Last updated: 24 September 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Customer") and Edgar Obare, a sole proprietor ("we", "us"), operator of MemberBot (the "Service"), and applies where we process personal data about the Customer's members on the Customer's behalf. It is made under the Kenya Data Protection Act, 2019 and, where applicable, Article 28 of the GDPR/UK GDPR.
For personal data about the Customer's members processed through the Service, the Customer is the data controller and we are the data processor. The Customer is responsible for having a lawful basis and appropriate notices for that data. (We are the controller for the Customer's own account data, as described in our Privacy Policy.)
We process member personal data only to provide and support the Service, and only on the Customer's documented instructions (including as given through the Service's features and configuration), unless required to act otherwise by applicable law — in which case we will inform the Customer where legally permitted.
We ensure that anyone authorised to process the data is bound by confidentiality and processes the data only as necessary to provide the Service.
We implement appropriate technical and organisational measures, including: encryption in transit (TLS) and encryption of sensitive stored credentials; strict per-tenant isolation enforced at the database level (row-level security); hashed passwords; access controls; and regular, encrypted backups. These measures are described further in our Privacy Policy.
The Customer authorises us to engage the sub-processors listed in our Privacy Policy (currently PayPal, NOWPayments, Safaricom/M-Pesa, DigitalOcean, Cloudflare, Apple/iCloud, OpenAI, and Telegram) to help provide the Service. We impose data-protection obligations on each sub-processor no less protective than this DPA, and remain responsible for their performance. We will give reasonable notice of any new sub-processor; if the Customer reasonably objects on data-protection grounds, the Customer may terminate the affected Service. Payment providers the Customer connects act under their own terms and are not our sub-processors.
Taking into account the nature of the processing, we will provide reasonable assistance to enable the Customer to: (a) respond to data-subject requests (access, rectification, erasure, restriction, portability, objection); and (b) meet its obligations regarding security, breach notification, and, where required, data protection impact assessments. Where we receive a request directly from a member, we will refer that member to the Customer.
We will notify the Customer without undue delay after becoming aware of a personal-data breach affecting member data, with the information reasonably available to help the Customer meet its notification obligations to the ODPC, a supervisory authority, and affected individuals.
Where processing member data involves a transfer outside Kenya (or outside the EEA/UK), we rely on appropriate safeguards — such as standard contractual clauses and each sub-processor's compliance framework — as required by the Kenya Data Protection Act and the GDPR.
On termination of the Service, or at the Customer's request, we will delete or return member personal data within a limited period, except where retention is required by law. The Customer can also export or delete workspace data through the Service at any time.
We will make available information reasonably necessary to demonstrate compliance with this DPA and, subject to confidentiality and reasonable notice, will allow for audits by the Customer or an independent auditor to the extent required by applicable law.
This DPA is governed by the laws of Kenya. If there is a conflict between this DPA and the Terms of Service on the subject of data protection, this DPA prevails.
| Subject matter | Provision of the MemberBot membership/subscription service to the Customer. |
|---|---|
| Duration | For the term of the Customer's use of the Service, plus the retention window described in the Privacy Policy. |
| Nature & purpose | Hosting, storing, and processing member data to sell and manage access to the Customer's Telegram communities (subscriptions, payments records, access grants, member management, storefront, support). |
| Categories of data | Telegram user IDs, usernames and first names; subscription and payment records; phone numbers (M-Pesa payers); access/entitlement records; messages sent to the bot needed to deliver access or support. |
| Data subjects | The Customer's members and prospective members. |
Edgar Obare, Kenya — our contact form.
MemberBot is a service operated by Edgar Obare.