Lexiscript Data Processing Agreement

Version 1.0 · Last updated: 25 October 2026

This Data Processing Agreement (“DPA”) forms part of the Lexiscript Terms of Service. It applies whenever Lexiscript processes personal data on your behalf, which in practice means when the Lexiscript consent widget runs on your website or Shopify store.

1. Parties and how this DPA applies

You (“the Controller”) are the business that runs the website or store on which the Lexiscript consent widget is installed, whether you signed up directly at lexiscript.jaytechkenya.com, through the WordPress plugin or through the Shopify App Store.

We (“the Processor”) are JAYDEE INNOVATION HUB, a registered business at Heshima Road, Nairobi, Kenya, which operates Lexiscript.

This DPA takes effect automatically when you install or enable the consent widget, and lasts as long as the widget is in use on any of your websites. If you need a copy signed by both parties for your records, email support@jaytechkenya.com with your business name and the websites concerned, and we will return a countersigned copy of this same text.

If this DPA and the Terms of Service conflict on a data protection matter, this DPA wins.

2. What is processed, and why

What is not covered by this DPA. The visitor’s consent choice is stored in the visitor’s own browser and, on Shopify, passed to Shopify’s Customer Privacy API. It is not sent to us. The Lexiscript scanner visits your site as an anonymous browser and does not collect personal data about your visitors. Your own account details (your name, business, email and billing details) are processed by us as a controller under our Privacy Policy, not under this DPA.

3. Our obligations as your processor

We will:

• Follow your instructions. Process the personal data only to provide the consent widget as described in section 2, which is your documented instruction. Your settings in the Lexiscript dashboard (regions, categories and banner options) are further instructions. If we believe an instruction breaks the GDPR, the UK GDPR or Kenya’s Data Protection Act, 2019, we will tell you.
• Keep it confidential. Make sure anyone we authorise to access the personal data is bound by a duty of confidentiality.
• Keep it secure. Apply the technical and organisational measures in Annex 1.
• Help you with people’s rights. If a visitor asks us directly to access, correct or erase their data, we will pass the request to you and not answer it ourselves unless you ask us to. Because we do not keep visitor IP addresses as part of your records, there is normally nothing for us to return or erase, and we will tell you so.
• Help you with your own obligations. Give you the information you reasonably need for security, breach notifications, data protection impact assessments and consultations with a supervisory authority, as far as they relate to Lexiscript.
• Tell you about breaches. Notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting data we process for you, with the details we have at the time and updates as we learn more.
• Delete at the end. When you remove the widget or close your account, stop processing visitor data for your websites. We hold no stored copies of visitor data to return or delete.
• Show our compliance. Make available the information reasonably needed to demonstrate that we meet this DPA, and answer reasonable written questions. An audit or inspection beyond written answers can be requested once a year with 30 days’ notice, at your cost, carried out by you or an independent auditor bound by confidentiality.

4. Your obligations as controller

• You decide whether to use Lexiscript on your website and how to configure it, and you are responsible for having a lawful basis for that processing.
• You tell your visitors about the processing in your own privacy notice. Lexiscript can generate a starting draft; it is an unreviewed template, not legal advice.
• You only install the widget on websites you own or are authorised to manage.

5. Sub-processors

You give us general authorisation to use the sub-processors listed in Annex 2. Before we add or replace a sub-processor that processes visitor data, we will update Annex 2 and email account holders at least 30 days in advance. If you object on reasonable data protection grounds, tell us within that period; if we cannot address the objection, you may stop using the widget and cancel without penalty. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible to you for their performance.

Shopify is not our sub-processor. If you use the Shopify App Store, Shopify is the platform you chose to run your store on, and your relationship with Shopify is governed by your own agreement with them.

6. International transfers

JAYDEE INNOVATION HUB is established in Kenya and has no establishment in the European Economic Area or the United Kingdom. Kenya is not covered by a European Commission adequacy decision. The widget is delivered from Cloudflare’s global network, so a visitor’s request may be handled in a data centre close to them.

To the extent that personal data subject to the GDPR or UK GDPR is transferred to us, the parties agree that:

• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference, with you as data exporter and us as data importer; the optional docking clause (Clause 7) applies; under Clause 9 option 2 (general authorisation) applies with the notice period in section 5; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by and subject to the courts of Ireland; and Annexes I to III of the Clauses are completed by sections 1 and 2 and Annexes 1 and 2 of this DPA;
• for transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0, issued by the Information Commissioner) applies, with the tables completed by the information in this DPA, and either party may end the Addendum as set out in its Section 19;
• if the Clauses or the Addendum conflict with this DPA, the Clauses or the Addendum win.

Where Kenyan law applies, we process personal data in line with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, including the duties of a data processor under section 42 of the Act.

7. Liability

Each party’s liability under this DPA is subject to the limitation of liability in the Lexiscript Terms of Service, except where the applicable law or the Standard Contractual Clauses do not allow liability to be limited.

8. Changes

We may update this DPA to reflect changes in law or in how Lexiscript works. The version and date at the top show the current text. We will email account holders before any change that reduces the protection given to visitor data.

9. A note on infrastructure logs

Requests to the widget pass through Cloudflare, which may keep short-term request logs, including IP addresses, for security and operation of its network under its own data processing terms. These logs are not part of your Lexiscript account or scan records.

Annex 1: Technical and organisational security measures

• Data minimisation by design: the widget only needs a region, not an identity. Consent choices stay in the visitor’s browser and are never sent to us.
• Encryption in transit: the widget and the Lexiscript dashboard are served only over HTTPS.
• Edge protection: the widget is delivered from Cloudflare’s network, which provides DDoS protection and filtering of malicious traffic.
• Access control: every dashboard request is checked against real ownership of the record, so one merchant cannot read another’s data, even by guessing an ID.
• Session security: sign-in uses short-lived, httpOnly session cookies that page JavaScript cannot read; passwords are stored only as secure hashes.
• Separation of services: the scanner runs as its own service, apart from the dashboard.
• Least privilege on Shopify: the Shopify app requests no access scopes, so it cannot read orders, products or customer records.
• People: access to production systems is limited to the staff who operate Lexiscript, who are bound by confidentiality.

Annex 2: Sub-processors

Contact

JAYDEE INNOVATION HUB · Heshima Road, Nairobi, Kenya · support@jaytechkenya.com · +254 792 335 470

This agreement is a template provided for transparency. It is not legal advice; please have it reviewed by a qualified advocate before relying on it.