POPIA Data Processing Agreement

The customer (the security company using OZWA ONE) is the responsible party. It decides why and how personal information about its employees, guards, clients and site contacts is processed.

Ozwa one acts as the customer's operator when it hosts and processes that information to provide OZWA ONE. For its own account, billing and support records, Ozwa one is a responsible party in its own right, as described in the Privacy Policy.

Operator details: [To be confirmed: registered company name, registration number and physical address].

Personal information the customer enters or uploads, which may include: employee and guard names, ID numbers, contact details, registration and grade details, banking details, rosters and postings, attendance and shift sign-in/out records, timesheets, payroll figures, fines and deductions, incidents, inspections, uploaded documents, client and site contact details, and messages between users.

Purpose: only to provide, secure and support the OZWA ONE service for the customer.

Ozwa one will process customer personal information only on the customer's documented instructions — which include the customer's use and configuration of OZWA ONE — unless the law requires otherwise. It will not use that information for its own purposes or sell it.

The customer is responsible for having a lawful basis (for example, an employment contract or legal obligation) and for informing its staff that their information is processed in OZWA ONE.

Ozwa one will treat customer personal information as confidential and will only allow access to people who need it to provide or support the service and who are bound by confidentiality.

Ozwa one intends to maintain appropriate, reasonable technical and organisational measures, as required by POPIA section 19, to protect customer information against loss, damage and unauthorised access.

Description of the measures in place: [To be confirmed: a verified list of current security measures, to be attached as a schedule].

Inside OZWA ONE, the customer controls which of its users can open which pages and is responsible for managing those permissions and its users' passwords.

Ozwa one may use other service providers (subprocessors), such as cloud hosting, database and email delivery providers, to provide the service. It will bind them to obligations at least as protective as this agreement and remains responsible for them.

Current list of subprocessors and the countries where data is stored: [To be confirmed: names, services and locations]. Customers will be told of planned changes to this list: [To be confirmed: notice period and how customers may object].

Payments are handled by Paddle.com as Merchant of Record, which acts as an independent party for payment data and does not receive customer employee records.

If Ozwa one becomes aware of reasonable grounds to believe that customer personal information has been accessed or acquired by an unauthorised person, it will notify the customer without undue delay, so that the customer can meet its own notification duties to the Information Regulator and affected people under POPIA section 22.

Notification time frame and contact channel: [To be confirmed: e.g. within a set number of hours, by email to the account owner].

When an employee or guard asks the customer for access to, correction of or deletion of their information, Ozwa one will give reasonable help. OZWA ONE includes tools for the customer to view, correct, export and erase employee records itself.

If Ozwa one receives such a request directly, it will pass it on to the customer rather than respond itself, unless the law requires otherwise.

During the subscription, the customer decides how long its records are kept, using the retention settings in OZWA ONE, subject to the customer's own legal record-keeping duties.

When the subscription ends, the customer may request an export of its data, as set out in the Terms of Service. After that, Ozwa one will delete customer personal information, except where the law requires it to be kept. Deletion time frame, including backups: [To be confirmed: number of days].

Ozwa one will provide information reasonably needed to show that it meets this agreement, and will cooperate with the Information Regulator where required. Scope, frequency and cost of customer audits: [To be confirmed: audit terms].

Where customer information is stored or processed outside South Africa, Ozwa one will only do so where POPIA section 72 allows it. Basis relied on: [To be confirmed: e.g. binding agreements with subprocessors].

This agreement runs for as long as Ozwa one processes customer personal information and sits alongside the Terms of Service. If the two conflict on data protection, this agreement is intended to prevail. It is proposed to be governed by South African law, subject to legal review.

Questions or requests for a signed copy: privacy@ozwaone.app.