Data Processing Terms

1. Roles

When your business ("you") uses UpClient, you are the responsible party for the personal information described in section 2, and WebGap (Pty) Ltd t/a UpClient ("we") is your operator, processing it on your behalf. These terms are the written contract between a responsible party and an operator that sections 20 and 21 of POPIA require. Words used in these terms have their POPIA meanings.

2. What we process

• Your team - the people in your company on UpClient: names, email addresses, job titles, departments, offices, phone numbers, headshots, social media links, sign-offs, and their sign-in and activity records.
• People your emails and cards reach - what they choose to enter in your forms, ratings and competitions, and statistics about opens and clicks (counted, with IP addresses scrambled one way).
• Purpose - only to provide UpClient to you: building, installing and showing signatures and cards, running your campaigns, forms and statistics, and supporting you. For as long as your account is open.

3. Your instructions

We process this information only on your documented instructions - which are these terms, and the settings and actions you and your authorised people (including any partner managing your account) take in UpClient - unless the law requires otherwise, in which case we'll tell you first if we're allowed to. We don't use it for our own purposes, sell it, or use it for advertising.

4. Confidentiality

We treat this information as confidential, and don't disclose it except as these terms allow or the law requires. Everyone at UpClient who can access it is bound to keep it confidential, and has access only as far as their work needs.

5. Security measures

As section 19 of POPIA requires, we keep appropriate, reasonable technical and organisational measures in place, including:

• encryption in transit (HTTPS only), and AES-256 encryption for sensitive stored details; no card or bank account numbers stored;
• passwords stored only as strong one-way hashes; two-step verification available to all, and required for our staff and partners;
• access limited by role, separation between companies' information, and a log of administrator actions;
• limits on sign-in attempts and other abuse, and protection against common web attacks;
• uploaded files re-created and stored so they can't run as code;
• hosting in South Africa with a professional provider, and regular backups.

We review these measures as risks and technology change.

6. Other operators we use

You authorise us to use these service providers to help provide UpClient. Each is bound by a contract that protects the information at least as well as these terms:

• Xneelo (South Africa) - hosting of our servers and database.
• Paystack - payments and referral payouts (your billing contact only).
• Google and Microsoft - only where you or your people connect Gmail, sign in with them, or use our Outlook add-in.
• Shopify or WooCommerce - only if you connect your online store.

We'll tell account owners before adding or replacing a provider that processes your team's information, so you can object. If you object on reasonable grounds and we can't resolve it, you may cancel.

7. If there's a breach

If we have reasonable grounds to believe that personal information we process for you has been accessed or acquired by an unauthorised person, we'll tell you without undue delay - and within 72 hours of becoming aware of it - with what we know: what happened, the information involved, the likely consequences, and what we're doing about it. We'll help you meet your own duties under section 22 of POPIA to notify the Information Regulator and the people affected.

8. Helping with requests

If someone asks us directly to see, correct or delete their information that we hold for you, we'll pass the request to you rather than answer it ourselves. UpClient lets you view, correct and delete your team's information, and we'll give you reasonable further help to respond to such requests and to any enquiry from the Information Regulator.

9. Transfers outside South Africa

Your team's information is stored in South Africa. Where a provider in section 6 processes it elsewhere, we make sure the transfer meets section 72 of POPIA - for example, through a binding agreement giving protection substantially similar to POPIA.

10. At the end

When you delete your company, or your agreement with us ends, we delete the personal information we hold for you - except what the law requires us to keep - and backups are overwritten in their normal cycle. Before you delete, you can copy or export what you need from UpClient.

11. Information and checks

We'll give you the information reasonably needed to show that we meet these terms, and answer reasonable security questionnaires. Enterprise customers may agree further assurance with us.

12. Your responsibilities

• Have a lawful basis for the information you put into UpClient, and tell your people about it (for example in your staff privacy notice).
• Make sure your forms, ratings and campaigns ask only for what you need, and that any direct marketing you do complies with POPIA and the Consumer Protection Act.
• Give access to UpClient only to people who should have it, and remove people who leave.