Data Processing Agreement

1. Parties, incorporation and scope

This agreement forms part of the Terms of Service accepted by the customer and FlexiMetaDoc (Pty) Ltd. It applies when the customer determines the purpose and means of processing and FlexiMetaDoc acts as operator under POPIA. It does not retrospectively amend an existing contract or replace a signed processing agreement without a valid contractual change. For the processing subject matter it takes priority over conflicting general service wording, subject to mandatory law.

The accepted order, supported service configuration and documented instructions define the processing: receipt, storage, extraction, validation, workflow execution, authorised disclosure, support, return and deletion. Data may concern customer staff, contacts, suppliers, clients or respondents and include identifiers, contact and business records and customer-submitted content. Duration is the contracted service plus authorised retention. The specific dataset, purpose, categories, retention and deployment restrictions must be agreed before processing; this description does not authorise every category.

2. Instructions and lawful collection

The customer must establish its lawful basis, provide notices, authorise users, minimise the data and define lawful instructions. FlexiMetaDoc processes only on those documented instructions, except where required by law. Where lawful, it informs the customer of a legal requirement or a suspected unlawful instruction before acting and seeks resolution. It must not sell customer personal information or use it for unrelated advertising or model training under this agreement.

Special personal information, children’s data and processing requiring prior authorisation need an identified statutory basis and agreed safeguards before activation. The customer’s responsibilities do not transfer or remove FlexiMetaDoc’s statutory duties.

3. Confidentiality and security

FlexiMetaDoc must maintain the reasonable and appropriate safeguards required by POPIA section 19 through the written operator obligation in section 21. Authorised personnel must be subject to confidentiality and access only information needed for their duties. Safeguards must address access control, secure transmission, system protection, separation of customer access, logging, recovery and secure disposal proportionate to the data and deployment; identified risks and effectiveness must be reviewed.

Specific encryption, hosting, backup, recovery and audit commitments must be documented for the deployment. This page does not certify controls that have not been tested. FlexiMetaDoc provides relevant evidence reasonably needed to assess its performance, subject to protection of other customers, security and confidentiality.

4. Sub-operators, AI and foreign processing

Before a sub-operator processes customer data, FlexiMetaDoc must disclose its identity, function and relevant processing locations, obtain the authorisation required by the customer agreement and impose written confidentiality, security, purpose and incident obligations appropriate to the processing. It remains responsible for its subcontracted performance. Material provider changes require advance notice where practicable and a reasonable opportunity to raise substantiated data-protection objections; unresolved objections must be addressed before the affected processing continues.

The parties must document applicable POPIA section 72 safeguards and onward-transfer restrictions before an international transfer. Prior authorisation requirements must be addressed where applicable. For AI providers, the approved scope must include data use, retention and any training restrictions. Customer acceptance is not a blanket authorisation for unknown providers or unrestricted foreign processing.

5. Immediate incident notification and assistance

FlexiMetaDoc must immediately notify the customer responsible party when there are reasonable grounds to believe that an unauthorised person has accessed or acquired customer personal information. The initial report must not wait for complete investigation. It provides available information on the event, affected information and people, likely consequences, containment and contact, then supplements the report as facts become available.

FlexiMetaDoc must take reasonable containment and remediation steps, preserve relevant evidence lawfully and assist the customer with POPIA section 22 notifications and investigation. The responsible party decides and makes its required notifications; FlexiMetaDoc remains responsible for notifications required for its own processing. No SLA severity threshold or fixed 72-hour waiting period replaces these duties.

6. Requests, retention and exit

FlexiMetaDoc promptly routes relevant rights requests to the customer and provides reasonable assistance with access, correction, deletion, objection, restriction and eligible automated-decision review. It does not disclose another customer’s data or make the customer’s substantive decision without authority, except as required by law.

On expiry or lawful instruction, FlexiMetaDoc returns or deletes customer data in accordance with the agreed export format, timetable and retention schedule. Lawfully required retention must be identified, limited and protected. Backup data remains restricted until its documented removal cycle; any restored copy must be brought back under the current deletion instructions. The parties should record completion and any remaining lawful retention.

7. Evidence, liability and contacts

The parties keep the processing instructions and relevant compliance evidence and cooperate with lawful regulator requests. Reasonable reviews must protect credentials, confidential systems and other customers’ information. No audit right permits uncontrolled access to production or another tenant.

The Terms of Service liability clause applies only to the extent lawful, including its most-recent-payment cap and express exceptions. It does not bind the Information Regulator, waive non-excludable data-subject rights, reduce statutory duties or cap a required refund. Processing enquiries: hardus.vandyk@fleximetadoc.com. Security incidents: hardus.vandyk@fleximetadoc.com.

Service providers and retention information

The Processing and Retention Schedule identifies supported provider routes, data categories and retention controls. Read the schedule with the service-specific order and instructions. A supported integration is used only where selected and enabled; provider-specific processing locations, downstream recipients, retention and transfer safeguards must be established for that service.