Data Processing Agreement
Effective 2 November 2026. This DPA forms part of the Customer's agreement with Mansa Fleet Ltd ("Mansa") and applies whenever Mansa processes personal data inside Customer Content in Mansa Drive or Mansa Invoices. The Customer is the controller and Mansa is the processor. It is accepted automatically with the Terms of Service or the Master Service Agreement, whose definitions it uses.
Mansa Fleet Ltd is being registered in Kenya. These documents are being reviewed by our lawyer; we will give 30 days’ notice of any material change.
Processing details
| Item | Detail |
|---|---|
| Subject matter | Hosting, reading, indexing, calculating with, displaying and backing up the Customer's records |
| Duration | The subscription term plus the deletion period in clause 8 |
| Purpose | Providing the Service as configured by the Customer, including settlement statements, document records and reminders |
| Data subjects | Customer's Users, staff, drivers, owner-operators, dispatchers, clients, suppliers and anyone else named in records |
| Personal data | Names, contact details, the last 4 characters of ID or licence numbers, the last 6 of fuel cards, pay, deduction and load details, signatures, and anything else the Customer uploads |
| Special categories | Only if the Customer chooses to upload them (for example medical cards or drug and alcohol test results in driver files); the Customer is responsible for having a lawful basis. US protected health information under HIPAA is not permitted (Terms, Acceptable use), and Mansa does not act as a HIPAA business associate |
Clauses
- Instructions. Mansa processes personal data only on the Customer's documented instructions, which are the agreement, the Customer's settings and its use of the Service. Mansa will tell the Customer if it believes an instruction breaks data protection law and may refuse to follow it.
- Customer duties. The Customer confirms it has a lawful basis and any notices or consents needed for every piece of personal data it uploads, and that its instructions comply with the law. The Customer indemnifies the Mansa Parties against claims caused by data it had no right to upload or process. Driving records (MVRs) and MVR scores are obtained by the Customer, not Mansa. The Customer is responsible for getting them lawfully, including any driver authorisation and permitted-use rules (in the US, for example, the Driver's Privacy Protection Act and, for hiring or employment decisions, the Fair Credit Reporting Act), and for any decision it makes based on them. Mansa only stores what the Customer enters and does not check, calculate or verify MVR scores. When the Customer asks the Service to copy records between Mansa Invoices and Mansa Drive, that is processing within Mansa on the Customer's instructions, and the Customer must have the authority to keep those records in both.
- Confidentiality. Everyone at Mansa with access to personal data is bound by confidentiality and gets access only when their job needs it.
- Security. Mansa keeps appropriate technical and organisational measures, including encryption in transit, role-based access, file type checks and size limits on upload, audit logging, staff access controls, storing only partial card and ID numbers, end-to-end encryption of Mansa Drive password vault entries (AES-256-GCM, with keys wrapped per user by RSA-OAEP and passphrase-derived keys), and optional company encryption in Mansa Invoices (AES-256-GCM with a PBKDF2-SHA256 key). The Security page lists further measures and when they arrive. Mansa may update these measures if protection does not go down.
- Subprocessors. The Customer gives general authorisation for Mansa to use Subprocessors, including the providers for hosting, file storage, AI text reading, email and payments listed on the Subprocessors page. Mansa will give 30 days' notice of a new Subprocessor. The Customer may object on reasonable data protection grounds. If no fix is agreed, the Customer's only remedy is to end the affected Service and receive a pro-rata refund of prepaid fees for it. Mansa binds each Subprocessor to data protection terms no less protective than this DPA, or relies on the provider's own published data processing terms where it cannot negotiate them.
- Assistance. Mansa will help the Customer, at the Customer's reasonable cost, answer data subject requests, carry out impact assessments and consult regulators, where the Customer cannot do so through the Service's own tools.
- Personal data breach. Mansa will notify the Customer without undue delay, and within 72 hours, after becoming aware of a breach affecting the Customer's personal data. The notice gives what is known at the time and is updated as facts emerge. Notice is not an admission of fault or liability.
- Return and deletion. The Customer can export its data at any time during the term. After the term ends, Mansa deletes Customer Content and Extracted Text within 30 days, and from backups within a further 35 days, unless the law requires keeping it.
- Audits. Mansa will provide the information reasonably needed to show compliance with this DPA, such as security summaries and certifications when available. On-site audits happen at most once a year, with 30 days' notice, during business hours, under confidentiality, and at the Customer's cost, unless a regulator requires otherwise.
- International transfers. Where personal data leaves the country where it was collected, Mansa uses a lawful transfer method, such as the EU Standard Contractual Clauses (incorporated by reference where they apply) or the safeguards under the Kenya Data Protection Act 2019 and its regulations.
- Liability. Each party's liability under this DPA is subject to the limitations and exclusions in the Terms or MSA. They apply to all claims under this DPA combined, and do not create a separate or higher cap.
- Order of precedence. For personal data processing, this DPA prevails over the Terms and MSA. The Standard Contractual Clauses prevail over this DPA where they apply.
Questions: [email protected].