Skip to main content

Data Processing Addendum

How Nisc Cloud processes personal data on your behalf when you use our hosting, email, servers and other services, under the Kenya Data Protection Act, 2019.

Effective: 13 November 2026Last updated: 13 November 2026Version 1.0
Subject to Change. We may revise these terms from time to time. Registered users will be notified by email at least 30 days before any material changes take effect. Your continued use of our platform after the effective date of any revision constitutes acceptance of the updated terms.
Nisc Cloud Limited is registered with the Office of the Data Protection Commissioner (ODPC) under the Kenya Data Protection Act, 2019. Registration No. 160-3417-5D07 · Serial No. 14768 · Valid 16 September 2025 – 16 September 2027.

At a glance

How we handle your customers' data

Own and control your data
You
You are the data controller. We process it only to deliver your services.
Breach notification
72 h
We tell you about a confirmed breach affecting your data within 72 hours.
Hosting regions
3
Data centres in Africa (Kenya), America and Europe.
To export after closure
30 days
Then we delete your data, and backups expire on their normal cycle.
On this page

This Data Processing Addendum ("Addendum") forms part of the Terms of Service between NISC CLOUD LIMITED, registration number PVT-ZQUX33PK ("Nisc Cloud", "we", "us"), and the Client ("you"). It applies automatically when you use our Services; no signature is needed. A signed copy is available on request from privacy@nisccloud.com.

1. Scope and roles

This Addendum applies where you use our Services to store or process the personal data of your own customers, employees or other end users ("Client Personal Data"). For Client Personal Data, you are the data controller and Nisc Cloud is the data processor, as those terms are used in the Kenya Data Protection Act, 2019 ("the Act").

Personal data we collect about you as our customer, such as your account and billing details, is covered by our Privacy Policy, where Nisc Cloud is the data controller.

2. Definitions

"Personal data", "processing", "data subject", "data controller", "data processor" and "personal data breach" have the meanings given in the Act. "Sub-processor" means a third party we engage to process Client Personal Data. Other capitalised terms have the meanings given in the Terms of Service.

3. Details of processing

  • Subject matter: hosting, storing, transmitting, backing up and migrating Client Personal Data as part of the Services you order, including website hosting, email hosting, cloud servers, domains and related support.
  • Duration: for as long as we provide the Services, plus the export and deletion periods in Section 9.
  • Purpose: only to provide, secure, support and maintain the Services.
  • Types of personal data: whatever you or your users upload, send or store using the Services, for example names, contact details, email content, website form submissions and order records.
  • Data subjects: your customers, website visitors, employees, mailbox users and other people whose data you process using the Services.

4. Our obligations

When we process Client Personal Data, we will:

  • Process it only on your documented instructions. Your instructions are this Addendum, the Terms of Service, your order and the way you configure and use the Services. We will tell you if we believe an instruction breaks the Act, unless the law prevents us from doing so;
  • Not sell Client Personal Data or use it for our own marketing;
  • Make sure staff who can access Client Personal Data are bound by confidentiality obligations;
  • Apply the technical and organisational security measures described in Section 11 of our Privacy Policy and Section 5 of our Service Level Agreement, including encryption in transit and at rest, role-based access controls and regular patching;
  • Taking into account the nature of the processing, help you respond to requests from data subjects exercising their rights under the Act, where you cannot do so yourself using the Services; and
  • Provide reasonable information to help you carry out data protection impact assessments and consult the Office of the Data Protection Commissioner where required.

5. Your obligations

You are responsible for:

  • Having a lawful basis under the Act for the Client Personal Data you process using the Services;
  • Giving data subjects any notices the law requires and obtaining any consents you need;
  • Making sure your instructions to us comply with the Act;
  • Keeping your account credentials secure and managing your own users and permissions; and
  • Using the Services in line with our Acceptable Use Policy.

6. Sub-processors

You authorise us to engage sub-processors to help deliver the Services, including data centre and server infrastructure providers, email delivery providers and helpdesk software providers. We will:

  • Bind each sub-processor to written data protection obligations no less protective than this Addendum;
  • Remain responsible to you for our sub-processors' performance of those obligations; and
  • Provide our current list of sub-processors on request from privacy@nisccloud.com.

7. International transfers

Client Personal Data is hosted in data centres in Africa (Kenya), America and Europe. Where Client Personal Data is transferred outside Kenya, we apply the safeguards described in Section 8 of our Privacy Policy, in line with the Act. You can request details of the safeguards for a specific transfer from privacy@nisccloud.com.

8. Personal data breaches

We will notify you of a confirmed personal data breach affecting Client Personal Data within 72 hours of discovering it. Our notice will describe, as far as the information is available, what happened, the data and data subjects likely affected, the likely consequences and the steps we are taking. We will give you reasonable help to meet your own notification obligations to the Office of the Data Protection Commissioner and to data subjects.

9. Return and deletion

When your Services end, you have 30 days to export your data, as set out in Section 9.3 of the Terms of Service. After that period we delete Client Personal Data from our live systems. Copies in backups expire at the end of the backup retention period in our Service Level Agreement. We may keep data for longer only where the law requires it.

10. Demonstrating compliance

On written request, we will provide the information reasonably necessary to show that we meet our obligations under this Addendum. Any audit or inspection beyond this must be agreed in writing in advance, including its scope, timing and costs.

11. Liability and precedence

Each party's liability under this Addendum is subject to the limitations in Section 19 of the Terms of Service. If this Addendum and the Terms of Service conflict on the processing of Client Personal Data, this Addendum prevails. This Addendum changes in the same way as the Terms of Service, as set out in Section 24, and disputes are resolved under Sections 22 and 23 of the Terms of Service.

12. Contact

  • Privacy and data protection: privacy@nisccloud.com
  • Company: NISC CLOUD LIMITED, registration number PVT-ZQUX33PK
  • Address: Applewood, Office 805, Ngong Road, Nairobi, Kenya
  • ODPC Registration No.: 160-3417-5D07

Related documents