Data Processing Agreement

Parties and incorporation

This Data Processing Agreement (“DPA”) is between the organisation that uses Shaka (the “Customer”, controller) and Shaka Labs (the “Processor”). It is effective 16 October 2026 and is incorporated into the Terms of Service. A signed Master Service Agreement may attach this DPA as an exhibit.

The Processor is Shaka Labs, a private company limited by shares registered by RDB, company code and TIN 156935461, registered office Kaminuza, Bugoyi, Gisenyi, Rubavu District, Western Province, Republic of Rwanda.

This DPA applies to personal data in Customer content that we process to provide the service: mailbox content, attachments, organisation chat, assistant history tied to those mailboxes, and API payloads for a Customer mailbox. It does not replace the Privacy Policy for account and billing data where Shaka Labs is controller.

Subject matter, nature, and duration

Subject matter: hosting and transmission of company email and related collaboration features at mail.shaka.rw. Nature: collection, storage, retrieval, transmission, deletion, and automated analysis by AI assistance (summaries, reply suggestions, and the assistant) unless the Customer’s users turn it off. Duration: the term of the Customer’s organisation on the service, plus deletion or return as set out below.

Purpose and instructions

The Processor will process Customer personal data only: (a) to provide Shaka as configured by the Customer; (b) as documented in the Terms, this DPA, and the product UI; and (c) as required by law (in which case we will notify the Customer unless legally prohibited). The Customer’s instructions are the product’s ordinary functions, including send, receive, forward, search, trash, API access, webhooks, chat, and AI assistance.

Types of data and data subjects

Typical categories (determined by the Customer’s use):

• Email addresses, names, phone numbers, and other identifiers in messages.
• Message bodies, attachments, and metadata (folders, timestamps, read state).
• Chat messages and media among organisation members.
• Special-category or sensitive data only if the Customer or its correspondents put it in mail. The service is not designed as a dedicated health or children’s platform.

Data subjects typically include the Customer’s staff, contacts, and anyone who emails a Customer mailbox.

Customer obligations

The Customer will:

1. Ensure it has a lawful basis under Rwanda Law Nº 058/2021 (and any other applicable law) to collect and store the content it places in Shaka.
2. Configure administrators, forwarding destinations, API keys, and webhooks responsibly.
3. Not instruct processing that would make the Processor breach the law.
4. Handle data-subject requests that relate to Customer content, unless the request is clearly for account data that Shaka Labs controls.

Processor obligations

Shaka Labs will:

1. Process Customer personal data only on documented instructions, including with respect to transfers.
2. Ensure persons authorised to process the data are under confidentiality duties, and log every time platform staff open a Customer mailbox.
3. Implement the security measures in the security section below.
4. Engage subprocessors only as this DPA allows.
5. Assist the Customer, taking into account the nature of processing, with data-subject requests and with the Customer’s duties on security and breach notification.
6. Let the Customer download its content, and delete it at the end of the service, as set out in “Deletion and return”, unless law requires storage.
7. Make available information reasonably necessary to demonstrate compliance with this DPA.

Subprocessors

The Customer authorises the Processor to use the subprocessors listed in the appendix. We rely on each subprocessor’s contract terms, which include data-protection commitments. Before we add a subprocessor that will receive Customer content, we update the appendix and email organisation administrators at least 30 days in advance. The Customer may object to a new subprocessor by writing to info@shaka.rw or calling +250 799 762 749 and, if we cannot accommodate the objection, may terminate the affected organisation and receive a pro-rata refund of the unused prepaid period.

Appendix A: subprocessors

Security measures

Without limiting the Customer’s own responsibilities, we maintain:

• Access control: hashed passwords, session cookies, organisation isolation by domain, admin-gated mailbox creation, and API bearer keys.
• Transport security: HTTPS for the app and APIs.
• Separation: customer mail stored per organisation/mailbox records; chat limited to the same email domain.
• Least-privilege operational access for Shaka Labs personnel, used to run, secure, and support the service. Every time staff or an organisation administrator opens a mailbox, it is logged.
• Vendor security of Cloudflare and Resend as platform controls we rely on.
• Backups: we rely on Cloudflare D1’s point-in-time recovery for the database. We keep no separate backup copy.
• No customer-held end-to-end encryption of mail or chat. Do not treat the product as end-to-end encrypted.

Personal data breach

We will notify the Customer within 48 hours after becoming aware of a personal data breach affecting Customer content, and will provide the information we can reasonably give to help the Customer meet its notification duties under Rwanda Law 058/2021. We also notify the National Cyber Security Authority (NCSA) within 48 hours. Notification to the Customer is sent to its organisation administrator mailbox and, if that cannot be reached, to another contact we have for the Customer.

AI as a processing activity

When a user of the Customer opens an email, its text is sent to Cloudflare Workers AI for reply suggestions; in chat, the last message is sent for reply suggestions; and when the user asks the assistant, the context needed is sent and the thread is stored so the user can continue it. Users can turn this off in your Profile, under AI assistance. Cloudflare does not train models on this content. This is an instructed processing activity of the service, not a separate product.

Deletion and return

At any time, including after a plan ends and until deletion, the Customer’s users can download a copy of their mail from your Profile, under Your data, Download my mail. When a plan ends, we keep Customer content as set out in “When a plan ends” in the Terms of Service: at least 60 days after the grace period, with at least 14 days’ notice by email before we delete anything. After that, or on the Customer’s written request, we delete Customer content from our systems, except data we must keep by law. Deleted data leaves Cloudflare D1’s point-in-time recovery window when that window expires.

Audits

The Customer may request, no more than once per twelve months (unless a competent authority requires more), a written description of security measures. On-site or intrusive testing of Cloudflare or shared infrastructure is not offered. Subprocessors’ own audit reports are available from each subprocessor’s trust portal.

International transfers

The Customer instructs the Processor to transfer Customer personal data to subprocessors outside the Republic of Rwanda as needed to provide the service: the database and file storage are in Western Europe, and outbound mail passes through the United States. Those transfers are part of the documented instructions. Safeguards: each subprocessor is bound by contract terms with data-protection commitments, and data is encrypted in transit.

Liability

Liability under this DPA is subject to the limitations in the Terms (or the signed MSA if one exists), except that nothing in this DPA limits either party’s liability to a data subject that cannot be limited by law.

Term

This DPA lasts for as long as the Processor processes Customer personal data under the Terms or MSA. Survival: confidentiality, deletion, and liability provisions survive termination.

Governing law

This DPA is governed by the laws of the Republic of Rwanda, consistent with the Terms, unless a signed MSA states otherwise.

Contact

DPA notices: info@shaka.rw or +250 799 762 749.