Operator agreement

About this agreement

In this agreement, “we” and “us” means AutomateiQ, based in Centurion, Gauteng, and “you” means the business we work for. Under POPIA you are the responsible party for the personal information of your customers and visitors, and we are your operator: we process it for you, under your authority. Section 21 of POPIA asks for a written contract between the two; this is it. It forms part of our terms and conditions and applies for as long as we hold personal information for you. Where this agreement and POPIA differ, POPIA applies.

What we process for you

Only what our services for you need, which can include:

• enquiries sent through your website’s contact form: names, phone numbers, email addresses and messages;
• your customers’ accounts on your website: names, email addresses and passwords, which we keep only in scrambled (hashed) form;
• orders, bookings, invoices and payment records: names, contact details, addresses and what was bought or paid;
• emails we send on your behalf, such as order confirmations and password resets.

Card details never reach us: card payments go straight to your own payment provider, under your own agreement with them. Our website statistics count visits without cookies and keep nothing about the visitor.

What you are responsible for

• Having a lawful reason to collect the information, and telling people about it in your privacy policy, which we can write for your website.
• Getting consent where POPIA needs it, for example before sending marketing to someone who is not yet your customer.
• Telling us if you want information handled differently from how our services handle it.

What we do

Only for you

We process the information only to provide our services to you, or as you tell us. We never sell it, never use it for our own marketing and never give it to anyone else for theirs.

Confidentiality

Everyone who works on your account for us keeps the information confidential, and sees only what they need for the work. That duty continues after our agreement ends.

Security

We take reasonable technical and organisational measures to keep the information safe, as section 19 of POPIA requires, including:

• encrypted (HTTPS) connections to your website and to our admin;
• each business’s information kept apart, and signed-in access limited to your own people and our staff;
• passwords stored hashed, and payment provider keys stored encrypted;
• regular backups, kept encrypted, so information can be restored after a fault;
• keeping our software up to date, and testing every change before it goes live.

If something goes wrong

If we have reason to believe that someone without authority has gained access to personal information we hold for you, we tell you immediately, with what we know: what happened, what information is affected and what we are doing about it. We then help you notify the Information Regulator and the people affected, as section 22 of POPIA requires of you.

Requests from your customers

If someone asks us to see, correct or delete their information, we pass the request on to you, and help you answer it: we can export what we hold about a person, correct it or delete it. Records the law requires to be kept, such as issued invoices, are kept for as long as the law requires.

Our service providers

We use a small number of providers to run our services, such as hosting, backup storage and email delivery. We choose providers that protect information to a standard at least equal to this agreement, and we remain responsible to you for what they do. Where a provider stores information outside South Africa, it is in a country with data protection law of a similar standard to POPIA, or under an agreement that gives the same protection, as section 72 of POPIA requires. Our privacy policy says where our providers keep information.

How long we keep it

We keep the information while we provide our services to you. When our agreement ends, we give you a copy of your information if you ask within 30 days, and then delete it, except where the law requires a record to be kept. Copies in our backups are deleted as the backups expire.

Questions and checks

You may ask us at any time how we protect your information, and we will answer. For anything about this agreement, including a suspected breach, email [email protected] or WhatsApp 068 909 1282.

Changes

If we change this agreement, we update this page and the date at the top, and tell you of any change that affects how your information is handled.