Last updated: 7 July 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Customer") and BNN LTD ("BNN", "we", "us"), operator of MemberBot (the "Service"), and applies where BNN processes personal data about the Customer's members on the Customer's behalf. It is made under the Kenya Data Protection Act, 2019 and, where applicable, Article 28 of the GDPR/UK GDPR.
For personal data about the Customer's members processed through the Service, the Customer is the data controller and BNN is the data processor. The Customer is responsible for having a lawful basis and appropriate notices for that data. (BNN is the controller for the Customer's own account data, as described in our Privacy Policy.)
BNN processes member personal data only to provide and support the Service, and only on the Customer's documented instructions (including as given through the Service's features and configuration), unless required to act otherwise by applicable law — in which case BNN will inform the Customer where legally permitted.
BNN ensures that personnel authorised to process the data are bound by confidentiality and process the data only as necessary to provide the Service.
BNN implements appropriate technical and organisational measures, including: encryption in transit (TLS) and encryption of sensitive stored credentials; strict per-tenant isolation enforced at the database level (row-level security); hashed passwords; access controls; and regular, encrypted backups. These measures are described further in our Privacy Policy.
The Customer authorises BNN to engage the sub-processors listed in our Privacy Policy (currently Paddle, PayPal, NOWPayments, Safaricom/M-Pesa, DigitalOcean, Cloudflare, Apple/iCloud, OpenAI, and Telegram) to help provide the Service. BNN imposes data-protection obligations on each sub-processor no less protective than this DPA, and remains responsible for their performance. We will give reasonable notice of any new sub-processor; if the Customer reasonably objects on data-protection grounds, the Customer may terminate the affected Service. Payment providers the Customer connects act under their own terms and are not BNN sub-processors.
Taking into account the nature of the processing, BNN will provide reasonable assistance to enable the Customer to: (a) respond to data-subject requests (access, rectification, erasure, restriction, portability, objection); and (b) meet its obligations regarding security, breach notification, and, where required, data protection impact assessments. Where BNN receives a request directly from a member, it will refer that member to the Customer.
BNN will notify the Customer without undue delay after becoming aware of a personal-data breach affecting member data, with the information reasonably available to help the Customer meet its notification obligations to the ODPC, a supervisory authority, and affected individuals.
Where processing member data involves a transfer outside Kenya (or outside the EEA/UK), BNN relies on appropriate safeguards — such as standard contractual clauses and each sub-processor's compliance framework — as required by the Kenya Data Protection Act and the GDPR.
On termination of the Service, or at the Customer's request, BNN will delete or return member personal data within a limited period, except where retention is required by law. The Customer can also export or delete workspace data through the Service at any time.
BNN will make available information reasonably necessary to demonstrate compliance with this DPA and, subject to confidentiality and reasonable notice, will allow for audits by the Customer or an independent auditor to the extent required by applicable law.
This DPA is governed by the laws of Kenya. If there is a conflict between this DPA and the Terms of Service on the subject of data protection, this DPA prevails.
| Subject matter | Provision of the MemberBot membership/subscription service to the Customer. |
|---|---|
| Duration | For the term of the Customer's use of the Service, plus the retention window described in the Privacy Policy. |
| Nature & purpose | Hosting, storing, and processing member data to sell and manage access to the Customer's Telegram communities (subscriptions, payments records, access grants, member management, storefront, support). |
| Categories of data | Telegram user IDs, usernames and first names; subscription and payment records; phone numbers (M-Pesa payers); access/entitlement records; messages sent to the bot needed to deliver access or support. |
| Data subjects | The Customer's members and prospective members. |
BNN LTD, Kenya — [email protected].
MemberBot is a service of BNN LTD.