Operator Agreement (POPIA)

This Operator Agreement is between the Customer (the responsible party) and NorthStar Digital Solutions (Pty) Ltd (the operator). It forms part of the Terms of Service and is accepted with them. It sets out how we process personal information contained in Customer Data, as required by sections 20 and 21 of the Protection of Personal Information Act 4 of 2013 (“POPIA”).

If this agreement conflicts with the Terms on a matter of personal information, this agreement prevails.

Data subjects: the Customer’s employees, contractors’ personnel and contact people, inspectors, people involved in incidents, and the Customer’s users.

Information: names, employee numbers, roles, sites, contact details, certifications and their issue and expiry dates, uploaded documents and photos, inspection results, and incident descriptions and investigations. Some of this may be special personal information, for example medical fitness certificates or injury details.

Purpose: only to provide the Service to the Customer — storing, displaying, reminding, reporting, backing up and securing the information — and for no other purpose.

The Customer’s use and configuration of the Service, and any written instructions it gives us, are its instructions. We will process the information only on those instructions, unless the law requires otherwise (in which case we will tell the Customer first, if the law allows).

We will treat the information as confidential and will only give access to people who need it to run or support the Service and who are bound by confidentiality.

• Encrypted connections (HTTPS) for all access; encrypted storage for uploaded files and backups.
• Separation of each customer’s data, enforced on every database query.
• Role-based access, hashed passwords, rate-limited sign-in, and an append-only audit trail.
• No public network access to the database; production access restricted to authorised staff.
• Automatic daily backups, security updates on the server, and monitoring of costs and resources.

If we have reasonable grounds to believe that personal information in Customer Data has been accessed or acquired by an unauthorised person, we will notify the Customer without undue delay, and in any event within 72 hours of becoming aware of it, with the information reasonably available to us, and we will take reasonable steps to contain it. The Customer, as responsible party, decides on and makes any notification to the Information Regulator and data subjects; we will give reasonable help.

Users can view, correct, export and delete most records themselves in the Service. If we receive a request directly from a data subject about Customer Data, we will pass it to the Customer and not respond ourselves unless instructed. We will give reasonable assistance with requests and with enquiries from the Information Regulator.

The Customer authorises us to use the providers below. They are bound by written terms that protect the information. We will give at least 30 days’ notice before adding or replacing a provider that processes Customer Data; if the Customer reasonably objects, it may end the agreement and receive a pro-rata refund of prepaid fees.

The Customer agrees to transfers outside South Africa for these purposes, which we make under binding agreements that provide protection substantially similar to POPIA (section 72).

• Have a lawful basis for collecting and uploading the information, including any special personal information, and tell data subjects (for example its workers) that their information is kept in an electronic compliance system operated by a service provider.
• Only upload information that is adequate, relevant and not excessive for its compliance purposes.
• Keep the information accurate and up to date, and delete it when it no longer needs it.
• Control who has user accounts, give users appropriate roles, and remove access promptly.

When the agreement ends, the Customer has 30 days to export its information. We then delete it from the live Service; backup copies expire within about 30 days after that. On request we will confirm deletion in writing.

On reasonable written request (not more than once a year, unless after a security compromise), we will provide information reasonably needed to show that we comply with this agreement, such as a description of our security measures and sub-operators.

The limits and exclusions of liability in the Terms of Service apply to this agreement, except where POPIA does not allow them to be limited.