Operator Agreement (POPIA)

Version 1.0. This agreement is between the customer named in its ComplianceDesk account or order (the "Responsible Party") and Elestack Digital Solutions (Pty) Ltd, registration number K2026258767, of Kenmare, Krugersdorp, Gauteng (the "Operator"). It starts on the date the customer accepts it or first uses the service. Larger or regulated customers can ask for a signed copy at privacy@elestackdigitalsolutions.co.za.

1. Why this agreement exists

The Operator provides software and related services to the Responsible Party under the Terms of Service (the "Services"). To do so it processes personal information on the Responsible Party's behalf. This is the written contract the Protection of Personal Information Act 4 of 2013 ("POPIA") requires between a responsible party and an operator. Words defined in POPIA have the same meaning here.

2. What the Operator may do

The Operator processes the personal information described in the Schedule only on the Responsible Party's documented instructions (including its use of the product's features) and only to provide the Services. It does not use the information for its own purposes, and treats it as confidential unless the Responsible Party authorises disclosure or the law requires it, in which case it tells the Responsible Party first where lawful.

3. Security

The Operator keeps appropriate, reasonable technical and organisational measures to protect the information against loss, damage, unauthorised destruction and unlawful access. These include separated customer data, role-based access, multi-factor sign-in, encryption in transit, audit logging and backups. Everyone at the Operator with access is bound by confidentiality and POPIA obligations.

4. Security compromises

If the Operator knows or reasonably suspects that personal information has been accessed or acquired by an unauthorised person, it tells the Responsible Party in writing without delay and within 48 hours, with what happened, what information and how many people may be affected, what has been done and who to contact. It helps the Responsible Party investigate, contain and notify.

5. Other operators (sub-processors)

The Responsible Party gives general permission for the Operator to use the sub-processors listed in the Schedule. The Operator gives at least 30 days' notice of a new or replacement sub-processor so the Responsible Party can object. It binds each sub-processor to terms giving at least the same protection and stays responsible for them.

6. Requests from people

If a data subject contacts the Operator about information it holds for the Responsible Party, the Operator passes the request on promptly and does not answer itself unless told to. It reasonably helps the Responsible Party respond to requests to access, correct, delete or object.

7. Information outside South Africa

The Responsible Party agrees that the information is held on the Operator's infrastructure in Western Europe and may be processed by the sub-processors in the countries they operate in, as recorded in the Schedule. The Operator does not promise any particular location, and sends information abroad only as POPIA allows.

8. Checking compliance

The Operator gives the Responsible Party the information it reasonably needs to check this agreement is followed, and allows a reasonable review on reasonable notice, no more than once a year unless there has been a compromise. The Operator may meet this by giving its current security summary and sub-processor terms.

9. Ending

When the Services end, or earlier on request, the Operator lets the Responsible Party export its information, then securely deletes it from live systems within 90 days and from backups as they expire, and confirms in writing if asked. It may keep copies only if the law requires, and those stay protected.

10. General

This agreement is read together with the Terms. If they conflict about personal information, this agreement wins. Changes must be in writing, except that the Operator may update the sub-processor list as clause 5 provides. South African law governs.

Schedule

• Services: ComplianceDesk, and any other Elestack product the customer uses under its account or order.
• Types of personal information: whatever the Responsible Party chooses to store, typically names, contact details, account information, files and records of its own staff and customers. The Responsible Party must tell the Operator before storing special personal information (for example health information) or information about children.
• Whose information: the Responsible Party's staff, customers, suppliers and other contacts.
• Duration: for as long as the Services are provided, and until return or deletion under clause 9.
• Sub-processors: Cloudflare (hosting, database, file storage and email, Western Europe and elsewhere as Cloudflare states); Paystack (Paystack South Africa (Pty) Ltd, card payments, which may process data in other countries as it states in its terms).

Accepted on behalf of the Operator by Kyle Hanger, Director. This agreement is compiled from public sources and has not been reviewed by a lawyer.