Data Processing Agreement

Lead Provider data may only be used for the specific solar installation enquiry it was purchased for. All other uses are strictly prohibited.

1. Scope & Definitions

This Data Processing Agreement (DPA) applies to all installers and B2B partners ("Processor") who access personal data of Lead Providers ("Data Subjects") through SolrMarket ("Controller"). It supplements the Installer Agreement.

2. Purpose Limitation

Personal data received through SolrMarket may be used ONLY for the specific solar installation enquiry it was purchased for. Any other use — including marketing, profiling, resale, transfer to third parties, or bulk processing — is strictly prohibited.

3. Confidentiality

Processor agrees to maintain the confidentiality of personal data and ensure that all personnel authorised to process it are subject to confidentiality obligations.

4. Security Measures

Processor must implement appropriate technical and organisational measures: encryption at rest and in transit, access controls (role-based), audit logging, regular security assessments, secure deletion of data when retention ends.

5. Sub-Processors

Processor may not engage sub-processors to handle Lead Provider data without prior written consent of SolrMarket.

6. Data Subject Rights

Processor must assist SolrMarket in responding to Data Subject requests within 48 hours.

7. Personal Data Breach

Processor must notify SolrMarket of any personal data breach within 24 hours of becoming aware.

8. International Transfers

Cross-border transfers of personal data require appropriate safeguards.

9. Data Retention & Deletion

Lead Provider data must be deleted from Processor systems within the period defined by the Installer Agreement.

10. Audit Rights

SolrMarket reserves the right to audit Processor's compliance with this DPA upon reasonable notice.

11. Liability

Processor is liable for damages caused by processing in breach of this DPA, applicable data protection law, or the Installer Agreement.

12. Applicable Law

This DPA observes Kenya DPA 2019, POPIA (South Africa), GDPR (where EU Data Subject data is processed), India DPDP 2023.

13. Term & Termination

This DPA remains in effect for the duration of the Installer Agreement.

14. Contact

Data Protection Officer queries: privacy@solrmarket.ai.