Legal Policies & Service Agreements

Master Terms of Service

1.1 Definitions

"Services" means web hosting (shared, VPS, dedicated, and cloud), domain name registration, DNS management, SSL certificates, email hosting, and any ancillary service listed on routeafrica.net.

"Account" means the client account created through the Route Africa billing portal (rab.routeafrica.net) or successor system.

"Content" means all data, files, databases, email messages, website code, and any other digital material stored on or transmitted through Route Africa infrastructure by the Client or at the Client's direction.

"Infrastructure" means all servers, network equipment, software, and data centre resources operated by or on behalf of Route Africa.

"Force Majeure" means any event beyond a party's reasonable control including natural disasters, war, terrorism, pandemic, government action, upstream provider outages, zero-day security vulnerabilities with no available patch at the time of exploitation, and failures of internet backbone infrastructure.

1.2 Service Agreement Formation

A binding agreement is formed when you complete an order through the Route Africa billing portal, pay the applicable fees, and receive an order confirmation. Each service ordered constitutes a separate service agreement governed by these Master Terms and any service-specific terms referenced herein.

1.3 Client Obligations

1. Maintain accurate and current contact information, including a functional email address monitored regularly. Route Africa's obligation to communicate is fulfilled when notice is sent to the email address on file.
2. Maintain the security of all account credentials. Any action taken through authenticated access to your account is deemed authorised by you.
3. Comply with the Acceptable Use Policy (Section 2) at all times.
4. Maintain independent backups of all Content as specified in the Backup Policy (Section 5). Hosting services are not a substitute for a backup strategy.
5. Cooperate promptly with Route Africa in any security incident response, including completing required migrations within communicated timeframes.
6. Ensure that domain name registrations do not infringe third-party rights.

1.4 Route Africa's Obligations

1. Provide the Services with reasonable skill and care consistent with industry standards.
2. Maintain infrastructure security, including the timely application of security patches in accordance with our patch management procedures (critical/zero-day CVEs: within 72 hours of vendor patch availability; high-severity: within 7 days; medium: within 30 days).
3. Provide advance notice of scheduled maintenance where reasonably practicable, with a minimum of 24 hours for maintenance expected to cause service interruption.
4. Communicate material service disruptions through the NOC email (noc@radns.net) and, where available, through the status page and client portal notifications.
5. Facilitate domain transfers in accordance with applicable registry policies as set out in Section 6.

1.5 Modifications to Terms

Route Africa may modify these terms at any time by posting the updated version at routeafrica.net/legal and notifying clients via email at least thirty (30) days before the effective date of material changes. Continued use of Services after the effective date constitutes acceptance. For changes that materially reduce your rights or increase your obligations, you may terminate the affected service without penalty within thirty (30) days of notification.

1.6 Intellectual Property

Each party retains ownership of its pre-existing intellectual property. The Client retains all rights to their Content. Route Africa retains all rights to its infrastructure, software, documentation, and proprietary tools. Nothing in these terms grants either party rights to the other's intellectual property beyond what is necessary for the performance of the Services.

1.7 Confidentiality

Each party shall treat as confidential all non-public information received from the other party in connection with these terms. This obligation survives termination for a period of three (3) years. Confidentiality obligations do not apply to information that is publicly available, independently developed, lawfully received from a third party, or required to be disclosed by law or regulatory authority.

1.8 Term and Termination

Individual services are provided for the billing period selected at purchase (monthly, quarterly, semi-annually, or annually) and renew automatically unless cancelled. Either party may terminate for cause upon thirty (30) days' written notice if the other party commits a material breach and fails to cure within the notice period. Route Africa may suspend or terminate services immediately upon discovery of AUP violations, non-payment exceeding fourteen (14) days past due, or upon order of a competent authority.

1.9 Effect of Termination

Upon termination, Route Africa will retain Client Content for fourteen (14) calendar days, during which the Client may request data export. After this retention period, all Content will be permanently deleted. Any prepaid fees for the unused portion of the current billing period are subject to the Refund Policy (Section 10). Accrued obligations, confidentiality provisions, limitation of liability, and dispute resolution clauses survive termination.

1.10 Governing Law

These terms are governed by the laws of the United Republic of Tanzania. For services involving specific ccTLDs, the domain-related provisions are additionally subject to the applicable registry regulations (including TCRA's Electronic and Postal Communications (Domain Name System) Regulations, 2020 for .tz domains). The dispute resolution procedures in Section 9 apply before either party may pursue regulatory or judicial remedies.

Acceptable Use Policy

2.1 Purpose

This Acceptable Use Policy ("AUP") defines the boundaries of permitted use on Route Africa infrastructure. It applies to all clients, their end-users, and any party accessing Services through the client's account. Violations may result in immediate suspension without prior notice.

2.2 Prohibited Activities

2.2.1 Illegal Content and Activities

1. Hosting, distributing, or linking to content that violates applicable law in Tanzania or the jurisdiction where the content is accessed.
2. Child sexual abuse material (CSAM) in any form — results in immediate termination, data preservation for law enforcement, and reporting to relevant authorities.
3. Fraud, phishing, identity theft, or financial scams.
4. Sale or distribution of controlled substances in violation of applicable law.
5. Gambling operations without appropriate licences.

2.2.2 Network Abuse

1. Sending unsolicited bulk email (spam). All email must comply with applicable anti-spam laws and include functional unsubscribe mechanisms.
2. Operating open mail relays, open DNS resolvers, or open proxies.
3. Participating in or facilitating distributed denial-of-service (DDoS) attacks.
4. Network scanning, port probing, or vulnerability testing of systems you do not own or have authorisation to test.
5. Running cryptocurrency mining software on shared hosting infrastructure.
6. Running botnets, command-and-control infrastructure, or malware distribution platforms.

2.2.3 Resource Abuse

1. Consuming CPU, memory, disk I/O, or bandwidth in a manner that degrades service for other clients on shared infrastructure.
2. Running persistent background processes on shared hosting accounts without authorisation.
3. Circumventing resource limits or quotas.

2.2.4 Security Violations

1. Attempting to gain unauthorised access to any system, account, or data.
2. Distributing malware, ransomware, spyware, or exploit kits.
3. Interfering with or disrupting the integrity or performance of Route Africa infrastructure.

2.3 Enforcement and Consequences

2.4 Reporting AUP Violations

Reports of abuse should be sent to abuse@routeafrica.net with evidence including timestamps, IP addresses, and logs where available. Route Africa acknowledges abuse reports within 24 hours and provides a substantive response within 72 hours.

2.5 Client Responsibility for End Users

Resellers and clients who provide access to their hosting accounts to third parties are responsible for ensuring those third parties comply with this AUP. Route Africa may hold the account holder liable for violations committed by their end users.

Privacy & Data Protection Policy

3.1 Scope and Applicability

This policy describes how Route Africa collects, processes, stores, and protects personal data. As a pan-African infrastructure provider with registrar accreditations in multiple jurisdictions, Route Africa complies with the data protection laws of each country in which it operates:

Where requirements differ between jurisdictions, Route Africa applies the most protective standard applicable to the data subject's location.

3.2 Data Controller

Route Africa Networks Limited acts as the data controller for personal data collected directly from clients during account registration, billing, and support interactions. For data hosted on Route Africa infrastructure by clients, Route Africa acts as a data processor (see Section 11, Data Processing Agreement).

Contact for data protection matters: privacy@routeafrica.net

3.3 Personal Data We Collect

3.3.1 Data collected directly

1. Account data: name, email address, phone number, physical address, company name, Tax Identification Number (where required for invoicing).
2. Billing data: payment method details (processed and stored by third-party payment processors; Route Africa retains only transaction references and last four digits of card numbers where applicable).
3. Support data: support ticket content, live chat transcripts, call recordings (where disclosed).
4. Domain registration data: registrant contact details as required by the applicable registry (WHOIS data).

3.3.2 Data collected automatically

1. Technical data: IP addresses, browser type, access timestamps, referring URLs when using Route Africa websites and portals.
2. Service data: resource usage metrics, server logs, login records.

3.4 Legal Basis for Processing

1. Contract performance: processing necessary to deliver the Services you have purchased.
2. Legal obligation: compliance with tax, telecommunications, and domain registry requirements.
3. Legitimate interest: infrastructure security, fraud prevention, service improvement, and abuse detection — balanced against your privacy rights.
4. Consent: marketing communications (opt-in only; withdrawable at any time).

3.5 Data Sharing and International Transfers

Route Africa may share personal data with:

1. Domain registries: TZNIC, KENIC, NiRA, ZACR/Registry.net.za, RICTA, UICT as required for domain registration and WHOIS obligations.
2. Payment processors: for transaction processing.
3. Data centre and infrastructure partners: upstream hosting and connectivity providers, subject to data processing agreements.
4. Law enforcement and regulators: where required by law or valid legal process.

Where personal data is transferred outside the data subject's country of residence, Route Africa ensures appropriate safeguards are in place, including contractual data protection clauses with receiving parties.

3.6 Data Subject Rights

Depending on your jurisdiction, you have the right to access, rectify, erase, restrict processing of, and port your personal data, and to object to certain processing. To exercise these rights, contact privacy@routeafrica.net. We will respond within thirty (30) days, or within the shorter timeframe required by applicable law.

3.7 Data Retention

Account data is retained for the duration of the service agreement plus seven (7) years for tax and legal compliance purposes. Service logs are retained for ninety (90) days. Domain registration records are retained as required by the applicable registry. Upon account deletion, personal data is purged from active systems within thirty (30) days, with backup copies purged within ninety (90) days.

3.8 Security Measures

Route Africa implements technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS 1.2+), access controls and authentication, regular security assessments, staff awareness training, and incident response procedures as detailed in Section 7.

Service Level Agreement

4.1 Uptime Commitment

Uptime is measured from Route Africa's monitoring systems at network ingress points. Scheduled maintenance windows, client-caused outages, Force Majeure events, and third-party service failures are excluded from uptime calculations.

4.2 Service Credits

If Route Africa fails to meet the applicable uptime target in any calendar month, the Client is entitled to service credits upon written request submitted within fifteen (15) days of the end of the affected month:

Service credits are applied to future invoices and are the Client's sole and exclusive remedy for SLA breaches. Credits do not accumulate beyond a single month's fee and are not redeemable as cash.

4.3 Support Response Times

Response times are measured during business hours (Monday–Friday 08:00–20:00 EAT, Saturday 09:00–14:00 EAT) except for P1 incidents, which are measured 24/7. Support channels: support tickets via rab.routeafrica.net (primary), email to support@routeafrica.net, and emergency NOC contact at noc@radns.net.

4.4 Escalation Procedures

4.5 Scheduled Maintenance

Scheduled maintenance is performed during low-traffic windows (Tuesday–Thursday, 02:00–06:00 EAT) where possible. Clients receive at least 24 hours' notice for maintenance expected to cause service interruption, and at least 72 hours' notice for maintenance requiring client action (such as server migrations). Emergency maintenance required for security (e.g., critical CVE patching) may be performed with shorter notice, with notification sent as soon as practicable.

Backup Policy

5.1 Route Africa Infrastructure Backups

5.2 Limitations of Route Africa Backups

1. Infrastructure backups are designed for server-level disaster recovery, not individual file or account restoration.
2. Route Africa does not guarantee the availability, completeness, or integrity of any backup.
3. Backups may be unavailable during or following security incidents, hardware failures, or server decommissioning.
4. When a server is decommissioned (whether due to a security incident, hardware end-of-life, or infrastructure consolidation), backups of the decommissioned server are retained for a maximum of thirty (30) days following decommissioning, after which they are permanently deleted.
5. Email data (mailboxes, message content) may not be included in all backup types. Email backup availability varies by server configuration.

5.3 Client Backup Responsibilities

1. Clients must maintain their own independent backup copies of all data, including website files, databases, email, and configuration settings.
2. Clients using cPanel/WHM have access to the cPanel Backup function and, where available, JetBackup for self-service backup and restoration.
3. Route Africa recommends maintaining at least one backup copy stored independently of Route Africa infrastructure (for example, local storage or a separate cloud provider).
4. Route Africa offers optional managed backup add-on services at additional cost, with separate terms governing those services.

5.4 Restoration Requests

Where a backup is available and restoration is technically feasible, Route Africa will make reasonable efforts to restore data upon client request. Restoration from Route Africa infrastructure backups is provided on a best-effort basis with no guarantee of success. Restoration requests are handled as P2 support tickets. A restoration fee may apply for requests requiring significant manual effort.

5.5 Client Acknowledgment

By using Route Africa Services, you acknowledge that:

1. You have read and understood this Backup Policy.
2. Route Africa's infrastructure backups are not a replacement for your own backup strategy.
3. Route Africa is not liable for any loss of data, including but not limited to data loss resulting from security incidents, server migrations, hardware failures, or server decommissioning.
4. You are responsible for verifying the completeness and integrity of your own backup copies.

Domain Registration Agreement

6.1 Registrar Capacity

Route Africa is an accredited registrar for the following ccTLDs: .tz (TZNIC), .ke (KENIC), .ng (NiRA), .za (ZACR/Registry.net.za), .rw (RICTA), and .ug (UICT). For gTLDs, Route Africa acts as a reseller through accredited registrar partners until such time as Route Africa obtains ICANN registrar accreditation.

Domain registration is subject to the policies of the applicable registry, which take precedence over these terms to the extent of any conflict.

6.2 Registration and Renewal

1. Domain registration is on a first-come, first-served basis and does not guarantee name availability.
2. The Client warrants that their registration does not infringe any third-party rights and that the registrant information provided is accurate.
3. Domains renew automatically on the anniversary of registration. Route Africa sends renewal reminders at sixty (60), thirty (30), and seven (7) days before expiry.
4. If a domain is not renewed before expiry, it enters the applicable registry's grace/redemption period. Additional fees may apply for redemption. Route Africa is not responsible for domains that expire due to non-payment.

6.3 Domain Transfers

6.3.1 Transfers Away from Route Africa

1. The Client submits a transfer request via the Route Africa billing portal or by email to support@routeafrica.net.
2. Route Africa will provide the EPP/authorisation code (where the registry supports EPP-based transfers) within two (2) business days of a verified request.
3. For registries that do not use EPP-based transfers (such as certain .tz transfers requiring TZNIC registrar coordination), Route Africa will initiate the registrar-side approval process within two (2) business days and cooperate with the gaining registrar as required by registry procedures.
4. Route Africa will remove any registrar-level transfer locks within two (2) business days of the transfer request, unless the lock is required by registry policy (e.g., 60-day post-registration lock) or a pending dispute.
5. The domain must be in active status (not expired, suspended, or in dispute) for transfer to proceed.
6. No transfer fees are charged by Route Africa for outbound transfers, though the gaining registrar or registry may charge their own fees.

6.3.2 Transfers To Route Africa

Inbound transfers follow the applicable registry's transfer procedures. The Client must obtain an EPP/authorisation code from their current registrar (where applicable) and initiate the transfer through Route Africa's billing portal. Transfer pricing includes a one-year registration extension where the registry supports it.

6.4 WHOIS Data and Privacy

Registrant information is published in accordance with registry requirements. Where a registry offers WHOIS privacy or data redaction services, Route Africa will make these available to clients where permitted. WHOIS data is processed in accordance with Section 3 (Privacy & Data Protection Policy).

6.5 Domain Disputes

Domain name disputes are handled through the applicable registry's dispute resolution mechanism (e.g., TZNIC's dispute procedures under TCRA's Domain Name System Regulations, 2020, or ICANN's UDRP for gTLDs). Route Africa will comply with decisions of competent dispute resolution bodies and regulatory authorities. Route Africa does not act as arbiter in domain disputes between third parties.

6.6 DNS Management

Route Africa provides DNS hosting via the radns.net infrastructure. Clients may use Route Africa's nameservers or configure external nameservers. DNSSEC signing is available for domains where the registry supports it. DNS management tools are accessible through the client portal.

Incident Response & Notification Policy

7.1 Definitions

"Security Incident" means any event that compromises or is reasonably likely to have compromised the confidentiality, integrity, or availability of Route Africa infrastructure or Client Content, including but not limited to unauthorised access, malware infection, data breach, exploitation of software vulnerabilities, and ransomware.

"Personal Data Breach" means a Security Incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

7.2 Incident Classification

7.3 Incident Response Process

1. Detection and Triage — Incident detected via monitoring systems, abuse reports, or vendor advisories. Initial severity classification within one (1) hour.
2. Containment — Immediate measures to prevent spread (isolation of compromised systems, credential rotation, firewall rules). For Critical/High incidents, containment takes priority over client notification.
3. Investigation — Root cause analysis including affected scope, attack vector, timeline, and data impact assessment.
4. Remediation — Vulnerability patching, malware removal, system rebuild or migration as required. Affected clients provided with clear migration instructions and timelines where client action is required.
5. Recovery — Service restoration with verification. Post-migration confirmation to each affected client.
6. Post-Incident Review — Internal review within fourteen (14) days of resolution. Findings documented and used to improve security posture.

7.4 Client Notification Timelines

7.5 Notification Content

Client notifications for Critical and High incidents will include: (a) the nature and scope of the incident; (b) the approximate timeframe of the incident; (c) the data and services potentially affected; (d) the measures taken and being taken to address the incident; (e) any recommended actions for the client; and (f) contact information for further enquiries.

7.6 Regulatory Breach Notification

Where a Security Incident constitutes a Personal Data Breach, Route Africa will notify the applicable supervisory authority within the statutory timeframe:

7.7 Incident Reports

For Critical and High incidents, Route Africa will produce a written incident report within thirty (30) days of resolution. Affected clients may request a copy of the report relevant to their services. Reports are factual and include root cause analysis, remediation actions taken, and measures to prevent recurrence.

Limitation of Liability & Indemnification

8.1 Limitation of Liability

1. No liability for indirect losses. To the maximum extent permitted by applicable law, Route Africa shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, loss of revenue, loss of business, loss of data, loss of goodwill, or business interruption, however caused and under any theory of liability, whether in contract, tort (including negligence), strict liability, or otherwise.
2. Cap on direct damages. Route Africa's total aggregate liability for all claims arising out of or related to any single service agreement shall not exceed the total fees paid by the Client to Route Africa for the specific service giving rise to the claim during the twelve (12) months immediately preceding the event giving rise to the claim.
3. No liability for data loss. Without limiting the above, Route Africa expressly disclaims liability for any loss of or damage to Client Content, including email messages, databases, files, and website data, whether caused by hardware failure, software vulnerability, security incident, server migration, server decommissioning, or any other cause. The Client's sole protection against data loss is the Client's own backup strategy as described in Section 5.
4. Force Majeure. Neither party shall be liable for failure to perform obligations to the extent caused by a Force Majeure event, provided the affected party gives prompt notice and makes reasonable efforts to resume performance.
5. Statutory rights preserved. Nothing in these terms excludes or limits liability for (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any liability that cannot be excluded or limited under applicable mandatory law.

8.2 Indemnification by Client

The Client shall indemnify, defend, and hold harmless Route Africa, its officers, directors, employees, and agents from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising from:

1. The Client's use of Services in violation of these terms or applicable law.
2. The Client's Content, including any claim that such Content infringes the intellectual property rights, privacy, or other rights of any third party.
3. Any dispute between the Client and the Client's end users.
4. The Client's failure to maintain adequate backups of their data.

8.3 Indemnification by Route Africa

Route Africa shall indemnify the Client against any third-party claims arising directly from Route Africa's wilful misconduct or gross negligence in the provision of Services, provided the Client gives prompt written notice of the claim and cooperates in the defence.

8.4 Jurisdiction-Specific Provisions

Where mandatory consumer protection or data protection laws of any jurisdiction in which Route Africa operates impose greater liability or broader remedies than provided in this section, those mandatory provisions shall apply to the extent they cannot be contractually excluded. This section shall be interpreted in the most restrictive manner permitted by applicable law.

Dispute Resolution Policy

9.1 Objective

Route Africa is committed to resolving disputes fairly and efficiently. This section establishes a graduated process designed to resolve matters at the earliest possible stage, preserving the business relationship and avoiding unnecessary regulatory or legal proceedings.

9.2 Escalation Ladder

Step 1 — Direct Resolution (Support Channel)

All complaints and disputes must first be raised through Route Africa's support channels (support ticket or email to support@routeafrica.net). The support team will acknowledge the complaint within 24 hours and provide a substantive response within five (5) business days.

Step 2 — Management Review

If the Client is unsatisfied with the support team's resolution, the Client may request escalation to Route Africa management by emailing escalation@routeafrica.net. A member of the management team will review the matter and respond within ten (10) business days.

Step 3 — Executive Review

If the dispute remains unresolved after management review, either party may escalate to the executive level. The Client may contact the CEO directly. The executive review will produce a written determination within fifteen (15) business days.

Step 4 — Mediation

If the dispute is not resolved through the executive review, either party may propose mediation before a mutually agreed mediator. Mediation costs are shared equally unless the parties agree otherwise. The mediation will be conducted in Dar es Salaam, Tanzania, unless the parties agree to an alternative location or virtual proceedings.

Step 5 — Regulatory or Legal Proceedings

Only after Steps 1 through 4 have been exhausted (or where a party fails to participate in good faith within the stated timeframes) may either party pursue regulatory complaints (such as complaints to TCRA under the Domain Name System Regulations, 2020) or legal proceedings. For domain-specific disputes, the applicable registry's dispute resolution mechanism takes precedence.

9.3 Urgent and Interim Measures

Nothing in this section prevents either party from seeking urgent interim or injunctive relief from a court of competent jurisdiction where necessary to prevent irreparable harm.

9.4 Domain-Specific Disputes

Disputes concerning domain name registration, transfer, or ownership are subject to the dispute resolution procedures of the applicable registry and any relevant regulatory framework. Route Africa will comply with decisions of competent domain dispute resolution bodies. These disputes are not subject to the mediation requirement above.

Refund & Cancellation Policy

10.1 Cancellation Process

To cancel a service, submit a cancellation request through the Route Africa billing portal (rab.routeafrica.net) or by email to billing@routeafrica.net. Cancellations take effect at the end of the current billing period unless an immediate cancellation is requested and approved. Route Africa will confirm receipt of the cancellation request within two (2) business days.

10.2 Refund Eligibility

10.3 Exclusions

Refunds are not available where: (a) the account was suspended or terminated for AUP violations; (b) the cancellation is due to a domain dispute where Route Africa complied with a dispute resolution decision; (c) setup fees, migration fees, or administrative fees have been incurred; or (d) the refund window has expired.

10.4 Refund Method

Refunds are processed to the original payment method within fourteen (14) business days of approval. Where the original payment method is unavailable, Route Africa may issue account credit or arrange an alternative refund method. Mobile money refunds follow the applicable provider's processing times.

10.5 Early Termination of Annual Plans

Clients who cancel an annual plan before the end of the term forfeit the annual discount. If a refund is due for the unused portion, it is calculated at the monthly rate minus any payments already applied. If the recalculated amount at monthly rates exceeds the annual fee paid, no refund is due.

Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Master Terms of Service and applies where Route Africa processes personal data on behalf of a Client who acts as data controller.

11.1 Roles and Scope

The Client is the Data Controller. Route Africa is the Data Processor. The subject matter of processing is the provision of hosting, email, domain, and related infrastructure services. The personal data processed includes any personal data the Client or the Client's end users store on or transmit through Route Africa infrastructure.

11.2 Processing Instructions

Route Africa processes personal data only on the Client's documented instructions, which are constituted by: (a) the Master Terms of Service; (b) the Client's configuration of Services; and (c) any additional written instructions agreed between the parties. Route Africa will inform the Client if it believes an instruction infringes applicable data protection law.

11.3 Confidentiality

Route Africa ensures that persons authorised to process personal data are bound by appropriate obligations of confidentiality.

11.4 Security Measures

Route Africa implements technical and organisational measures as described in Section 3.8 and Section 7, appropriate to the nature, scope, context, and purposes of processing and the risks to data subjects. These measures are reviewed and updated as necessary.

11.5 Sub-Processors

Route Africa may engage sub-processors (including data centre operators and upstream infrastructure providers) to assist in providing the Services. A list of current sub-processors is available upon request. Route Africa will notify the Client at least thirty (30) days before engaging a new sub-processor. The Client may object within fifteen (15) days of notification; if the objection cannot be reasonably accommodated, either party may terminate the affected service. Route Africa remains liable for the acts and omissions of its sub-processors.

11.6 Data Subject Requests

Route Africa will assist the Client in fulfilling data subject rights requests (access, rectification, erasure, portability, restriction, and objection) by providing appropriate technical and organisational measures, taking into account the nature of processing.

11.7 Breach Notification

Route Africa will notify the Client of any Personal Data Breach without undue delay and in any event within 48 hours of becoming aware of the breach, providing the information set out in Section 7.5 to the extent available.

11.8 Data Protection Impact Assessments

Route Africa will assist the Client, upon request, with data protection impact assessments and prior consultations with supervisory authorities, to the extent such assistance is required under applicable data protection law and relates to Route Africa's processing activities.

11.9 Return and Deletion of Data

Upon termination of the service agreement, Route Africa will, at the Client's choice, return all personal data to the Client or delete it in accordance with Section 1.9, unless applicable law requires retention of the data.

11.10 Audit Rights

Route Africa will make available to the Client, upon reasonable request and no more than once per year, information necessary to demonstrate compliance with this DPA. The Client or an independent auditor appointed by the Client may conduct an audit, subject to: (a) thirty (30) days' prior written notice; (b) reasonable scope and duration; (c) confidentiality obligations; and (d) the auditor not being a direct competitor of Route Africa. Route Africa may satisfy audit requests through provision of certifications, audit reports, or other documentation where reasonably sufficient.

11.11 International Data Transfers

Where the performance of Services involves transferring personal data outside the data subject's jurisdiction, Route Africa will ensure that appropriate transfer mechanisms are in place as required by the applicable data protection law, including standard contractual clauses, adequacy decisions, or other legally recognised safeguards.

11.12 Governing Terms

This DPA is governed by the same law as the Master Terms of Service. In the event of a conflict between this DPA and the Master Terms, this DPA prevails with respect to the processing of personal data. Enterprise clients may negotiate supplementary data processing terms where required by their regulatory obligations.