Data processing agreement

This agreement meets sections 20 and 21 of POPIA. It is between you (the business, the responsible party) and [Registered company name] (Pty) Ltd (the operator), and forms part of the terms of service.

1. What we process and why

We process personal information about your employees and staff (identity details, contact details, tax and UIF numbers, pay, leave, attendance and bank details) only to provide AgriDesk to you: storing it, calculating payroll and producing payslips, reports and exports you ask for.

2. Your instructions

We process this information only on your documented instructions, which are given by how you use AgriDesk, unless the law requires otherwise. If we believe an instruction breaks the law we will tell you.

3. Confidentiality

Everyone at [Registered company name] (Pty) Ltd who can access your data is bound by confidentiality and has access only as far as needed to support the service.

4. Security safeguards (section 19)

• encryption in transit and at rest;
• row-level security separating every business's data, with role and category-based access inside your business;
• access to production systems limited to authorised staff;
• regular backups and the ability to restore them;
• logging of changes to sensitive records.

5. Security incidents (section 22)

If we have reasonable grounds to believe your employees' information has been accessed or acquired by an unauthorised person, we will tell you without undue delay, give you the information you need to notify the Information Regulator and affected employees, and help you respond.

6. Sub-operators

You authorise us to use the service providers listed in the privacy policy. We bind each one to safeguards no weaker than these, and will give you notice before adding a new one so you can object.

7. Location

Your data is stored in Zurich, Switzerland, and processed by application servers in Frankfurt, Germany. You authorise this transfer. Both are subject to data protection laws that give at least the level of protection POPIA requires, and each sub-operator is bound by a written agreement, as section 72 of POPIA requires. We will tell you before moving your data to another country.

8. Helping you meet your obligations

We will help you respond to requests from employees to access, correct or delete their information, and to enquiries from the Information Regulator.

9. When the service ends

You can export your data at any time. Within 90 days after your account closes we delete your employees' information from live systems; backups roll off within a further 30 days. We keep only what the law requires us to.

10. Audit

On reasonable notice we will give you information that shows we comply with this agreement.