Anansi Technology Data Governance & Processor Charter

1. Executive Summary & Purpose

Anansi Technology (“Anansi”) provides cloud software infrastructure, core digitization, and automation platforms to Savings and Credit Co-operative Organizations (SACCOs) and financial institutions.

In the operation of our platforms, our client SACCOs act as Data Controllers—determining the purposes, lawful bases, and rules for member data collection. Anansi Technology acts as a Data Processor, executing automated processing, system configuration, hosting, and technical operations strictly on behalf of and under documented instructions from the SACCO.

This Charter outlines our institutional data governance commitments, technical safeguards, and operational principles to assure our client partners of our compliance with the Kenya Data Protection Act (DPA 2019) and guidelines issued by the Office of the Data Protection Commissioner (ODPC).

2. Core Governance Principles

When executing processing operations for SACCO systems, Anansi adheres strictly to the fundamental principles set out in Section 25 of the Data Protection Act:

1. Instruction-Bound Processing: We process member personal data solely to fulfill service agreements, system maintenance, and platform functionality requested by the client SACCO.
2. Purpose & Data Minimization: Systems are architected so that staff and automated workflows access only the minimum data elements necessary to perform functional tasks.
3. Data Localization & Sovereignty: In compliance with Kenya ODPC localization mandates, primary production databases and active secondary backups storing SACCO member records are hosted within secure, localized data center environments or compliant regional cloud infrastructure meeting statutory data residence requirements.
4. Confidentiality & Access Control: All Anansi engineering, quality assurance, and technical support personnel are bound by non-disclosure obligations and strict Role-Based Access Control (RBAC) protocols.

3. Technical & Organizational Safeguards

Anansi implements defense-in-depth technical and organizational measures (TOMs) to maintain the integrity and confidentiality of processing systems:

• Data Encryption: All member data in transit across public or internal networks is protected using TLS 1.3 encryption. Data stored at rest in databases, backups, and media volumes is encrypted using industry-standard AES-256 encryption.
• Access Governance & Identity Management: Access to production database environments is strictly restricted to authorized engineering personnel through Multi-Factor Authentication (MFA), temporary privileged credentials, and jump-box architectures.
• Audit Logging & System Transparency: Anansi systems automatically generate tamper-evident audit trails for key system operations, including record modification, administrative actions, and system access, enabling SACCO compliance officers to audit system activity.
• Data Isolation: Client SACCO data is logically segregated within multi-tenant platforms or physically isolated in dedicated database environments to prevent cross-contamination or unauthorized access between organizations.

4. Incident Response & Breach Notification Protocol

Anansi maintains an active Incident Response Strategy to detect, isolate, and mitigate potential security events.

• Notification Timeline: In the event of a confirmed or reasonably suspected personal data breach affecting a client SACCO’s dataset, Anansi will notify the affected SACCO’s designated primary contact within 48 hours of discovery, enabling the SACCO to fulfill its statutory 72-hour reporting obligations to the ODPC.
• Breach Containment & Reporting: Notifications will include the nature of the event, estimated categories of data records involved, immediate containment actions taken, and recommended mitigation steps.

5. Support for Data Subject Rights (DSR) & ODPC Compliance

Because data subject rights (access, correction, erasure, and objection) are legally directed to the Data Controller, Anansi supports SACCOs in fulfilling these obligations through embedded software capabilities:

• Self-Service Technical Tools: Anansi platforms provide built-in administrative tools allowing SACCO administrators to export member profile records, rectify erroneous data, or mark accounts for restricted processing directly.
• Technical Assistance: Where a complex Data Subject Request requires backend database intervention, Anansi provides dedicated technical assistance to execute the validated request within 10 business days of receiving written authorization from the SACCO.
• Data Protection Impact Assessments (DPIAs): Anansi assists SACCO compliance teams by providing technical documentation, platform architecture reviews, and risk assessments required during the SACCO’s statutory DPIA reviews.

6. Sub-Processors & Infrastructure Partners

Anansi engages vetted third-party vendors (such as cloud hosting providers, SMS gateways, and payment API aggregators) strictly to deliver platform services.

• Vetting & Contracts: All third-party sub-processors undergo security assessments and are bound by data processing contracts enforcing security standards equal to or higher than those outlined in this Charter.
• Transparency: SACCO partners are provided with an updated inventory of third-party service integrators upon onboarding or during major platform architecture updates.

7. Data Lifecycle, Retention & Deletion

• Data Ownership: All data uploaded to, generated by, or processed through Anansi platforms remains the exclusive property of the client SACCO and its members.
• Termination & Return: Upon termination of a service contract, Anansi provides the client SACCO with full data extraction in structured formats (e.g., SQL dump, CSV, JSON). Following successful handoff and verification, Anansi securely purges or overwrites all client production and staging copies in accordance with secure media sanitization guidelines, retaining only minimum logs required for legal audit compliance.

8. Governance Enquiries & Contact

For questions regarding Anansi’s data processing practices, regulatory compliance documentation, or technical audit requests, contact our Data Governance Officer:

• Email: dpo@anansitechnology.com
• Address: Professional Centre 3rd Floor Ngong Road, Nairobi, Kenya
• Regulatory Compliance: Registered Data Processor with the Office of the Data Protection Commissioner (ODPC).