Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of our Terms of Service. It sets out how personal information is processed under the Protection of Personal Information Act 4 of 2013 (POPIA).

• Allocentra is the operator. Allocentra (Pty) Ltd processes personal information on your behalf, only to provide the Service.
• You, the MSP or organisation, are the responsible party. You decide why and how personal information is processed through the Service, including for the clients you manage.

Identity and contact data of your technicians, your clients and their staff; device and system data (device names, IP addresses, hardware identifiers, installed software); activity data (tickets, audit log entries, remote session records); and technical data (agent check-ins, patch status, alert history).

We process personal information only on your documented instructions (these Terms, this DPA and any written instructions you give us), or where the law requires it.

Encryption in transit (TLS 1.2 or later) and at rest (AES-256), role-based access with least privilege, multi-factor authentication for staff with production access, secrets held in a managed secrets store, and logical separation of each customer by tenant.

Customer data is hosted with Amazon Web Services in the eu-west-1 region (Ireland, European Union). This is a transfer of personal information outside South Africa under POPIA section 72.

[Placeholder: the legal basis for the transfer (adequate protection under the GDPR, binding agreement with the sub-operator), and the responsible party's authorisation.]

• Amazon Web Services (AWS): cloud infrastructure, eu-west-1 (Ireland, EU).
• Paystack: payment processing, billing data only, South Africa.

[Placeholder: notice period and objection process for new sub-operators.]

We will tell you without undue delay, and within 72 hours of becoming aware, if a security compromise affects your personal information, so you can meet your duties under POPIA section 22.

[Placeholder: how we help you respond to access, correction and deletion requests.]

[Placeholder: return of data in a machine-readable format within 30 days, then deletion within 30 days, except where the law requires us to keep it.]

[Placeholder: audit requests, notice period, confidentiality and costs.]

[Placeholder: liability follows the Terms of Service cap; South African law applies; this DPA prevails over the Terms on matters of personal information.]

Data protection queries: privacy@allocentra.co.za.