AEGIS — POPIA Data-Processing Agreement (Operator Agreement)

**Researched against POPIA (4/2013), Consumer Protection Act (68/2008), ECTA (25/2002), VAT Act

(89/1991) and Companies Act (71/2008) — sections cited inline. Owner-approved v1.1.**

Prepared 2026-07-27; consolidated and finalised 2026-07-30. POPIA = Protection of Personal

Information Act 4 of 2013. This DPA forms part of the Master Subscription Agreement.

This is the single data-processing agreement. It supersedes and absorbs the earlier

docs/legal/data-processing-agreement.md draft, which is retained for history only and is no

longer operative.

Clause numbering is stable from v1.0. Sections 1–7 keep their numbers, so references like

"clause 2.4" (breach notification) or "clause 3.1" (sub-operators) mean what they did before.

The material folded in from the superseded draft was added as sections 8–12 and Annexures A–B.

Roles. For the personal information you and your Clients place in the Service, the Practice is the Responsible Party and AEGIS is the Operator processing that information on your documented instructions. Both terms are used as defined in POPIA s1: an Operator processes personal information *for* a Responsible Party, in terms of a contract or mandate, without coming under its direct authority. The duties this places on AEGIS are in POPIA ss20–21. Where AEGIS processes personal information for its own account (e.g. your billing details), AEGIS is the Responsible Party for that.

Why this document is required. POPIA s21(3) requires the Operator's security obligations to be set out in a written contract between the Responsible Party and the Operator. A Responsible Party that fails to put one in place remains accountable for its Operator's processing — so this DPA protects the Practice, not only AEGIS.

1. Scope and purpose

AEGIS processes personal information only to provide the Service — hosting the ledger, take-on, documents, statements, tax and compliance functions — and as you instruct in the Service. AEGIS will not process it for any other purpose, and will not sell it. AEGIS will inform you if, in its opinion, an instruction infringes POPIA.

2. AEGIS's obligations as Operator (POPIA s20–21)

2.1 Process personal information only on your instructions and this DPA. 2.2 Treat it as confidential and ensure persons authorised to process it — employees, contractors and sub-operators — are bound to confidentiality and process it only as instructed. 2.3 Secure it with appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of it — the standard set by POPIA s19, applied to an Operator by s21(1): encryption in transit and at rest for sensitive fields, row-level access controls, least-privilege, audit logging, MFA for privileged access, and regular review. The measures are set out in Annexure B. 2.4 Notify you of a compromise within 72 hours of becoming aware of it. POPIA s21(2) requires an Operator to notify the Responsible Party immediately where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, and s22 requires the Responsible Party's own notification to be made as soon as reasonably possible after discovery. The 72-hour window in this clause is a stricter commitment AEGIS imposes on itself than the statutory formulation, so that you have a fixed, relied-on period in which to prepare your own s22 notification. The notice will carry enough detail (the nature of the compromise, the information involved, likely consequences and the measures taken) for you to meet your s22 duties to the Information Regulator and to affected data subjects. AEGIS will assist you with that response. Notice to AEGIS on any data-protection matter, including a compromise you become aware of, must be sent to legal@aegis.org.za; AEGIS will notify you at the email address on your account. 2.5 Assist you, so far as reasonably possible, with data-subject requests (access, correction, deletion, objection) and with your POPIA obligations. 2.6 On termination, return or delete personal information as set out in clause 10 and in the Master Subscription Agreement, save where retention is required by law.

3. Sub-operators

3.1 You authorise AEGIS to use the following sub-operators to provide the Service:

| Sub-operator | Purpose | |---|---| | Supabase | Database and application data hosting | | Vercel | Application hosting and delivery | | Paystack | Payment processing | | Resend | Transactional email | | Anthropic | AI processing |

3.2 AEGIS imposes data-protection obligations on each sub-operator no less protective than this DPA, and remains responsible to you for their processing. 3.3 AEGIS will give you reasonable notice before adding or replacing a sub-operator, and you may object on reasonable data-protection grounds. The current list is maintained at docs/compliance/sub-processor-register.md; clause 3.1 above is the operative list.

4. Cross-border processing (POPIA s72)

4.1 The Service's primary database is hosted in the European Union (Ireland). Certain sub-operators named in clause 3.1 process personal information outside South Africa, including in the United States. 4.2 You authorise these transfers. AEGIS makes them under POPIA s72. The primary EU/Ireland hosting qualifies under s72(1)(a): the recipient is subject to a binding agreement providing an adequate level of protection that upholds principles for lawful processing substantially similar to POPIA, which the EU data-protection regime does. Each sub-operator in clause 3.1 is bound by such an agreement. Where data-subject consent is instead the ground relied on, that is s72(1)(b), and AEGIS provides the onboarding consent mechanism to capture and record it. 4.3 The AI sub-operator does not use your data to train its models.

5. Data subjects and categories

employees, debtors, creditors and related persons appearing in the books.

identifiers; financial and transactional data; payroll data; and the contents of uploaded documents (invoices, bank statements, FICA documents such as ID and proof of address). This includes special personal information and high-sensitivity data.

Full details of the processing are in Annexure A.

6. Your obligations as Responsible Party

You warrant you have a lawful basis and any necessary consents to place this personal information in the Service, and that your instructions comply with POPIA.

7. Liability and general

This DPA is subject to the liability and governing-law terms of the Master Subscription Agreement. In conflict on data-protection matters, this DPA prevails. Each party remains responsible for its own compliance with POPIA in its respective role. Nothing here limits a data subject's statutory rights, or either party's liability that cannot be limited by law.

8. Assistance to the Practice

Taking into account the nature of the processing, AEGIS will provide reasonable assistance with: (a) responding to data-subject requests; (b) the security obligations in clause 2.3; (c) breach handling under clause 2.4; and (d) any engagement with the Information Regulator.

9. Audit and compliance

AEGIS will make available information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to reasonable audits — which may be satisfied by up-to-date third-party certifications or reports where available — on reasonable notice and subject to confidentiality.

10. Return or deletion on termination

On termination, AEGIS will, at your election, return or delete (and procure deletion by sub-operators of) the personal information, save where retention is required by law (for example FICA and tax record-keeping) — in which case AEGIS continues to protect it and processes it only for that purpose.

11. Term

This DPA takes effect when you accept the Master Subscription Agreement and continues for as long as AEGIS processes personal information on your behalf.

12. Notices

Data-protection notices to AEGIS: legal@aegis.org.za, or by delivery to AEGIS Intelligence Systems (Pty) Ltd, 138 Harpur Avenue, Benoni, 1501. Notices to the Practice: the email address on your account.

Annexure A — Details of processing

directors, beneficial owners, members, employees and contacts.

tax numbers; financial records; payroll data; and the contents of uploaded documents (invoices, bank statements, FICA documents such as ID and proof of address). Includes special personal information / high-sensitivity data.

document extraction, validation, allocation, reconciliation, VAT/CIPC/FICA/e-signature workflows, and reporting.

Annexure B — Technical and organisational security measures

Encryption at rest (AES-256-GCM) of high-sensitivity fields and document blobs, with keys held outside the database in a dedicated secrets vault; row-level security isolating each Practice's data; least-privilege roles and multi-factor authentication; segregation of duties on sensitive actions; an immutable, append-only audit trail (financial records are reversible, never editable or deletable); TLS in transit; backups with a tested restore; access logging and monitoring; and vetted sub-operators under equivalent obligations.

Statutory grounding — index

| POPIA section | What it grounds | Where | |---|---|---| | s1 | The definitions of *Responsible Party* and *Operator* — an Operator processes *for* the Responsible Party without coming under its direct authority | Roles | | s19 | The security-safeguards standard (integrity and confidentiality; prevent loss, damage, unlawful access) | 2.3, Annexure B | | s20 | Processing only with the Responsible Party's knowledge/authorisation, and only as instructed | 1, 2.1 | | s21 | Operator duties: s21(1) applies the s19 standard, s21(2) immediate notification of a compromise, s21(3) the written-contract requirement this document satisfies | Why this document is required; 2.3, 2.4 | | s22 | The Responsible Party's own notification to the Information Regulator and data subjects, "as soon as reasonably possible" — which our fixed 72 hours is stricter than | 2.4 | | s72 | Cross-border transfer: s72(1)(a) binding agreement with substantially similar protection (EU/Ireland hosting), s72(1)(b) data-subject consent where relied on | 4.1–4.2 |

Liability and governing law are grounded in the Master Subscription Agreement (see its own statutory index — CPA ss48/51 and s5(2)(b), ECTA ss11/22/24/43, VAT Act ss7(1)/23, Companies Act 71 of 2008).

Version 1.1 · accepted electronically at signup alongside the Master Subscription Agreement; the accepted version, content hash and timestamp are recorded.