1. Parties and acceptance
This agreement is offered for review between Edgar Jerry, operating Regio (“processor”), and the business customer identified in written acceptance (“controller”). A customer acting as a processor must have its controller’s authority to engage Regio.
This page is not a signed agreement. Before it takes effect, both parties must record written acceptance identifying the customer, authorised representatives, this dated version, the processing schedule and approved providers, locations and safeguards. Contact edgarjerry0@gmail.com to arrange acceptance. Signup, an invitation or filing authorisation is not evidence of that separate acceptance.
Section 11’s open matters must be resolved in the accepted schedule. Publication does not establish completed provider due diligence or regulatory compliance.
2. Processing schedule
- Subject and purpose
- Providing selected business-record, reconciliation, payroll and tax-preparation tools, support and security on customer instructions.
- Operations
- Receiving, storing, parsing, organising, calculating, retrieving and displaying records, sharing with authorised users, and returning or deleting data under agreed instructions.
- People concerned
- Authorised users, employees, customers, suppliers and other individuals in records lawfully supplied by the customer.
- Information
- Names, contact details, relevant identifiers and KRA PINs, transaction/payment references, invoices, tax and payroll records and operational metadata. Identify sensitive data and special safeguards in the accepted schedule.
- Duration
- The agreed service period and specific return, deletion and legally required retention periods in the accepted schedule. This is not permission for indefinite processing.
3. Instructions and responsibilities
Regio will follow documented lawful instructions, including selected features and authorised settings. The controller determines purposes and lawful grounds, provides required notices, ensures upload authority and avoids unnecessary personal data.
Regio will flag instructions it believes breach data protection law and may suspend them pending resolution. Legally required processing outside instructions will be disclosed unless prohibited. Regio’s own controller activities, including its billing and account security obligations, are described in Privacy.
4. Confidentiality and safeguards
Access must be limited to authorised people with a business need and confidentiality obligations. Regio will apply measures proportionate to the data and risk, including authentication, business access controls, encryption for sensitive stored fields, auditability and incident handling. Provider and backup controls must be documented in the accepted schedule.
The customer controls its users and credentials. Neither party may treat safeguards as a guarantee against every incident.
5. Providers and transfers
Regio must obtain prior controller authorisation before engaging another processor for covered data and impose appropriate processing obligations by contract. The accepted register must identify approved providers, functions, locations and onward processing. Regio remains responsible for its processor obligations.
The inventory includes Vercel, Supabase/PostgreSQL, Upstash, Resend and Sentry. Cloudflare Turnstile, optional Google sign-in and payment services require activity-specific role assessment. This is not proof of provider approval or completed contracts.
Transfers outside Kenya require an applicable lawful basis and safeguards recorded before transfer. Obtain any required authorisation before changing providers or locations. If agreement cannot be reached, the affected processing must not proceed.
6. Rights and regulatory assistance
Regio will assist the controller with rights requests, security and impact assessments, and regulatory enquiries, taking account of the processing and available information. Customer-record requests will be passed on promptly rather than decided independently unless law or instructions require it.
Both parties must cooperate within statutory time limits while verifying identity and authority and protecting other customers.
7. Personal data incidents
Regio will notify the controller without delay and, where reasonably practicable, within 48 hours after becoming aware of a personal data breach affecting covered data. The report will include known facts, affected categories, likely consequences, response measures and a contact. Further information may follow as investigation continues.
Regio will take reasonable containment steps, preserve relevant evidence and assist with notification duties. An initial report is not an admission of liability. The controller retains its own legal notification responsibilities.
8. Return, deletion and retention
At the end of processing, Regio will return or delete covered data at the controller’s documented choice, except data legally required to be retained. The accepted schedule must state available formats, contacts, completion dates, backup treatment and narrow retention exceptions. Retained data remains protected and limited to lawful purposes.
Current limitation: raw statement cleanup is not general deletion. Parsed records, payroll, audits and provider backups lack a comprehensive confirmed disposal schedule. Agree workable dates and legal-hold handling before this agreement takes effect. This text does not implement automatic erasure or a new export tool.
9. Evidence and audit
Regio will provide relevant compliance information and permit reasonable audits or inspections by the controller or its independent auditor. Agreed scope, timing and security arrangements must protect other customers and confidential systems without defeating legal inspection rights.
Material findings require a documented remediation response. Intrusive security testing needs separate written authorisation.
10. Governing terms
Kenyan law governs this agreement. Once accepted, it prevails over conflicting service terms concerning covered personal data. It does not grant filing permission, approve payments, certify integrations or waive statutory rights. Changes require recorded agreement.
11. Acceptance checklist
- Identify the parties, authorised representatives, service address and document version.
- Confirm features, data categories, lawful instructions and special safeguards.
- Approve the provider register, actual locations, onward processing and transfer safeguards.
- Agree record-specific retention, return/deletion dates, backup handling and legal holds.
- Document security measures, incident contacts, rights-request routing and audit arrangements.
Keep the completed schedule and written acceptance with the service agreement. Contact us before sending records dependent on safeguards not yet agreed.
Contact
Regio is operated by Edgar Jerry, an individual. Support and privacy contact: edgarjerry0@gmail.com.
Do not send passwords, one-time codes or full identity documents in an initial email. We may ask for proportionate verification before discussing an account or acting on a data request.