Entered into between:
Jonker Vorster Inc
Registration number: 2002/013781/21
(hereinafter referred to the Company)
(Hereinafter referred to as the “Operator”)
The Protection of Personal Information Act, 4 of 2013 (POPIA) is a data protection privacy law which as its main function and objective, regulates and controls the processing of Personal Information by a Responsible Party.
The Company, for the purposes of carrying out its business and related objectives, does and will from time to time, processes Personal Information belonging to a number of persons, including legal entities and individuals, who are referred to as Data Subjects under POPIA.
The Company is obligated to comply with POPIA and the Data Protection conditions housed under POPIA with respect to the processing of all and any Personal Information pertaining to all and any Data Subjects.
In order for the Company to pursue its mandate and its related operational and business interests, the Company may from time to time request third parties to process certain Personal Information on its behalf, which Personal Information has been obtained from its Data Subjects.
In terms of section 20 of POPIA, if the Company discloses Personal Information which it has collected from Data Subjects to another for the purpose of processing or further processing of such Personal Information on its behalf, (hereinafter referred to as “the Operator”) then, any such processing must be subject to a written agreement concluded between the Company and the Operator, which contractually obliges the Operator to:
comply with the provisions of POPIA and the POPIA processing conditions when processing such Personal Information on behalf of the Company;
only process the Personal Information received from the Company in accordance with the mandate or written instruction received from the Company;
keep all the Personal Information held by the Operator on behalf of the Company and / or belonging to the Company Data Subjects, confidential;
put measures in place in order to keep all such Personal Information held by the Operator, and processed on behalf of the Company confidential, safe and secure from misuse, abuse and / or unauthorised use or access.
The Company is desirous of providing the Operator with certain Personal Information which pertains to certain of its Data Subjects, which the Company would like the Operator to process on its behalf, and the Operator has agreed to process the Personal Information on behalf of the Company, which processing will be subject to the terms and conditions set out under this Operator Agreement.
2.1 The parties must take note of the following definitions, which will be used throughout this Operator Agreement, unless the context indicates a contrary meaning:
2.1.1 “Agreement” means the Agreement or series of Agreements entered into between the Company and the Operator;
2.1.2 “Data Subject (s)” means the person (s) who own (s) the Personal Information which is to be processed by the Operator, on behalf of the Company, in terms of the Agreement and the Operator Agreement;
2.1.3 “Jonker Vorster Inc” shall mean the Company, who has mandated the Operator to process certain Personal Information belonging to Data Subjects on its behalf, in accordance with the terms of this Operator Agreement;
2.1.4 "Operator" means _______________________ who has been mandated by the Company in terms of the Agreement and this Operator Agreement to processes Personal Information belonging to certain Data Subject (s) on its behalf;
2.1.5 “Operator Agreement” means this Operator Agreement;
2.1.6 "person" means an identifiable, living, natural person, or an identifiable, existing juristic person;
2.1.7 "Personal Information" means personal information relating to any identifiable, living, natural person, and an identifiable, existing juristic person, including, but not limited to:
184.108.40.206 in the case of an individual:
name, address, contact details, date of birth, place of birth, identity number, passport number, bank details, details about your employment, tax number and financial information;
information about next of kin and or dependants;
information relating to education or employment history; and
Special Personal Information including race, gender, pregnancy, national, ethnic or social origin, colour, physical or mental health, disability, criminal history, including offences committed or alleged to have been committed, membership of a trade union and biometric information, such as images, fingerprints and voiceprints, blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition;
220.127.116.11 in the case of a juristic person:
name, address, contact details, registration details, financials and related history, B-BBEE score card, registered address, description of operations, bank details, details about employees, business partners, customers, tax number, VAT number and other financial information; and
correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
the views or opinions of another individual about the person; and
the name of the person if it appears with other Personal Information relating to the person or if the disclosure of the name itself would reveal information about the person.
2.1.8 "process or processing" means any operation or activity or any set of operations, whether or not by automatic means, performed by the Operator concerning a Data Subject’s Personal Information, including—
(a) the collection, receipt, recording, organization, collation, storage, updating or modification, retrieval, alteration, consultation or use;
(b) dissemination by means of transmission, distribution or making available in any other form; or
(c) merging, linking, as well as restriction, degradation, erasure or destruction of information;
2.1.9 "record" means any recorded information—
(a) regardless of form or medium, including any of the following:
(i) writing on any material;
(ii) information produced, recorded or stored by means of any recorder, computer equipment, whether hardware or software or both, or other device, and any material subsequently derived from information so produced, recorded or stored;
(iii) label, marking or other writing that identifies or describes anything of which it forms part, or to which it is attached by any means;
(iv) book, map, plan, graph or drawing;
(v) photograph, film, negative, tape or other device in which one or more visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced;
(b) in the possession or under the control of a responsible party;
(c) whether or not it was created by a responsible party; and
(d) regardless of when it came into existence.
3. MANDATE TO PROCESS
The Company hereby grants to the Operator a mandate to process certain Personal Information, of its data subjects, on its behalf for the following purpose and period:
4. OBLIGATIONS OF THE OPERATOR
4.1 The Operator expressly warrants and undertakes that it will:
4.1.1 process the Personal Information strictly in accordance with its mandate set out under this Agreement, read together with Clause 3 above, and any specific written instructions provided to it by the Company from time to time;
4.1.2 not use the Personal Information for any other purpose, save for the purpose set out under this Operator Agreement and Clause 3, read together any further specific written instructions.
4.1.3 only disclose, transfer and/or hand over the Personal Information to those person(s) necessary to fulfil the purpose in Clause 3;
4.1.6 notify the Company immediately where it has reasonable grounds to believe that the Personal Information, which has been provided to it, including any Personal Information which it has processed, has been lost, destroyed, or accessed or acquired by any unauthorised person;
4.1.7 process the Personal Information strictly in accordance with POPIA and the POPIA processing conditions;
4.1.8 not use the Personal Information for any direct marketing or advertising, research or statistical purposes, unless expressly authorised to do as described under “Annexure A”, read together with the Agreement, and when conducting such activity ensure that this is done strictly in compliance with the requirements of POPIA and its regulations especially those applicable to direct marketing detailed under section 69 of the POPIA;
4.1.9 not treat the Personal Information as its own, it expressly acknowledging that it has been tasked with processing the Personal Information in its capacity as the Company’s Operator and agent, and that ownership of all the records housing the Personal Information and any records comprising such Personal Information pertaining to the Data Subject, will always remain with the Company;
4.1.10 not sell, alienate or otherwise part with the Personal Information or any of the records housing the Personal Information;
4.1.11 where it is allowed to transfer the Personal Information onwards, to any third party, known as a Sub Operator, for the purposes of performing its mandate, ensure that such party also concludes a “Operator agreement” with it and the Company which compels the third party receiving the Personal Information to respect and maintain the confidentiality and security of the Personal Information, which Operator Agreement will house the same terms and conditions as contained in this Agreement, and which shall be concluded before the Personal Information is transferred to the Sub operator.
4.1.12 ensure that any person acting under the authority of the Operator, including any employee or sub operator, shall be obligated to process the Personal Information only on instructions from the Operator and strictly in accordance with this Operator Agreement, read together with all relevant policies, where applicable.
4.2 The Operator warrants that it has the legal authority to give the above-mentioned warranties and fulfil the undertakings set out in this Operator Agreement.
4.3 The Company, in order to ascertain compliance with the warranties and undertakings housed under this Operator Agreement, will have the right on reasonable notice and during regular business hours, to view and / or audit, either by itself or through an independent agent, the Operator’s facilities, files, and any other data processing documentation needed for the required review, audit and / or independent or impartial inspection and the Operator undertakes to provide all necessary assistance which may be needed to give effect to this right.
5. LIABILITY OF THE OPERATOR AND THIRD PARTY RIGHTS
5.1 In the event of the Operator, the Sub Operator or their respective employees or agents breaching any of the warranties and undertakings housed under this Agreement, or the Sub Operator Agreement here applicable, or failing to comply with any of the provisions of POPIA and / or the eight POPIA Personal Information conditions, then in such an event, the Operator shall be liable for:
5..1.1 all damages it or the Sub Operator may have caused in consequence of said breach or non-compliance to a maximum amount of six times the amount of the last invoice.
5.2 At the request of the Company, the Operator will provide the Company with evidence of financial resources sufficient to fulfil its responsibilities set out under this Agreement, which may include insurance coverage.
6. APPLICABLE LAW
The laws of South Africa shall apply to this Operator Agreement, regardless of where the Personal Information is, will be, or was actually processed.
7.1 In the event of:
7.1.1 the Agreement being terminated for whatsoever reason;
7.1.2 the transfer of Personal Information to the Operator being temporarily suspended by the Company for longer than one month, for whatever reason;
7.1.3 the Operator is in breach of its obligations under this Agreement or has failed to comply with POPIA or the eight Information Processing Principles, and has failed when called upon to do so by the Company to rectify the breach;
7.1.4 the Operator is in substantial or persistent breach of any warranties or undertakings given by it under this Agreement, notwithstanding that the Company has not given the Operator notice of such breach;
7.1.5 the Sub Operator is in breach of the Sub Operator Agreement;
7.1.6 an application is filed for the placing of the Operator under business rescue, under administration, or winding up whether interim or final, which application is not dismissed within the applicable period for such dismissal under applicable law; or any equivalent event in any jurisdiction occurs, then the Company without prejudice to any other rights, which it may have against the Operator, shall be entitled to terminate the Agreement and the Operator Agreement as well as the Sub Operator Agreement.
7.2 The Parties agree that the termination of the Agreement and the Operator Agreement at any time, and / or the Sub Operator agreement, where applicable, in any circumstances and for whatever reason, does not exempt them from the rights and obligations set out under this Operator Agreement with regards to the processing of the Personal Information detailed under Annexure “A” read together with the obligations under POPIA.
7.3 In the event of the Agreement and / or Operator Agreement being terminated whenever, and for whatsoever reason, the Operator undertakes to:
7.3.1 restore and / or transfer back to the Company all and any Personal Information which has been provided to the Operator for processing, including that held by the Sub Operator, whether same has been processed or not, and or which has been processed, together with any related documentation and / or information, all of which documentation must without exception, be returned to the Company within a period of 30 (thirty) days from date of service of the termination notice.
7.3.2 to confirm in writing simultaneously when the transfer under clause 7.3.1 takes place, that all such Personal Information will be kept confidential as per the provisions of clause 4.1 and that it will not under any circumstances use the aforementioned information for whatsoever reason.
7.4 Notwithstanding termination of the the Operator Agreement and for whatsoever reason, the clauses 4, 5, 6 and 7.2 will survive any such termination.
The parties may not modify the provisions of this Operator Agreement unless such variation is reduced to writing and signed by the Parties.
All notices to be provided in terms of the Operator Agreement must be sent to the Information Officer at:
Concluded on __________________ at ____________________________
Signature on behalf of the Operator
Signature of: ____________________________
Concluded on __________________ at ____________________________
Signature on behalf of the Company
Signature of: ____________________________