How we process Customer Data on your instructions.
This Data Processing Agreement ("DPA") sets out the terms on which CloudPMO (Pty) Ltd processes personal information within Customer Data as an operator under POPIA (equivalently, a processor under comparable laws) on behalf of a Customer.
Who is responsible for what
- For Customer Data that is personal information, the Customer is the responsible party (POPIA) / data controller (comparable laws), and CloudPMO is the operator / data processor.
- This DPA applies only to that personal information. It does not change the Terms of Service, and where the two conflict on data protection, this DPA governs.
We process on your instructions, nothing more
- CloudPMO processes Customer Data only to provide the Service as described in the Terms, to act on the Customer's documented instructions given through the product or in writing, and to comply with law.
- We do not use Customer Data for our own purposes, do not sell it, and do not use it to train any third-party AI model. Optional AI-assisted features send only the data a tenant administrator has enabled for that purpose, as described in the Privacy Policy.
- If an instruction would, in our reasonable view, break applicable data protection law, we will tell the Customer before carrying it out.
Technical and organisational measures
- Encrypted connections (TLS) between a User's browser, the application, and the database.
- Tenant isolation enforced at the application layer and by PostgreSQL row-level security, so one tenant's Customer Data is not reachable from another tenant's session.
- Role-based access control, and audit logging of administrative and tenant-configuration actions with actor, timestamp and before/after values.
- Staff and sub-processor access to Customer Data is limited to what is needed to operate or support the Service, under confidentiality obligations.
- Full detail, including evidence sources, is on the Security page.
Who else touches Customer Data, and how you hear about changes
- The current sub-processor list, each with its purpose, processing location and transfer basis, is published in section 4 of the Privacy Policy.
- We will update that list before adding a new sub-processor that processes Customer Data, and will notify Customers under this DPA in advance, with the opportunity to object on reasonable data-protection grounds.
- Each sub-processor is bound by written terms that impose data-protection obligations materially equivalent to this DPA.
Where processing happens outside South Africa
Where a sub-processor processes Customer Data outside South Africa, our written contract with that sub-processor is the POPIA section 72 transfer basis, as named per sub-processor in section 5 of the Privacy Policy.
If something goes wrong
- If we become aware of unauthorised access to or disclosure, loss, or destruction of Customer Data, we will notify the affected Customer without undue delay and within 72 hours of becoming aware, as described in section 7 of the Privacy Policy.
- Notification will describe, to the extent then known: the nature of the incident, the data categories and approximate number of data subjects affected, and the steps we are taking or recommend.
- We will reasonably assist the Customer in meeting its own notification obligations to the Information Regulator or affected individuals.
Helping you answer your own Users
Where a Customer's own tenant tools (member management, export, deletion) do not already let it answer a data subject request itself, we will provide reasonable assistance on request, at the Customer's cost for anything beyond what the product already provides.
What happens to Customer Data when the agreement ends
- For 30 days after a subscription ends, the Customer can export Customer Data in a common machine-readable format, or ask us for a copy.
- After that 30-day window, we delete Customer Data from live systems, and purge it from backups within a further 90 days, except where we are required by law to keep it longer (for example, billing records kept 7 years under the Companies Act and Tax Administration Act).
- On request, we will confirm in writing once deletion from live systems is complete.
Showing our working
We keep records sufficient to show compliance with this DPA. On reasonable written notice, and no more than once in a 12-month period absent a reasonable security concern, we will provide the information needed to demonstrate compliance, or make available the results of an independent audit or certification we hold at the time of the request.
How this fits with the rest of the agreement
This DPA supplements the Terms of Service and does not replace the limitation of liability, indemnity or dispute provisions there, which continue to apply.