Data Processing Agreement

Parties and incorporation

This Data Processing Agreement (“DPA”) is between the organisation that uses Shaka (the “Customer”, controller) and Shaka Labs Ltd (the “Processor”). It is effective 23 August 2026 and is incorporated into the Terms of Service. A signed Master Service Agreement may attach this DPA as an exhibit.

This DPA applies to personal data in Customer content that we process to provide the service — mailbox content, attachments, organisation chat, assistant history tied to those mailboxes, and API payloads for a Customer mailbox. It does not replace the Privacy Policy for account and billing data where Shaka Labs Ltd is controller.

Subject matter, nature, and duration

Subject matter: hosting and transmission of company email and related collaboration features at mail.shaka.rw. Nature: collection, storage, retrieval, transmission, deletion, and — when the Customer’s users enable them — automated analysis by an AI assistant. Duration: the term of the Customer’s organisation on the service, plus deletion or return as set out below.

Purpose and instructions

The Processor will process Customer personal data only: (a) to provide Shaka as configured by the Customer; (b) as documented in the Terms, this DPA, and the product UI; and (c) as required by law (in which case we will notify the Customer unless legally prohibited). The Customer’s instructions are the product’s ordinary functions — including send, receive, forward, search, trash, API access, webhooks, chat, and optional AI.

Types of data and data subjects

Typical categories (determined by the Customer’s use):

• Email addresses, names, phone numbers, and other identifiers in messages.
• Message bodies, attachments, and metadata (folders, timestamps, read state).
• Chat messages and media among organisation members.
• Special-category or sensitive data only if the Customer or its correspondents put it in mail — the service is not designed as a dedicated health or children’s platform.

Data subjects typically include the Customer’s staff, contacts, and anyone who emails a Customer mailbox.

Customer obligations

The Customer will:

1. Ensure it has a lawful basis under Rwanda Law Nº 058/2021 (and any other applicable law) to collect and store the content it places in Shaka.
2. Configure administrators, forwarding destinations, API keys, and webhooks responsibly.
3. Not instruct processing that would make the Processor breach the law.
4. Handle data-subject requests that relate to Customer content, unless the request is clearly for account data that Shaka Labs Ltd controls.

Processor obligations

Shaka Labs Ltd will:

1. Process Customer personal data only on documented instructions, including with respect to transfers.
2. Ensure persons authorised to process the data are under confidentiality duties.
3. Implement the security measures in the security section below.
4. Engage subprocessors only as this DPA allows.
5. Assist the Customer, taking into account the nature of processing, with data-subject requests and with the Customer’s duties on security and breach notification.
6. Delete or return Customer content at the end of the service, at the Customer’s choice, unless law requires storage.
7. Make available information reasonably necessary to demonstrate compliance with this DPA.

Subprocessors

The Customer authorises the Processor to use the subprocessors listed in the appendix. We will impose data-protection terms no less protective than this DPA in substance. We may update the list as the stack changes; material additions will be reflected on this page. Continued use after an update constitutes authorisation. The Customer may object to a new subprocessor by writing to info@shaka.rw or calling +250 799 762 749 and, if we cannot accommodate the objection, may terminate the affected organisation as its remedy.

Appendix A — subprocessors

• Cloudflare, Inc. and affiliates — application hosting (Workers), D1, R2, KV, Email Routing, Durable Objects, DNS, Workers AI. Regions as operated by Cloudflare.
• Resend, Inc. — transactional and user-initiated outbound email. May use Amazon Web Services (Amazon SES) as infrastructure.
• IntouchPay — Mobile Money payment collection in Rwanda (account/billing data; not mailbox bodies).
• Push infrastructure of the user’s browser or OS when the user enables notifications.

Security measures

Without limiting the Customer’s own responsibilities, we maintain:

• Access control: hashed passwords, session cookies, organisation isolation by domain, admin-gated mailbox creation, and API bearer keys.
• Transport security: HTTPS for the app and APIs.
• Separation: customer mail stored per organisation/mailbox records; chat limited to the same email domain.
• Least-privilege operational access for Shaka Labs Ltd personnel, used to run, secure, and support the service.
• Vendor security of Cloudflare and Resend as platform controls we rely on.
• No customer-held end-to-end encryption of mail or chat — do not treat the product as E2EE.

Personal data breach

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer content, and will provide information we can reasonably give to help the Customer meet its notification duties under Rwanda Law 058/2021. Notification is sent to a known organisation admin mailbox or info@shaka.rw if no admin can be reached.

AI as a processing activity

When a user of the Customer invokes the assistant or similar AI features, the Processor will submit the context required for that feature to Workers AI and may store the thread so the user can continue it. This is an instructed processing activity of the service, not a separate product. The Customer is responsible for any internal policy that forbids staff from using AI on mailbox content.

Deletion and return

During the subscription the Customer may export or download content through the product (mail, attachments) as available. After termination or written request, we will delete Customer content from production systems within a reasonable period, except backups that expire on a rolling cycle and data we must keep by law. Return means providing export through the product or, for a reasonable fee if the product cannot do so, a mutually agreed extract.

Audits

The Customer may request, no more than once per twelve months (unless a competent authority requires more), a written description of security measures. On-site or intrusive testing of Cloudflare or shared infrastructure is not offered. We may satisfy audit rights with independent platform reports from subprocessors where they exist.

International transfers

The Customer instructs the Processor to transfer Customer personal data to subprocessors outside the Republic of Rwanda as needed to provide the service. Those transfers are part of the documented instructions.

Liability

Liability under this DPA is subject to the limitations in the Terms (or the signed MSA if one exists), except that nothing in this DPA limits either party’s liability to a data subject that cannot be limited by law.

Term

This DPA lasts for as long as the Processor processes Customer personal data under the Terms or MSA. Survival: confidentiality, deletion, and liability provisions survive termination.

Governing law

This DPA is governed by the laws of the Republic of Rwanda, consistent with the Terms, unless a signed MSA states otherwise.

Contact

DPA notices: info@shaka.rw or +250 799 762 749.