Data Processing Agreement

1. Purpose and parties

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Brendmo (the "Operator") and the Customer (the "Responsible Party"). It applies to personal information that the Operator processes on the Customer's behalf through Brendmo PMS ("Customer Personal Information"), in line with sections 20 and 21 of the Protection of Personal Information Act 4 of 2013 (POPIA).

2. Instructions

• The Operator processes Customer Personal Information only on the Customer’s documented instructions, which are these Terms, the configuration the Customer sets in the Service and any written instruction it gives, and only to provide the Service.
• The Operator tells the Customer if it believes an instruction would break the law.
• The subject matter is performance management of the Customer’s employees; the duration is the subscription term plus the retention period in the Terms; the categories of data subjects are the Customer’s employees and users; the types of information are identity and contact details, job information, KPIs, ratings, comments and attachments.

3. Confidentiality

The Operator ensures that people who access Customer Personal Information are bound by confidentiality and only access it where they need to.

4. Security safeguards

The Operator maintains reasonable technical and organisational measures to protect Customer Personal Information against loss, damage and unauthorised access, including access control, separation of customer data, secure storage of credentials and logging of administrative access. The Operator reviews these measures as the Service develops.

5. Security compromises

If the Operator becomes aware of a security compromise affecting Customer Personal Information it will notify the Customer without undue delay, describe what happened and what is being done, and help the Customer meet its duties under POPIA section 22.

6. Sub-operators

The Customer authorises the Operator to use sub-operators such as cloud hosting, file storage, email delivery and payment providers, under written agreements that give equivalent protection. The Operator will make the list of categories and providers available on request and give notice of material changes so the Customer can object on reasonable grounds.

7. Transfers outside South Africa

Where Customer Personal Information is processed outside South Africa, the Operator ensures the transfer meets POPIA section 72, for example through a binding agreement with the sub-operator that gives equivalent protection.

8. Data subject requests

The Operator will promptly pass on any request it receives from a data subject about Customer Personal Information and give reasonable help so the Customer can respond within the time POPIA allows.

9. Return and deletion

At the end of the subscription the Operator makes Customer Personal Information available for export for the period stated in the Terms and then deletes or anonymises it, unless the law requires the Operator to keep it.

10. Audit and information

On reasonable written notice and not more than once a year (unless a security compromise has occurred), the Operator will give the Customer the information needed to show that it meets this DPA, and allow reasonable audits subject to confidentiality.

11. Order of precedence

If this DPA conflicts with the Terms of Service about the processing of Customer Personal Information, this DPA prevails.