Data Processing Agreement
Last updated: 13 October 2026 · Version 2026-10-13
The parties
- The Customer: the estate organisation that subscribes to LangoHub. It is the data controller.
- Vanray Systems ("Vanray"): the provider of LangoHub. It is the data processor.
This Data Processing Agreement ("DPA") forms part of the LangoHub Terms of Service. The Customer accepts it when it accepts the Terms. It is written to meet:
- section 42 of the Data Protection Act, 2019 (the "Act"); and
- Regulations 24 and 25 of the Data Protection (General) Regulations, 2021 (the "Regulations").
1. Definitions
| Term | Meaning |
|---|---|
| Personal data, data subject, processing, data controller, data processor, sensitive personal data, personal data breach | As defined in the Act. Plain-language explanations are on our Data Protection Terms page. |
| Estate Data | Personal data processed through LangoHub for the Customer. It covers visitors, residents, guards, staff, domestic workers, delivery riders and blacklist entries. |
| Sub-processor | A third party Vanray engages to process Estate Data. |
| Instructions | The Customer's documented instructions. They are made up of: (a) these Terms and this DPA; (b) the settings and features the Customer chooses in LangoHub; and (c) other reasonable written instructions consistent with them. |
| Controller for each estate | The Customer. Where the Customer subscribes as agent for an estate's owner or management body (for example, a property manager), the Customer confirms it has authority to give Instructions for that estate, and that owner or body is the data controller. |
2. Scope and roles
2.1 Vanray processes Estate Data only on the Customer's Instructions, for the purposes set out in Annex 1.
2.2 If Vanray processes Estate Data other than on the Instructions, it becomes a data controller for that processing (Act, section 42(3)). Vanray will not do so, except where the law requires it. In that case Vanray will tell the Customer before processing, unless the law prohibits telling it.
2.3 Vanray will tell the Customer promptly if, in its opinion, an instruction breaks the Act.
3. The Customer's obligations
The Customer is responsible for the matters below.
Lawful collection and use
- (a) having a lawful basis for each type of Estate Data it collects;
- (b) collecting only what is necessary; and
- (c) using gate data only for identification and security (Private Security Regulation Act, 2016, section 48(3)).
Information and consent
- (d) giving data subjects the information required by section 29 of the Act, including displaying the LangoHub visitor notice at each gate;
- (e) obtaining consent where it is the lawful basis, such as for residents' WhatsApp alerts; and
- (f) informing pre-registered visitors whose details a resident entered, within 14 days, where the law requires (Regulation 6(3)). The gate notice, the visitor link and the notice line in the access-code message do this.
Content of Estate Data
- (g) keeping Estate Data accurate; and
- (h) not putting sensitive personal data into LangoHub beyond the minimum needed for access control. Sensitive personal data is defined in section 2 of the Act and includes health status, ethnic or social origin, belief, family details, and sex or sexual orientation. Recording a parent who accompanies a child is an example of the minimum.
Requests, registration and impact assessments
- (i) responding to data-subject requests, with Vanray's help;
- (j) its own registration with the Office of the Data Protection Commissioner (ODPC) where required; and
- (k) carrying out any data protection impact assessment needed for its own use of LangoHub. Vanray will help.
4. Vanray's obligations
4.1 Instructions and confidentiality
Vanray will:
- process Estate Data only on the Instructions; and
- ensure everyone it authorises to process Estate Data is bound by confidentiality.
4.2 Security
Vanray will keep in place the technical and organisational measures in Annex 2 (also on our Security page). These measures:
- meet section 41 of the Act and Regulation 32; and
- are reviewed regularly.
Vanray may improve these measures, but will not materially reduce them.
4.3 Help with data-subject requests
Vanray will:
- (a) forward any request it receives about Estate Data to the Customer within 2 working days;
- (b) provide tools in LangoHub for the Customer to find, export, correct, restrict and erase a person's records; and
- (c) help the Customer meet the deadlines in Regulations 7 to 12:
- 7 days for access;
- 14 days for correction, erasure, objection and restriction; and
- 30 days for portability.
4.4 Help with compliance
Vanray will give the Customer reasonable help with:
- impact assessments;
- consultations with the Data Commissioner;
- breach notifications; and
- ODPC enquiries about LangoHub.
4.5 Personal data breaches
Vanray will notify the Customer without delay, and where reasonably practicable within 48 hours, of becoming aware of a personal data breach affecting Estate Data (Act, section 43(3)).
What the notice will contain. As far as the information is available (Regulation 38):
- (a) when and how the breach was discovered;
- (b) what happened;
- (c) the cause;
- (d) the categories and approximate number of people and records affected;
- (e) the likely consequences;
- (f) measures taken or proposed; and
- (g) a contact person.
After the notice. Vanray may provide information in phases. It will help the Customer notify:
- the Data Commissioner, within 72 hours of the Customer becoming aware; and
- affected people, where required.
Vanray keeps a record of every breach.
4.6 No other use
Vanray will not:
- use Estate Data for its own purposes;
- sell it;
- use it for marketing; or
- share it across estates.
Vanray may create anonymised statistics that cannot identify any person or estate.
4.7 Access by Vanray staff
Vanray staff may access an estate's records only:
- to give support the Customer asks for;
- to investigate faults, security issues or misuse; or
- where the law requires it.
This access is recorded in the audit log, and the Customer can ask for those records.
4.8 Requests from authorities
If an authority asks Vanray for Estate Data, Vanray will:
- refer the authority to the Customer where possible;
- disclose only what is legally required; and
- tell the Customer, unless the law prohibits it.
5. Sub-processors
5.1 Authorisation. The Customer gives general authorisation for Vanray to use the sub-processors listed on our Sub-processors page (Annex 3).
5.2 Contracts with sub-processors. Vanray will impose data-protection terms on each sub-processor that are no less protective than this DPA, including the particulars in Regulation 24(2). Vanray remains liable to the Customer for its sub-processors (Regulation 25(4)).
5.3 New sub-processors. Vanray will give at least 30 days' notice, by email and in the app, before a new sub-processor starts processing Estate Data.
5.4 Objections.
- The Customer may object on reasonable data-protection grounds within 14 days of the notice.
- If the parties cannot resolve the objection, the Customer may end the affected service and receive a pro-rata refund of prepaid fees.
6. Transfers outside Kenya
6.1 Authorisation. The Customer authorises Vanray to transfer Estate Data to the countries listed in Annex 3. The main hosting is in the United States, in Amazon Web Services' Oregon region, through Lovable Cloud and Supabase.
6.2 Safeguards. These transfers rely on appropriate safeguards under section 48 of the Act and Regulations 40–41:
- contracts with providers that include data-protection terms and standard contractual clauses;
- encryption in transit and at rest;
- access controls; and
- data minimisation.
6.3 Records of transfers. Vanray keeps the records required by Regulation 41(2) and will provide them to the Customer or the Data Commissioner on request.
6.4 Sensitive personal data. LangoHub is not designed to process sensitive personal data. Sensitive personal data may be transferred outside Kenya only with the data subject's consent and confirmed safeguards (section 49).
6.5 ODPC standard clauses. On request, the parties will sign the ODPC's standard contractual clauses for controller-to-processor transfers.
6.6 Localisation. If the law later requires any Estate Data to be stored in Kenya, the parties will cooperate to comply.
7. Retention, deletion and return
7.1 During the subscription. Estate Data is deleted automatically according to the Retention Schedule, or a shorter period the Customer sets. The Customer may place a legal hold on specific records linked to an incident under investigation (section 40(3)).
7.2 When the subscription ends. At the Customer's choice (Regulation 24(2)(e)):
- the Customer can export its records during the 30 days after the end; and
- Vanray then deletes all Estate Data within a further 30 days.
Backups are overwritten in the normal backup cycle. Vanray will confirm deletion in writing on request.
8. Audits and information
8.1 Vanray will make available the information reasonably needed to show compliance with this DPA, including summaries of its security measures and sub-processor commitments.
8.2 Audits by the Customer. The Customer may audit Vanray's compliance, at its own cost, on these terms:
- once a year, or after a breach;
- with 30 days' notice;
- during business hours; and
- in a way that does not compromise other customers' data.
Vanray may meet an audit request by providing reports or certifications from its providers.
9. Liability
9.1 Each party is responsible for the damage its own processing causes, as set out in section 65 of the Act.
9.2 Vanray is liable for damage caused by processing only where it:
- breached the duties the Act places on processors; or
- acted outside or against the Customer's lawful Instructions.
9.3 Otherwise, the limits in the Terms apply, to the extent the law allows.
10. Term and precedence
10.1 This DPA lasts as long as Vanray processes Estate Data.
10.2 If this DPA and the Terms conflict on data protection, this DPA prevails.
10.3 This DPA is governed by the laws of Kenya, and disputes follow the Terms.
Annex 1: Details of the processing (Regulation 24(2)(a))
| Item | Details |
|---|---|
| Subject matter | Providing the LangoHub visitor-management service to the Customer's estate. |
| Duration | For the subscription, plus the export and deletion periods in clause 7. |
| Nature of processing | Collection at the gate and through resident pre-registration, storage, organisation, retrieval, display, transmission (alerts), export, correction, restriction and erasure. |
| Purposes | Identifying and logging people and vehicles entering and leaving the estate; telling residents about arrivals; managing domestic-staff passes and deliveries; recording incidents; keeping an estate blacklist; reports for the estate; securing the service. |
| Categories of data subjects | Visitors; residents; guards and estate staff; estate managers; domestic staff; delivery riders; people on the estate blacklist. |
| Types of personal data | Names; phone numbers; email addresses (users); ID, passport or driving-licence numbers; unit visited; purpose; date and time in and out; gate; number plates and vehicle type; plain photos of visitors and vehicles (optional); notes; incident descriptions; blacklist reasons and expiry dates; staff-pass schedules; user roles; hashed PINs; device identifiers; audit logs; message delivery status. |
| Sensitive personal data | Not intended, beyond incidental details needed for access control (such as the unit a resident lives in, or a parent accompanying a child). No biometric data: there is no facial recognition. ID images are not stored by LangoHub. |
| Frequency | Continuous. |
| Retention | See the Retention Schedule. Visit records and photos are kept 12 months by default, and the Customer can choose a shorter period. |
Annex 2: Technical and organisational security measures
These are described in full on our Security page. In summary:
- Encryption: TLS in transit, and encryption at rest by the hosting provider.
- Separation between estates: database row-level security walls off each estate's data.
- Access by role: each role sees only what it needs.
- Guard PINs: stored only in hashed form.
- Gate devices: must be registered, and can be revoked.
- Photos: kept in private storage, shown only through expiring links, never included in CSV exports, and provided only on request.
- ID images: not stored by LangoHub.
- Audit log: covers administrative and support actions.
- Automated retention: records are deleted on schedule.
- Backups: made by the hosting provider.
- Staff: confidentiality commitments and least-privilege access.
- Breach response: a breach-response procedure with a 48-hour notice to the Customer.
- Maintenance: regular dependency and security updates.
Annex 3: Sub-processors and transfer countries
These are listed on our Sub-processors page, which forms part of this DPA.