinen to engage Subprocessors in connection with providing the Services.
Hafinen maintains an up-to-date list of authorized Subprocessors, including the nature of processing performed and applicable processing regions, at:
https://www.hafinen.com/subprocessors
Hafinen shall ensure all Subprocessors are bound by written obligations that provide data protection standards materially equivalent to those contained in this DPA.
Where required by applicable law or contractual obligations, Hafinen will provide notice of material Subprocessor changes.
Customer acknowledges that Personal Data may be transferred internationally.
Where legally required, Hafinen shall implement appropriate safeguards including contractual protections, data transfer agreements, and equivalent lawful transfer mechanisms.
To the extent legally required, Hafinen shall reasonably assist Customer in responding to access requests, correction requests, deletion requests, restriction requests, portability requests, and objection requests.
Where Hafinen receives a request directly, Hafinen may redirect the request to Customer.
Hafinen shall notify Customer without undue delay after becoming aware of a confirmed Security Incident affecting Customer Data.
Notification may include nature of incident, affected categories, likely consequences, and mitigation actions.
Notification does not constitute an admission of fault.
Where required by applicable law or enterprise agreement, Customer may request reasonable information necessary to demonstrate compliance.
Audits shall occur no more than once annually unless required by law, be at Customer’s expense, avoid unreasonable disruption, and remain subject to confidentiality.
Third-party certifications and security reports may satisfy audit obligations.
Unless prohibited by law, Hafinen may notify Customer of legally binding government requests for Personal Data.
Where AI-assisted features are enabled:
Aggregated and anonymized data may be used for product improvement.
Additional operational governance for AI-enabled features is governed by Hafinen’s AI Usage Policy.
Upon termination and Customer request:
Hafinen shall make Customer Data available for export.
After the retention period, Hafinen may delete Customer Data unless retention is required by law.
Liability under this DPA shall be governed by the liability limitations in the Agreement.
This DPA shall be governed by the laws of Kenya unless otherwise agreed in writing.
Hafinen Limited 107 Lower Kabete Road Westlands, Nairobi, Nairobi County Kenya Email: [email protected]
