Data Processing Agreement

1. Roles of the parties

Under the Protection of Personal Information Act, 2013 (POPIA), the customer is the Responsible Party for the personal information it uploads to or processes through the platform (including its employees' personal information). Compliance Radar acts as the Operator, processing that personal information only on the customer's documented instructions and for the purpose of providing the service.

2. Scope & purpose of processing

We process personal information solely to provide the Compliance Radar service, including:

• storing and managing employee, vehicle, company, and equipment compliance records;
• sending expiry reminders and notifications by email and WhatsApp;
• delivering payslips to the customer's employees over WhatsApp, with their recorded consent;
• generating compliance documents, reports, and statutory return drafts;
• managing the customer's disciplinary matters, including transcribing and summarising hearing recordings the customer uploads;
• maintaining audit logs and securing the platform.

3. Categories of data subjects & personal information

Data subjects include the customer's employees, drivers, and authorised users, and others who take part in the customer's disciplinary hearings, such as representatives. Personal information may include names, contact details, SA ID or passport numbers, employment details, credential and licence data, payslip and remuneration data, disciplinary records (charges, warnings, hearing documents and outcomes), hearing recordings (audio and transcripts), and uploaded compliance documents. The customer controls what it uploads.

4. Sub-operators

The customer authorises Compliance Radar to engage the following sub-operators, each bound by appropriate data-protection obligations:

• Amazon Web Services: database and storage of uploaded documents and hearing recordings, in the af-south-1 (Cape Town) region.
• Render: application servers that run the platform, in Frankfurt, Germany (EU).
• Vercel: hosting and content delivery for our website and the application's front end.
• Resend: transactional email delivery.
• Meta Platforms (WhatsApp Business Platform): WhatsApp delivery of payslips and, where the customer selects it, reminders.
• Twilio: WhatsApp reminders, sent through the customer's own Twilio account where the customer selects it.
• Paystack: payment processing (billing data only).
• Sentry: error monitoring (technical error details only).
• Anthropic: AI extraction of data from uploaded documents, payroll files and spreadsheets (including matching spreadsheet columns to fields), assistant answers (including the employee and vehicle records, with disciplinary warnings and cases, that the assistant looks up in the customer's account), and summaries of disciplinary hearing transcripts.
• OpenAI: transcription of disciplinary hearing recordings.
• Voyage AI: search embeddings of assistant questions, legal texts and the policies, handbooks, contract templates and other documents a customer adds to its knowledge library, used to find the passages the assistant relies on.

Anthropic and OpenAI process this data under their API terms, which do not permit use of the data to train their models. Voyage AI processes it under its API terms.

We will give reasonable notice of any intended change to our sub-operators so the customer may object on reasonable grounds.

5. Security measures

We implement appropriate, reasonable technical and organisational measures as required by POPIA Section 19 — including encryption in transit and at rest, tenant isolation, role-based access control, and audit logging. Full detail is on our Security page.

6. Assisting the Responsible Party

We will assist the customer, so far as reasonably possible, in responding to data-subject requests (access, correction, deletion, objection) and in meeting its POPIA obligations, using the platform's export and deletion tools and reasonable support.

7. Personal-information breaches

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the customer immediately, as section 21(2) of POPIA requires, and provide the information needed for the customer to meet its notification obligations under POPIA Section 22.

8. Cross-border transfers

Records and uploaded documents are stored on Amazon Web Services in the af-south-1 (Cape Town) region. The application runs on Render in Frankfurt, Germany (EU). Assistant, extraction, embedding and transcription processing by Anthropic, Voyage AI and OpenAI may happen in the United States. The website and the application's front end are served by Vercel, messages are sent through Meta Platforms (WhatsApp Cloud API), Twilio and Resend, error monitoring runs through Sentry, and payments are processed by Paystack; these providers may also process data outside South Africa. Where any processing takes place outside South Africa, we ensure an adequate level of protection consistent with POPIA Section 72.

9. Return & deletion of data

On termination of the service, the customer may export its data. We will delete or return personal information within a reasonable period thereafter, save where retention is required by law. Soft-deleted records are purged after their retention grace period.

10. Term

This DPA applies for as long as Compliance Radar processes personal information on the customer's behalf, and forms part of our Terms of Service.

11. Contact

Data-protection enquiries: [email protected]. You may also lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.