Data Processing Agreement
Last updated: 1 October 2026
This Data Processing Agreement ("DPA") is between Noria Technologies LTD ("Noria", "we", "us"), which operates BillGrid, and the business that owns a BillGrid workspace ("you"). It sets out how we process personal data on your behalf, as section 42 of the Data Protection Act, 2019 requires. It forms part of the Terms of Service.
You accept this DPA for your workspace when you create it, and again from Settings > Data protection in BillGrid if it changes. Acceptance is recorded against the workspace with the version, the date and the person who accepted. If you need a signed copy, write to [email protected] and we will countersign one with the same terms.
1. Definitions
- Act means the Data Protection Act, 2019 and the regulations made under it. "Personal data", "processing", "data subject", "data controller", "data processor" and "Data Commissioner" have the meanings in the Act.
- Customer Personal Data means personal data that you, or your customers, put into your BillGrid workspace, as described in Annex 1.
- Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
2. Roles
- You are the data controller of Customer Personal Data. We are your data processor.
- We are a data controller only for the details of your own staff who sign in to BillGrid, which we handle under our Privacy Policy.
3. Our obligations
- We process Customer Personal Data only on your documented instructions. The Terms of Service, this DPA, any signed agreement between us, and the way you use and configure BillGrid are your instructions.
- We tell you promptly if we believe an instruction breaks the Act.
- Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.
- We do not sell Customer Personal Data or use it for our own marketing.
4. Your obligations
By accepting this DPA you confirm that:
- you are the data controller for the contacts and customers you upload, and BillGrid processes them only on your instructions;
- you have a lawful basis under the Act to hold this data and to contact these people by email, SMS or WhatsApp;
- you have given these people a privacy notice, and you will honour opt-outs and data subject requests they raise with you;
- you are registered with the Office of the Data Protection Commissioner where your processing requires it.
You will not load sensitive personal data into BillGrid unless it is necessary for billing and you have a lawful basis for it.
5. Security
We apply technical and organisational measures appropriate to the risk, including those in Annex 3, and keep them under review.
6. Sub-processors
- You authorise us to use the categories of sub-processors in Annex 2.
- We give at least 14 days' notice, by email to your workspace owner, before adding or replacing a sub-processor. You may object on reasonable data protection grounds. If we cannot resolve the objection, you may end your subscription without penalty.
- We put written terms in place with each sub-processor that protect Customer Personal Data at least as well as this DPA, and we remain responsible to you for their work.
7. Transfers outside Kenya
Where Customer Personal Data is transferred outside Kenya, we make sure the transfer meets the requirements of Part VI of the Act, including appropriate safeguards, and we give you details on request.
8. Data subject rights
- If a data subject contacts us about Customer Personal Data, we pass the request to you within 5 business days and do not answer it ourselves unless you ask us to.
- BillGrid lets you find, export, correct and erase a person's data from Settings > Data protection. We give further reasonable help where you need it to respond to a request.
9. Personal data breaches
- We notify you without delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach.
- The notice describes, as far as we know at the time, what happened, the data and people likely to be affected, the likely consequences, and what we have done and propose to do. We add details as they become available.
- We help you meet your own duty to notify the Data Commissioner within 72 hours and, where required, the people affected.
10. Impact assessments
We give you reasonable information and help where you carry out a data protection impact assessment, or consult the Data Commissioner, about processing in BillGrid.
11. Return and deletion
- You can export your data from BillGrid at any time. When your subscription ends, you have 30 days to export it.
- We then delete Customer Personal Data within 90 days, including from backups as they expire, except where the law requires us to keep a record, such as financial and tax records. Anything we keep stays protected under this DPA for as long as we keep it.
12. Audit
- We make available the information reasonably needed to show that we comply with this DPA.
- Once a year, on at least 30 days' notice, you may audit our compliance, or appoint an independent auditor bound by confidentiality to do so, at your cost, during business hours and without disrupting our operations. An audit may also take place after a Personal Data Breach or at the request of the Data Commissioner.
13. Liability, term and law
- The limits of liability in the Terms of Service, or in any signed agreement between us, apply to this DPA.
- This DPA lasts for as long as we process Customer Personal Data for you.
- This DPA is governed by the laws of Kenya.
Annex 1. Details of the processing
| Subject matter | Hosting and processing your billing, messaging and payment records in BillGrid |
| Duration | Your subscription, plus the return and deletion period in section 11 |
| Nature and purpose | Storing customer and account records; recording meter readings and service; calculating and issuing bills; sending bills, receipts and reminders by email, SMS and WhatsApp; receiving and matching payments; producing statements and reports |
| Data subjects | Your customers, tenants and occupants, property owners, payers, and your field staff |
| Categories of data | Names; phone numbers; email addresses; physical and postal addresses; account, meter and unit numbers; ID or KRA PIN numbers where you record them; meter readings and consumption; bills, balances and payment history; M-Pesa, card and bank transaction references; messages sent; meter and site photos |
| Sensitive data | None expected |
Annex 2. Sub-processor categories
| Category | Purpose |
|---|---|
| Mobile-money payment providers | Collecting mobile-money payments and sending payouts |
| Card and bank payment providers | Card and bank payment processing |
| Messaging providers (SMS and WhatsApp) | Delivering messages and returning delivery status |
| Email delivery providers | Delivering bills, receipts and notices by email |
| AI and model providers | AI-assisted drafting, summaries and suggestions you trigger |
| Hosting, storage and monitoring providers | Running the service, storing data and backups, and detecting errors |
A current list of named sub-processors is available on request at [email protected].
Annex 3. Security measures
| Encryption | Data encrypted in transit and at rest |
| Separation | Each workspace is kept strictly separate from every other |
| Access | Role-based access inside each workspace; Noria staff access limited to those who need it, and logged |
| Monitoring | Systems monitored for errors, unusual activity and security events |
| Resilience | Regular backups and tested recovery procedures |
| People | Staff and contractors bound by confidentiality and trained on data protection |
| Review | Measures reviewed regularly and after any incident |
Contact
Noria Technologies LTD, P.O. Box 32159 - 00600, Nairobi. [email protected].