Operator Data Processing Terms

These Operator Data Processing Terms ("Operator Terms") form part of every agreement under which Solution House Software (Pty) Ltd ("SHS" or the "operator") provides Products to a client (the "responsible party"). They give effect to sections 20, 21 and 72 of POPIA. If the client agreement contains more protective provisions, those provisions apply.

SHS processes personal information only with the knowledge or authorisation of the client (section 20(a) of POPIA) and only on the client's documented instructions. These consist of the client agreement, the client's configuration of the Products and any further written instructions. SHS will tell the client if it believes an instruction would breach POPIA or another law.

SHS treats all personal information that comes to its knowledge as confidential and does not disclose it unless required by law or in the course of properly performing its duties (section 20(b) of POPIA). All personnel with access are bound by confidentiality obligations.

SHS maintains the security measures referred to in sections 19 and 21 of POPIA, as described in our Privacy Statement. The client is responsible for managing its own users, credentials, permissions and on-site devices, such as cameras.

SHS will notify the client immediately where there are reasonable grounds to believe that personal information processed on the client's behalf has been accessed or acquired by an unauthorised person (section 21(2) of POPIA). The notice will describe what happened, the categories of information involved, the likely consequences and the measures taken. SHS will help the client make the notifications required by section 22.

The client gives SHS general authorisation to engage sub-operators, such as cloud hosting, messaging, mapping and AI service providers. SHS will enter into written agreements imposing equivalent obligations on each sub-operator, remains responsible for their performance, provides a list of sub-operators on request, and will notify the client of material changes. The client may object to a change on reasonable grounds.

SHS transfers personal information outside South Africa only as permitted by section 72 of POPIA, and does not transfer special personal information or children's information to a country without adequate protection unless prior authorisation has been obtained under section 57.

SHS will promptly forward to the client any request or complaint it receives from a data subject about the client's data, and will reasonably assist the client with data subject requests, privacy impact assessments, enquiries from the Information Regulator and applications for prior authorisation.

As responsible party, the client must:

• Have a lawful basis and a specific, explicitly defined purpose for all processing (sections 9 to 13 of POPIA).
• Give data subjects the notices required by section 18, including clear signage wherever cameras, facial recognition or licence plate recognition are used.
• Obtain any consent required, including for special personal information and children's information.
• Obtain prior authorisation from the Information Regulator where section 57 applies, for example when processing information on criminal behaviour on behalf of third parties.
• Ensure that the information it captures, including watchlists, is complete, accurate, not misleading and updated where necessary (section 16).
• Configure retention periods that comply with section 14.
• Not instruct SHS to process personal information unlawfully.
• Give access only to authorised and trained users.
• Respond to data subject requests about its data.

When the client agreement ends, SHS will, on written request made within 30 days, make the client's data available for export. SHS will then delete the client's data from its active systems, and from backups in the normal backup cycle, unless a law requires it to be kept.

SHS will provide information reasonably needed to demonstrate compliance with these Operator Terms. The client may, on reasonable written notice and at its own cost, audit compliance once a year (or more often after a security compromise), subject to confidentiality and without access to other clients' data.