Legal
Data Processing Addendum
Data-processing terms governing Haiya’s processing of Customer Personal Data on behalf of business customers.
Effective and last updated: 13 November 2026
The short version
You control your customer data; Haiya processes it on your documented instructions to provide and secure the Service.
This summary is provided for convenience. The complete policy below governs.
1. Application and definitions
This Data Processing Addendum (“DPA”) forms part of the agreement between the customer using Haiya (“Customer”) and Quest Website Developers Ltd (“Quest”), the owner and operator of the Haiya service, where Quest processes Customer Personal Data on Customer’s behalf. It applies for the duration of the Service and prevails over conflicting data-processing terms in the main agreement. “Applicable Data Protection Law” means laws governing the processing covered by this DPA, including the Kenya Data Protection Act, 2019 and, where applicable, the GDPR or UK GDPR. “Customer Personal Data”, “controller”, “processor”, “data subject”, “processing” and “personal data breach” have the meanings given by applicable law.
2. Roles and instructions
Customer is the controller or a processor authorised by the relevant controller. Haiya is Customer’s processor or sub-processor. Customer instructs Haiya to process Customer Personal Data to provide, maintain, secure and support the Service; enable features Customer configures; comply with documented requests; and meet legal obligations. The agreement, product configuration and Customer’s authorised use constitute documented instructions. Haiya will process Customer Personal Data only on those instructions unless law requires otherwise, in which case Haiya will notify Customer before processing unless prohibited. Haiya will promptly tell Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law.
3. Processing details
Subject matter and purpose: providing a shared business inbox, messaging, CRM, automation, analytics, integrations, storage, security, support and optional AI-assisted features. Duration: the term of the Service plus the limited deletion, backup and legal-retention periods described in the agreement. Nature: collection, receipt, transmission, organisation, storage, retrieval, consultation, use, analysis, alteration, disclosure to authorised recipients, restriction, deletion and anonymisation. Data subjects: Customer’s prospects and customers; Customer personnel, contractors and invited users; and other people whose data Customer submits. Data types: identity and contact information; WhatsApp and business-account identifiers; messages, attachments and metadata; CRM, lead, tag, note and activity data; templates and campaign data; device, usage and security data; integration data; and AI instructions or knowledge sources Customer chooses to provide. Customer should not submit sensitive data unless necessary, lawful and supported by appropriate safeguards.
4. Customer obligations
Customer will comply with Applicable Data Protection Law; provide all required notices; establish a lawful basis; obtain and record required messaging consent; issue lawful instructions; configure access and retention appropriately; respond to data-subject requests; and ensure Customer Personal Data is accurate and limited to what is necessary. Customer is responsible for determining whether the Service is appropriate for regulated or sensitive processing and for completing any required impact assessment.
5. Confidentiality and personnel
Haiya will ensure that people authorised to process Customer Personal Data are subject to confidentiality obligations, receive appropriate privacy and security guidance, and access data only as necessary for their responsibilities. Confidentiality obligations survive the end of their engagement.
6. Security measures
Taking account of the state of the art, implementation cost, processing context and risk, Haiya will maintain appropriate technical and organisational measures. These include, as applicable: encryption in transit; hashed or otherwise protected credentials; role-based and workspace-scoped access; secure session and token handling; logging and monitoring; vulnerability and dependency management; incident response; and procedures for reviewing access. Customer is responsible for its endpoint devices, user permissions, connected services, webhook destinations, credentials and lawful configuration. No measure eliminates all risk, and security obligations are assessed proportionately under applicable law.
7. Sub-processors
Customer authorises Haiya to use sub-processors needed to provide the Service, including infrastructure and storage providers; Meta and the WhatsApp Business Platform; email and notification delivery providers; Apple and Google services; support and monitoring providers; and AI/model infrastructure when Customer enables those features. Haiya will impose data-protection obligations appropriate to each sub-processor’s services and remains responsible for its processing to the extent required by law. The current sub-processors are listed at haiya.co/legal/sub-processors; Haiya updates that page before a new sub-processor processes Customer Personal Data. Services the Customer connects with its own accounts (such as M-Pesa, Paystack or an AI provider for the Team assistant) process data under the Customer’s agreement with that service and are not Haiya sub-processors. Haiya will provide information about current material sub-processors on request and reasonable notice of a new sub-processor where required. Customer may object on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable solution; if none is available, Customer may stop the affected feature or terminate it in accordance with the agreement.
8. International transfers
Customer authorises transfers necessary to provide the Service. Haiya will not transfer Customer Personal Data across borders unless permitted by Applicable Data Protection Law and protected by an appropriate mechanism. Depending on the transfer, this may include an adequacy decision, approved standard contractual clauses, contractual and technical safeguards, or another lawful mechanism. Haiya will provide reasonably requested information relevant to Customer’s transfer assessment.
9. Data-subject requests and compliance assistance
Taking account of the nature of processing, Haiya will provide reasonable assistance for Customer to respond to requests to access, correct, restrict, export, object to or delete Customer Personal Data. If Haiya receives a request relating to data Customer controls, Haiya will direct the requester to Customer and notify Customer where legally permitted. Haiya will not independently fulfil the request unless instructed or legally required. Haiya will also provide reasonable information and assistance for security obligations, breach notifications, data-protection impact assessments and regulator consultations, considering the information available to Haiya. Additional work beyond normal Service functionality may be chargeable where permitted and agreed.
10. Personal data breaches
Haiya will notify Customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer Personal Data. The notice will include information reasonably available about the nature of the breach, likely consequences, affected data and people, and mitigation taken or proposed. Information may be provided in phases as the investigation develops. Customer is responsible for notifications it must make as controller. A notification is not an admission of fault or liability.
11. Return and deletion
During the Service, Customer may use available export and deletion controls. On termination or written instruction, Haiya will delete or return Customer Personal Data within a commercially reasonable period, unless law requires retention. Where backups exist, data in them is deleted as they are overwritten under normal cycles, and stays subject to this DPA. Deletion of an individual user may preserve anonymised shared business history as explained in the Privacy Policy.
12. Information and audits
Haiya will make available information reasonably necessary to demonstrate compliance with this DPA. Customer may request relevant security documentation or, where that is insufficient and law requires, an audit by an independent qualified auditor. Audits require reasonable advance notice, must avoid disruption, protect other customers and confidential information, and occur no more than once annually unless a breach or regulator requires otherwise. The requester bears reasonable costs unless the audit identifies a material breach by Haiya.
13. Liability, termination and contact
Liability arising under this DPA is subject to the exclusions and limits in the main agreement to the extent permitted by law. This DPA ends when Quest no longer processes Customer Personal Data through Haiya, except provisions that must survive to protect retained data. Data-protection questions and requests concerning this DPA may be sent to support@haiya.co or made by phone at +254 722 925 311. The contracting processor is Quest Website Developers Ltd, company number CPR/2014/172802, Muguku Business Center, 2nd Floor, Suite 2R, Posta Road, Kikuyu, Kiambu County 00902, Kenya.
Questions or requests
Email support@haiya.co or call or WhatsApp +254 722 925 311. Please do not send passwords, access tokens or unnecessary message content.