Data Processing Addendum

Effective date: see the version banner at the top of this page.

This Data Processing Addendum (the "DPA") forms part of the Terms of Service between Zilo Software (Pty) Ltd ("Zilo", "we", "Processor") and the Customer signing up to ItsSuite (the "Service") ("Controller" or "you").

It sets out the parties' obligations under the Protection of Personal Information Act, 4 of 2013 ("POPIA") and, where applicable to the Customer, the EU General Data Protection Regulation 2016/679 ("GDPR") in respect of personal information that the Processor processes on behalf of the Controller through the Service.

1. Definitions

Capitalised terms not defined here have the meanings set out in the Terms of Service, POPIA, or the GDPR (as applicable).

• "Customer Data" means personal information that the Controller uploads to, or causes to be processed by, the Service.
• "Sub-processor" means a third-party engaged by the Processor to carry out specific processing activities on behalf of the Processor.
• "Security Incident" means a confirmed unauthorised access to, loss of, or alteration of Customer Data.

2. Roles of the parties

The Controller determines the purposes and means of the processing of Customer Data. The Processor processes Customer Data only on the documented instructions of the Controller, which are set out in:

• the Terms of Service and this DPA;
• the configuration of the Customer's workspace at any given time (e.g. enabled features, flow definitions);
• any specific instructions issued by the Controller in writing.

If the Processor believes an instruction infringes POPIA, the GDPR, or any other applicable law, the Processor will inform the Controller without undue delay and may suspend execution of that instruction pending clarification.

3. Subject-matter, duration, nature and purpose of processing

The Processor does not process special personal information / special categories of data unless the Controller, against the recommendations of this DPA, includes such data inside a message or contact attribute. The Controller represents that it has the lawful basis to do so.

4. Processor obligations

The Processor will:

1. Process Customer Data only on documented instructions from the Controller (§2).
2. Ensure that personnel authorised to process Customer Data are subject to a binding confidentiality obligation.
3. Implement and maintain the technical and organisational measures described in the Security One-pager and Annex 1 of this DPA.
4. Assist the Controller, taking into account the nature of the processing and the information available, in:
   • responding to data-subject requests under POPIA §§23–25 (access, correction, deletion) or GDPR Arts 12-22;
   • notifications of Security Incidents (§7);
   • data-protection impact assessments (POPIA §§57–60; GDPR Art. 35).
5. Make available to the Controller all information necessary to demonstrate compliance with this DPA, including by allowing inspections conducted by the Controller or an auditor mandated by the Controller, subject to confidentiality undertakings and 30 business days' written notice.

5. Sub-processors

The Controller authorises the Processor to engage the sub-processors listed at /legal/subprocessors.

The Processor will notify the Controller of any intended changes to the sub-processor list at least 30 calendar days in advance. The Controller may object on reasonable grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the Terms of Service in respect of the affected processing.

The Processor remains liable for the acts and omissions of its sub- processors as if they were its own.

6. International transfers

Where Customer Data is transferred outside South Africa, the Processor ensures the transfer is supported by:

• a written processing agreement with the sub-processor incorporating POPIA-equivalent protections; and
• where the receiving jurisdiction is not the subject of an adequacy determination, the EU Standard Contractual Clauses (Module 3: Processor-to-Processor) or equivalent transfer mechanism.

7. Security incidents

The Processor will notify the Controller of a Security Incident without undue delay and in any event within 72 hours of becoming aware of it. The notice will include, to the extent known:

• the nature of the incident, including the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed to address the incident.

The Controller is responsible for any notifications it is required to make to the Information Regulator or data subjects under POPIA §22 or the GDPR Arts 33-34.

8. Data-subject requests

If the Processor receives a request directly from a data subject for the exercise of rights under POPIA or the GDPR, it will forward that request to the Controller without undue delay and will not respond substantively unless instructed in writing by the Controller.

9. Audits

Once per calendar year the Controller may, on 30 business days' written notice, request an audit of the Processor's compliance with this DPA. The Processor may satisfy this obligation by providing a recent third-party audit report (SOC 2, ISO 27001) or by hosting an on-site review at the Processor's premises. Each party bears its own costs.

10. Return or deletion of data

On termination of the Terms of Service, the Processor will, at the Controller's election:

• delete all Customer Data within 30 calendar days; or
• return Customer Data in a structured, commonly used, machine-readable format (JSON or CSV) and then delete it.

The Processor may retain Customer Data where required to do so by law, in which case it will inform the Controller of the legal basis and will protect the data in accordance with this DPA.

11. Order of precedence

In the event of conflict between this DPA and the Terms of Service, this DPA prevails in respect of the processing of Customer Data.

Annex 1 — Technical and organisational measures

See the Security One-pager. Headline measures:

• Encryption at rest (AES-GCM) for all credentials and tokens stored on behalf of the Controller.
• TLS 1.2+ in transit for all customer-facing endpoints and all intra-service connections.
• Mandatory two-factor authentication for all platform administrators.
• Role-based access control with the principle of least privilege.
• Append-only audit log of all administrative actions.
• Documented incident-response plan with 72-hour notification.

Initial template — please review with legal counsel before signing the DPA on behalf of either party.