Data Processing Addendum

1. Scope and roles

This addendum forms part of the POPIA Pal agreement. The customer is the responsible party for personal information it places in its workspace and determines the purpose and means of that processing. INNOFIX TECHNOLOGIES (PTY) LTDacts as operator. Innofix remains the responsible party for its own account, billing, security and business-administration processing.

2. Documented instructions

Innofix will process customer personal information only to provide, secure, support and improve the contracted service, comply with documented customer instructions, or meet a binding legal duty. If an instruction appears unlawful or materially unsafe, Innofix may pause it and request clarification.

3. Processing details

4. Confidentiality and access

Innofix restricts customer information to authorised persons who require access for support, security or operation and who are bound by confidentiality. Tenant-level controls and private storage separate customer workspaces. Production credentials are limited to approved administrative use.

5. Security safeguards

• Encrypted HTTPS transport and managed encryption at rest.
• Role and organisation-based access controls with database row-level enforcement.
• Private object storage and time-limited document access.
• Server-only secrets, signed payment webhooks and input validation.
• Logging, retention controls, vulnerability maintenance and incident response.
• Encrypted storage and audited reveal of identity numbers used for DSAR verification.

6. Suboperators and international processing

The customer gives general written authorisation for the suboperators on the operator register. Innofix will require appropriate confidentiality and security obligations, review material changes and give notice where a new provider materially changes the processing. Current suboperators include Supabase, Vercel, Resend, Paystack South Africa, Google. International processing is subject to contractual and organisational safeguards intended to satisfy section 72 of POPIA.

7. Data-subject assistance

Taking account of the nature of processing, Innofix will provide reasonable assistance for access, correction, deletion, objection and restriction requests. The customer remains responsible for identity verification, legal decisions and responses to its data subjects. Public request and export tools are provided to support those duties.

8. Security compromises

Innofix will notify the customer without undue delay after confirming an unauthorised access to or acquisition of customer personal information. Available details will include the nature of the compromise, affected information, likely consequences and mitigation. The customer, as responsible party, decides and performs notices required by section 22, with reasonable assistance from Innofix.

9. Return, deletion and retention

During the service term, authorised customers may export available data. After termination or a lawful instruction, Innofix will delete or return customer information unless retention is required by law, needed to resolve an active security incident or dispute, or remains temporarily in protected backups. Retained information remains protected and is not used for another purpose.

10. Evidence and review

Innofix will make reasonable information about its safeguards available to the customer and cooperate with proportionate compliance enquiries. Audits must protect other customers, security and confidential information and should first rely on available policies, logs and provider assurance reports.

11. Customer obligations

The customer must process lawfully, provide notices, minimise uploads, configure authorised users, keep credentials secure, respond to data subjects, and avoid uploading prohibited or unnecessary information. The customer must notify Innofix promptly of compromised credentials or an instruction affecting stored information.