ShivorA Solutions Limited
Data Processing Agreement
Contents
Part A — the agreement. 1. Roles · 2. Instructions · 3. Confidentiality · 3A. Data protection officer · 4. Security · 5. Sub-processors · 6. Assisting you with individuals’ rights · 7. Personal data breach · 8. Impact assessments · 9. Deletion and return · 10. Audit · 11. Storage location and cross-border transfer · 12. Liability · Annex 1 details of processing · Annex 2 security measures · Annex 3 sub-processors · Signature block.
Part B — the notice shown to the people whose location is recorded.
PART A — THE AGREEMENT
1. Roles
1.1 This Agreement applies where Shivora Solutions (“Processor”, “we”) processes personal data on behalf of the Customer (“Controller”, “you”) in providing ClientConnect.
1.2 You are the Controller. You determine the purposes and means of processing personal data in your account — including the personal data of your own personnel and of your own customers. We are the Processor and act only on your documented instructions.
1.3 Precedence. This Agreement forms part of the Terms of Service. Where it conflicts with the Terms of Service on any matter of data protection, this Agreement prevails.
1.4 This Agreement does not apply to data for which we are ourselves the controller — our website visitors, sales enquiries, support requests and billing contacts. Those are governed by our Privacy Policy.
2. Instructions
2.1 We will process personal data only on your documented instructions, which comprise this Agreement, the Terms of Service, your configuration of the Service, and any further written instruction you give that we accept.
2.2 We will tell you if, in our opinion, an instruction infringes applicable data protection law. We may decline an instruction that would require us to break the law.
2.3 If we can no longer comply. If at any time we determine that we can no longer meet our obligations under this Agreement or under applicable data protection law, we will tell you without undue delay, and you may suspend the transfer of personal data or terminate the affected part of the Service.
2.4 We will not sell personal data, use it for advertising, or use it to train artificial-intelligence models for our own benefit or that of any third party.
3. Confidentiality
Everyone we authorise to process personal data is bound by a duty of confidentiality and is given access only to what their role requires.
3A. Data protection officer
Section 48(1) requires both a data controller and a data processor to appoint a data protection officer, in accordance with guidelines issued by the Data Protection Commissioner. Our data protection contact point is support@shivora.co.zm, and every request, objection and breach notification under this Agreement reaches it. You are responsible for appointing your own.
4. Security
4.1 We implement the technical and organisational measures set out in Annex 2.
4.2 We will not materially reduce those measures during the term.
5. Sub-processors
5.1 You give general authorisation for us to engage the sub-processors listed in Annex 3.
5.2 We remain responsible for each sub-processor’s performance and impose data protection obligations on it no less protective than this Agreement.
**5.3 ** We will give you at least 30 days’ written notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds within that period, we will work with you in good faith to find an alternative; if none is available, you may terminate the affected part of the Service and receive a pro-rata refund for the unused period.
5.4 Document-reading providers specifically. Uploaded documents are transmitted to the artificial-intelligence provider identified in Annex 3 for text extraction. A change of that provider is treated as a change of sub-processor under 5.3 and will be notified in advance.
6. Assisting you with individuals’ rights
6.1 If an individual contacts us directly with a request about data in your account, we will not respond substantively. We will tell them to contact you, and tell you promptly.
6.2 We will assist you in responding to requests for access, correction, deletion, restriction, objection and portability. The Service provides you with tools to export an individual’s data and to erase or anonymise it.
6.3 Objection and withdrawal of consent. Where you instruct us that a data subject has objected under section 15(9), or has withdrawn consent under section 15(6), we will stop the processing you identify without undue delay and confirm what has been stopped. Recording an objection against a person stops their location being processed from that moment: no position is recorded, and the refusal is enforced by the Service itself rather than by the application on their device, so it holds even for a device running an older version of the app.
6.3.1 A person for whom an objection is recorded can still use the Service and start a working day. This is deliberate: location is otherwise required to check in, so an objection that also stopped somebody working would be a right they could not exercise.
6.3.2 Objecting stops FUTURE processing. It does not delete existing records — section 15(7) requires destruction of what is collected after a withdrawal, and earlier records may be ones you are required to keep. Deletion of existing personal data is a separate request, handled under clause 6.2 and clause 9.
6.3.3 Where processing cannot be stopped because the record is one you are required to keep, we will tell you which record and on what basis, rather than continuing silently.
6.4 Where erasure would remove a financial or legally required record, the Service anonymises the individual’s details and retains the record. We will tell you where this applies.
7. Personal data breach
7.1 We will notify you of a personal data breach affecting your data without undue delay and in any event within 12 hours of becoming aware of it, so that you retain sufficient time to meet your own obligation under section 49(1).
7.2 The notification will describe the nature of the breach, the categories and approximate number of individuals and records affected so far as known, the likely consequences, and the measures taken or proposed.
7.3 We will assist you in meeting your own notification obligations. Notifying the Commissioner within 24 hours (section 49(1)) and notifying affected individuals as soon as practicable (section 49(3)) are your responsibilities as Controller. We will provide what you need to do so, and will not wait to be asked.
8. Impact assessments
We will provide reasonable assistance with data protection impact assessments and prior consultations relating to your use of the Service, taking into account the information available to us.
9. Deletion and return
9.1 On termination, we will handle Customer Data as set out in clause 9 of the Terms of Service: available for export for 30 days, then deleted or anonymised.
9.2 We may retain personal data where required by law, and only for as long as required. We will tell you what has been retained and why.
9.3 Confirmation. On written request following deletion, we will confirm in writing what has been deleted and what, if anything, has been retained under 9.2.
9.4 Duration. This Agreement takes effect with the Terms of Service and continues for as long as we process personal data on your behalf. Clauses 3 (confidentiality), 7 (breach), 9 (deletion), 11 (transfers) and 12 (liability) survive its termination in respect of data still held.
10. Audit
10.1 We will make available the information reasonably necessary to demonstrate compliance with this Agreement.
**10.2 ** Where you reasonably require an audit, it will be conducted on at least 30 days’ notice, no more than once in any twelve-month period (unless required by a regulator or following a breach), during business hours, without unreasonable disruption, subject to confidentiality, and at your cost.
11. Storage location and cross-border transfer
11.1 Where the data is. Customer Data is stored in Ireland. Our infrastructure provider offers no region in Zambia or elsewhere in Africa. Sub-processors listed in Annex 3 operate in the European Union and the United States.
11.2 Basis for transfer. Transfers of personal data outside Zambia are made in accordance with Part X of the Data Protection Act, and our arrangements with the Data Protection Commission are in place. We will provide details of the applicable safeguards on request.
11.3 Registration. Shivora Solutions is registered with the Data Protection Commission as a data controller and as a data processor, and will provide its registration details on request. We will notify the Commission of any change in our registered particulars within the period the Act requires, and will tell you if our registration status changes.
11.4 Your instruction. By using the Service you instruct us to store Customer Data as described in 11.1. Clause 2.2 applies if we conclude that an instruction cannot lawfully be followed.
11.5 Sensitive personal data. The Service is not designed to collect the categories the Act treats as sensitive personal data and does not request them. Section 70(3) requires sensitive personal data to be processed and stored in Zambia, so you should instruct your personnel not to enter such data into free-text fields or capture it in photographs. If you need to process sensitive personal data through the Service, tell us before you do — we will agree the arrangements with you in writing rather than let it arrive unannounced.
12. Liability
Liability under this Agreement is subject to the limitations in clause 14 of the Terms of Service.
ANNEX 1 — Details of processing
Subject matter. Provision of the ClientConnect customer relationship management service.
Duration. The Subscription Term, plus the retention periods in clause 9.
Nature and purpose. Hosting, storage, retrieval, computation, analysis and transmission of Customer Data in order to operate the Service, record field activity, extract text from uploaded documents, produce reports, and deliver notifications.
Categories of data subject.
- The Controller’s personnel — managers, sales representatives, field representatives
- The Controller’s own customers and their contact persons
- The Controller’s suppliers, where named on uploaded documents
Categories of personal data.
- Identity and contact: name, mobile number, email, employee code, job role, profile image
- Location data: precise geolocation recorded in the background between check-in and check-out; routes; stop locations, arrival and departure times; distance travelled
- Images: photographs taken at customer visits; images of payment proof
- Documents: enquiries, quotations, purchase orders, delivery notes, invoices, and the personal data they contain
- Commercial records: customers, contacts, orders, deliveries, invoices, payments, targets, tasks
- Technical: device and application information, crash diagnostics, usage events, notification token
- Security: authentication events, administrative actions, audit records
Special categories. None are intentionally collected. The Service does not request them. Uploaded free-text and photographs could incidentally contain them; you should instruct your personnel accordingly.
ANNEX 2 — Technical and organisational measures
Measures are described by the protection they provide. Further implementation detail is available under non-disclosure to a Customer conducting a security assessment.
- Segregation of Customer Data. Each Customer’s data is logically isolated from every other Customer’s. Isolation is enforced centrally on every request rather than by individual application screens, so it cannot be disabled by a defect in one part of the product, and it is verified continuously as part of the release process.
- Least-privilege access within an account. Access is constrained by role at the point data is retrieved, not merely hidden in the interface. Roles that must not reach commercial or pricing information cannot retrieve it by any route the product exposes.
- Authentication and session control. Minimum password strength; forced password change on issue and on reset; two-factor authentication available and enforceable for privileged roles; immediate session revocation; controls against repeated failed sign-in attempts.
- Encryption. Industry-standard encryption in transit and at rest, including for backups. Where local caching on a device is enabled, that store is encrypted on the device.
- File protection. Uploaded files are never publicly addressable and are released only through expiring links issued to an entitled recipient.
- Logging and monitoring. Authentication events, administrative actions and changes to material records are logged. Error monitoring and alerting are in operation.
- Backup and recovery. Regular backups with point-in-time recovery.
- Change control. Changes are version-controlled, reviewed, and validated by an automated test suite including data-integrity and access-control assertions before release.
- Credential handling. Credentials granting privileged access are held in a managed secret store, are rotated, and are never included in the mobile or web application.
- Personnel. Access is limited to those who require it, under confidentiality obligations.
- Sub-processor diligence. Each sub-processor is bound to obligations no less protective than those in this Agreement.
ANNEX 3 — Authorised sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage — primary hosting of all Customer Data | Ireland |
| Google LLC — Firebase Cloud Messaging | Delivery of push notifications | Google infrastructure |
| Google LLC — Gemini | Text extraction from uploaded documents; text embeddings; phrasing of report commentary; interpretation of typed questions | Google infrastructure |
| Geoapify GmbH | Conversion of approximate coordinates (rounded to ~11 m) into place names. Receives coordinates only, never identity. | European Union |
| Google LLC — Maps | Map imagery | Google infrastructure |
| Functional Software, Inc. (Sentry) | Crash and error diagnostics | Sentry infrastructure |
| PostHog, Inc. | Product usage analytics | PostHog infrastructure |
Not currently engaged, and listed so that engaging one is a visible decision: Anthropic and OpenAI are available as alternative document-reading providers in the Service’s configuration but are not enabled; Google Roads and the PowerSync offline mirror are present but not enabled. Enabling any of these is a sub-processor change under clause 5.3.
PART B — WHAT YOUR STAFF ARE ASKED
ClientConnect uses the phone’s own location permission prompt. There is no separate disclosure screen: the app requests location the ordinary way, and each person’s answer — allowed or refused — is recorded against them with a timestamp. We will make that record available to you as evidence of consent under section 15(4).
Location is required to start a working day. A person who refuses the permission cannot check in, and is told plainly why and how to change it. A person whose phone simply cannot get a fix — indoors, a cold start — does check in, and the session is marked as having no position so you can see it. Refusing and being unable to are recorded as different things.
Tracking runs only between check-in and check-out, inside a foreground service, with a permanent notification visible on the device for the whole time it is running.