Operator Agreement

Concluded in terms of section 21 of the Protection of Personal Information Act
4 of 2013 ("POPIA") between you (the Responsible Party) and 720DegreeIT
(the Operator).

This agreement is required by law. Section 21 obliges a responsible party to
conclude a written contract with any operator processing personal information
on its behalf.

1. Roles

You decide what personal information is collected from your customers and why.
You are the responsible party.

We process that information only on your instruction, to provide the Platform.
We are your operator. We do not decide the purpose or means of processing
beyond what is necessary to run the service.

2. What we process on your behalf

• Names, mobile numbers and email addresses of your customers
• WhatsApp message content exchanged between your customers and your business
• Booking, attendance and enrolment records
• Contract and electronic signature records
• Debit order mandate details and bank account information
• South African identity numbers where you require them
• Where you are a health practice, health information supplied by your patients.
This is special personal information under section 26 and is processed only where section 32 permits it.

3. Our obligations

We will:

• Process personal information only on your documented instructions, unless

required otherwise by law

• Treat all personal information as confidential


• Secure the integrity and confidentiality of personal information by taking

appropriate, reasonable technical and organisational measures as required by
section 19, including encryption at rest of credentials, identity numbers and
bank account numbers, database-level isolation between clients, encryption in
transit, and an append-only audit log

• Notify you without undue delay and within 24 hours of becoming aware of

any unauthorised access to or acquisition of personal information, as required
by section 22

• Assist you in responding to data subject requests for access, correction or

deletion

• Not process personal information for our own purposes


• Delete or return personal information on termination, subject to statutory

retention obligations

4. Your obligations

You will:

• Obtain any consent required from your customers, including consent for direct

marketing under section 69 and the consent of a competent person for a child's
information under section 34

• Give your customers a privacy notice covering their use of the Platform


• Ensure the information you upload is accurate and lawfully obtained


• Respond to data subject requests relating to your customers


• Not instruct us to process personal information unlawfully

5. Sub-operators

We use the service providers necessary to run the Platform. Currently: Meta
Platforms for WhatsApp message delivery, an AI language model provider for
generating replies, our South African hosting provider, an object storage
provider for media and documents, and the payment provider you select.

We remain responsible to you for their performance and will give you reasonable
notice before adding or changing a sub-operator that materially affects the
processing of your customers' information.

6. Cross-border transfer

Platform data is hosted in South Africa. Some sub-operators process information
outside the country. Where that happens we rely on section 72 and require by
contract that the recipient affords protection substantially similar to POPIA.

7. Messages pass through Meta

WhatsApp message content necessarily transits Meta's infrastructure. This is
inherent to using WhatsApp. You acknowledge this and are responsible for
informing your customers.

8. Retention

We retain personal information for the term of your subscription and for 90
days after termination, except where a statutory retention period applies to
signed agreements, mandates and financial records, in which case we anonymise
the personal information and retain only the record.

9. Duration

This agreement runs for as long as we process personal information on your
behalf and survives termination in respect of any information still held.