Data Processing Terms
Last updated: 13 August 2026
1. Purpose and Scope
These Data Processing Terms establish the framework under which Sacyric Services processes personal data on behalf of a business customer using Janasi.
They apply to processing carried out through Janasi where the business customer determines the purposes and means for which personal data is processed and Sacyric Services processes that information on the business customer's behalf.
2. Roles of the Parties
For processing covered by these Terms, the business customer is responsible for determining the purposes and lawful basis for processing its customers' personal data.
Sacyric Services acts as a service provider and, where applicable, as a processor of personal data on behalf of the business customer.
The precise legal roles of the parties may depend on the nature of a particular processing activity and applicable law.
3. Instructions
Sacyric Services will process personal data in accordance with the business customer's documented instructions, the configured functionality of Janasi, these Terms, and applicable data-protection requirements.
Sacyric Services will not intentionally use personal data processed on behalf of a business customer for an unrelated purpose without an appropriate legal basis or instruction.
4. Categories of Data
Depending on how Janasi is configured, personal data processed through the service may include:
- names and contact information;
- telephone numbers and messaging identifiers;
- appointment and booking information;
- service preferences and customer requests;
- conversation and communication records;
- information supplied voluntarily by customers; and
- account, operational and technical information necessary to provide the service.
The business customer is responsible for determining what categories of personal data are necessary for its particular use of Janasi.
5. Categories of Data Subjects
Depending on the business and its configuration, data subjects may include:
- existing customers;
- prospective customers;
- people making or managing appointments;
- business staff and authorized users; and
- other individuals whose information is legitimately provided through the service.
6. Processing Activities
Processing may include collecting, receiving, recording, organizing, storing, retrieving, using, transmitting, updating, restricting and deleting information as necessary to provide Janasi.
Janasi may process information to support customer conversations, service discovery, recommendations, appointment workflows, follow-ups, customer context and escalation to the business's team.
7. Confidentiality
Sacyric Services will take reasonable steps to ensure that persons authorized to process personal data are subject to appropriate confidentiality obligations.
8. Security
Sacyric Services will maintain reasonable technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, destruction, alteration or disclosure.
Security measures may include access controls, authentication, system monitoring, secure infrastructure and other safeguards appropriate to the nature of the processing.
No technology service can guarantee absolute security, and business customers remain responsible for maintaining the security of their own accounts, credentials and authorized users.
9. Assistance With Data-Subject Requests
Where reasonably appropriate and subject to the nature of the service, Sacyric Services will provide reasonable assistance to a business customer in responding to requests relating to personal data processed through Janasi.
Where a request is made directly to Sacyric Services concerning information controlled by a business customer, Sacyric Services may direct the requester to the relevant business or otherwise act in accordance with applicable law.
10. Personal Data Breaches
If Sacyric Services becomes aware of a personal-data incident affecting personal data processed on behalf of a business customer, it will take reasonable steps to investigate, contain and address the incident.
Where notification to the business customer is required, Sacyric Services will provide relevant information reasonably available to it, subject to applicable legal and security considerations.
11. Subprocessors and Service Providers
Janasi may rely on third-party infrastructure and service providers to operate particular parts of the platform.
Where third parties process personal data on behalf of Sacyric Services, appropriate contractual and security measures should be used to require processing consistent with the relevant obligations.
The specific third-party providers used by Janasi may change as the platform develops. Business customers should be provided with relevant information about material subprocessors where required by applicable law or agreement.
12. International Processing
Depending on the infrastructure and service providers used by Janasi, personal data may be processed or stored outside Kenya.
Where applicable, Sacyric Services will consider the legal requirements and safeguards relevant to cross-border transfers and international processing.
13. Retention and Deletion
Personal data processed on behalf of a business customer should be retained only for as long as necessary for the relevant service, legitimate business purpose, legal obligation or other applicable requirement.
Where a business customer terminates its use of Janasi, data handling and deletion will be subject to the applicable service configuration, contractual arrangements, technical requirements and legal obligations.
14. Business Customer Responsibilities
The business customer remains responsible for:
- establishing an appropriate legal basis for processing;
- providing appropriate privacy notices to its customers;
- ensuring that information supplied to Janasi is collected lawfully;
- configuring Janasi appropriately for its business;
- limiting information supplied to what is reasonably necessary;
- responding to customer requests where the business is the responsible party;
- maintaining appropriate account security; and
- complying with applicable data-protection and sector-specific requirements.
15. Sensitive Personal Data
Businesses should carefully consider whether Janasi is appropriate for sensitive or highly regulated information.
A business must not configure Janasi to process sensitive personal data unless it has an appropriate lawful basis, required safeguards and a legitimate business need to do so.
Additional contractual or technical safeguards may be required for particular categories of information or regulated industries.
16. Compliance With Law
Each party is responsible for complying with the laws and regulations applicable to its own activities.
For businesses operating in Kenya, this may include applicable requirements under Kenyan data-protection law and regulations.
17. Changes to These Terms
These Data Processing Terms may be updated when Janasi's processing activities, infrastructure, contractual arrangements or applicable legal requirements change.
Material changes will be communicated where required by applicable law or contractual arrangements.
18. Contact
Questions concerning data processing through Janasi may be directed to:
Sacyric Services
Mlolongo, Kenya
0746470029
0745192174