OPERATOR AGREEMENT

 

Entered into between:

 

Jonker Vorster Inc

Registration number: 2002/013781/21

(hereinafter referred to the Company)

 

 

And

 

_________________________________

(Hereinafter referred to as the “Operator”)

 

 

1.       INTRODUCTION

 

  1. The Protection of Personal Information Act, 4 of 2013 (POPIA) is a data protection privacy law which as its main function and objective, regulates and controls the processing of Personal Information by a Responsible Party.

  2. The Company, for the purposes of carrying out its business and related objectives, does and will from time to time, processes Personal Information belonging to a number of persons, including legal entities and individuals, who are referred to as Data Subjects under POPIA.

  3. The Company is obligated to comply with POPIA and the Data Protection conditions housed under POPIA with respect to the processing of all and any Personal Information pertaining to all and any Data Subjects.

  4. In order for the Company to pursue its mandate and its related operational and business interests, the Company may from time to time request third parties to process certain Personal Information on its behalf, which Personal Information has been obtained from its Data Subjects.

  5. In terms of section 20 of POPIA, if the Company discloses Personal Information which it has collected from Data Subjects to another for the purpose of processing or further processing of such Personal Information on its behalf, (hereinafter referred to as “the Operator”) then, any such processing must be subject to a written agreement concluded between the Company and the Operator, which contractually obliges the Operator to:

    1. comply with the provisions of POPIA and the POPIA processing conditions when processing such Personal Information on behalf of the Company;

    2. only process the Personal Information received from the Company in accordance with the mandate or written instruction received from the Company;

    3. keep all the Personal Information held by the Operator on behalf of the Company and / or belonging to the Company Data Subjects, confidential;

    4. put measures in place in order to keep all such Personal Information held by the Operator, and processed on behalf of the Company confidential, safe and secure from misuse, abuse and / or unauthorised use or access.

  6. The Company is desirous of providing the Operator with certain Personal Information which pertains to certain of its Data Subjects, which the Company would like the Operator to process on its behalf, and the Operator has agreed to process the Personal Information on behalf of the Company, which processing will be subject to the terms and conditions set out under this Operator Agreement.

 

2.       DEFINITIONS

 

2.1     The parties must take note of the following definitions, which will be used throughout this Operator Agreement,                  unless the context indicates a contrary meaning:

 

2.1.1    “Agreement” means the Agreement or series of Agreements entered into between the Company and the                            Operator;

2.1.2    “Data Subject (s)” means the person (s) who own (s) the Personal Information which is to be processed by the                       Operator, on behalf of the Company, in terms of the Agreement and the Operator Agreement;

2.1.3    “Jonker Vorster Inc” shall mean the Company, who has mandated the Operator to process certain Personal                           Information belonging to Data Subjects on its behalf, in accordance with the terms of this Operator Agreement;

2.1.4    "Operator" means _______________________ who has been mandated by the Company in terms of the                                 Agreement and this Operator Agreement to processes Personal Information belonging to certain Data Subject (s)               on its behalf;

2.1.5    “Operator Agreement” means this Operator Agreement;

2.1.6    "person" means an identifiable, living, natural person, or an identifiable, existing juristic person;

2.1.7    "Personal Information" means personal information relating to any identifiable, living, natural person, and an                         identifiable, existing juristic person, including, but not limited to:

2.1.7.1      in the case of an individual:

  • name, address, contact details, date of birth, place of birth, identity number, passport number, bank details, details about your employment, tax number and financial information;

  • vehicle registration;

  • dietary preferences;

  • financial history;

  • information about next of kin and or dependants;

  • information relating to education or employment history; and

  • Special Personal Information including race, gender, pregnancy, national, ethnic or social origin, colour, physical or mental health, disability, criminal history, including offences committed or alleged to have been committed, membership of a trade union and biometric information, such as images, fingerprints and voiceprints, blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition;

2.1.7.2        in the case of a juristic person:

  • name, address, contact details, registration details, financials and related history, B-BBEE score card, registered address, description of operations, bank details, details about employees, business partners, customers, tax number, VAT number and other financial information; and

  • correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;

  • the views or opinions of another individual about the person; and

  • the name of the person if it appears with other Personal Information relating to the person or if the disclosure of the name itself would reveal information about the person.

2.1.8          "process or processing" means any operation or activity or any set of operations, whether or not by automatic                      means, performed by the Operator concerning a Data Subject’s Personal Information, including—

(a)   the collection, receipt, recording, organization, collation, storage, updating or modification, retrieval, alteration, consultation or use;

(b) dissemination by means of transmission, distribution or making available in any other form; or

(c) merging, linking, as well as restriction, degradation, erasure or destruction of information;

2.1.9 "record" means any recorded information—

(a)   regardless of form or medium, including any of the following:

(i)    writing on any material;

(ii)   information produced, recorded or stored by means of any recorder, computer equipment, whether hardware or software or both, or other device, and any material subsequently derived from information so produced, recorded or stored;

(iii) label, marking or other writing that identifies or describes anything of which it forms part, or to which it is attached by any means;

(iv) book, map, plan, graph or drawing;

(v)   photograph, film, negative, tape or other device in which one or more visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced;

(b)   in the possession or under the control of a responsible party;

(c)   whether or not it was created by a responsible party; and

(d)   regardless of when it came into existence.

 

 

 

3.       MANDATE TO PROCESS

 

The Company hereby grants to the Operator a mandate to process certain Personal Information, of its data subjects, on its behalf for the following purpose and period:

 

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

 

4.       OBLIGATIONS OF THE OPERATOR

 

4.1     The Operator expressly warrants and undertakes that it will:

 

4.1.1      process the Personal Information strictly in accordance with its mandate set out under this Agreement, read                          together with Clause 3 above, and any specific written instructions provided to it by the Company from time to time;

4.1.2      not use the Personal Information for any other purpose, save for the purpose set out under this Operator                              Agreement and Clause 3, read together any further specific written instructions.

4.1.3      only disclose, transfer and/or hand over the Personal Information to those person(s) necessary to fulfil the                              purpose in Clause 3;

4.1.4      save for the provisions housed under clause 4.1.3, treat the Personal Information as confidential and not disclose                  the Personal Information to any other person unless required by law and only once it has provided the Company                  with adequate warning of this requirement to disclose and the related details thereof, including the identity of                      the person who is to receive the Personal Information, the reason for the disclosure and confirmation that                              the person to whom the Personal Information is to be disclosed to, has agreed to comply with all requirements of                POPIA and perform all its duties in terms of this agreement and the Privacy Policy of the Company;

4.1.5      has and will continue to have in place, appropriate technical and Organizational measures to protect and                              safeguard the Personal Information against accidental or unlawful destruction or accidental loss, alteration,                          unauthorised disclosure or access, and which in addition, provides a level of security appropriate to the risk                          represented by the processing and the nature of the Personal Information to be protected and which safeguards                  comply with the requirements set out under POPIA, and the Privacy Policy of the Company;

4.1.6      notify the Company immediately where it has reasonable grounds to believe that the Personal Information, which                has been provided to it, including any Personal Information which it has processed, has been lost, destroyed, or                  accessed or acquired by any unauthorised person;

4.1.7      process the Personal Information strictly in accordance with POPIA and the POPIA processing conditions;

4.1.8      not use the Personal Information for any direct marketing or advertising, research or statistical purposes, unless                    expressly authorised to do as described under “Annexure A”, read together with the Agreement, and when                          conducting such activity ensure that this is done strictly in compliance with the requirements of POPIA and its                      regulations especially those applicable to direct marketing detailed under section 69 of the POPIA;

4.1.9      not treat the Personal Information as its own, it expressly acknowledging that it has been tasked with processing                  the Personal Information in its capacity as the Company’s Operator and agent, and that ownership of all the                          records housing the Personal Information and any records comprising such Personal Information pertaining to the                Data Subject, will always remain with the Company;

4.1.10    not sell, alienate or otherwise part with the Personal Information or any of the records housing the Personal                          Information;

4.1.11    where it is allowed to transfer the Personal Information onwards, to any third party, known as a Sub Operator, for                  the purposes of performing its mandate, ensure that such party also concludes a “Operator agreement” with it                    and the Company which compels the third party receiving the Personal Information to respect and maintain the                    confidentiality and security of the Personal Information, which Operator Agreement will house the same terms                      and conditions as contained in this Agreement, and which shall be concluded before the Personal Information is                  transferred to the Sub operator.

4.1.12    ensure that any person acting under the authority of the Operator, including any employee or sub operator, shall                  be obligated to process the Personal Information only on instructions from the Operator and strictly in                                  accordance with this Operator Agreement, read together with all relevant policies, where applicable.

4.2         The Operator warrants that it has the legal authority to give the above-mentioned warranties and fulfil the                             undertakings set out in this Operator Agreement.

4.3     The Company, in order to ascertain compliance with the warranties and undertakings housed under this Operator                Agreement, will have the right on reasonable notice and during regular business hours, to view and / or audit, either            by itself or through an independent agent, the Operator’s facilities, files, and any other data processing                                  documentation needed for the required review, audit and / or independent or impartial inspection and the                            Operator undertakes to provide all necessary assistance which may be needed to give effect to this right.

 

5.       LIABILITY OF THE OPERATOR AND THIRD PARTY RIGHTS

 

5.1     In the event of the Operator, the Sub Operator or their respective employees or agents breaching any of the                        warranties and undertakings housed under this Agreement, or the Sub Operator Agreement here applicable, or                  failing to comply with any of the provisions of POPIA and / or the eight POPIA Personal Information conditions, then            in such an event, the Operator shall be liable for:

 

5..1.1 all damages it or the Sub Operator may have caused in consequence of said breach or non-compliance to a                          maximum amount of six times the amount of the last invoice.

 

5.2     At the request of the Company, the Operator will provide the Company with evidence of financial resources                          sufficient to fulfil its responsibilities set out under this Agreement, which may include insurance coverage.

 

6.       APPLICABLE LAW

 

          The laws of South Africa shall apply to this Operator Agreement, regardless of where the Personal Information is,                will be, or was actually processed.

 

7.       TERMINATION

 

7.1         In the event of:

7.1.1      the Agreement being terminated for whatsoever reason;

7.1.2      the transfer of Personal Information to the Operator being temporarily suspended by the Company for                                  longer than one month, for whatever reason;

7.1.3      the Operator is in breach of its obligations under this Agreement or has failed to comply with POPIA or the                          eight Information Processing Principles, and has failed when called upon to do so by the Company to rectify                        the breach;

7.1.4      the Operator is in substantial or persistent breach of any warranties or undertakings given by it under this                              Agreement, notwithstanding that the Company has not given the Operator notice of such breach;

7.1.5      the Sub Operator is in breach of the Sub Operator Agreement;

7.1.6      an application is filed for the placing of the Operator under business rescue, under administration, or winding up                whether interim or final, which application is not dismissed within the applicable period for such dismissal under                  applicable law; or any equivalent event in any jurisdiction occurs, then the Company without prejudice to any                        other rights, which it may have against the Operator, shall be entitled to terminate the Agreement and the                            Operator Agreement as well as the Sub Operator Agreement.

7.2          The Parties agree that the termination of the Agreement and the Operator Agreement at any time, and / or the                   Sub Operator agreement, where applicable, in any circumstances and for whatever reason, does not exempt                       them from the rights and obligations set out under this Operator Agreement with regards to the processing of                     the Personal Information detailed under Annexure “A” read together with the obligations under POPIA.

7.3          In the event of the Agreement and / or Operator Agreement being terminated whenever, and for whatsoever                      reason, the Operator undertakes to:

7.3.1      restore and / or transfer back to the Company all and any Personal Information which has been provided to the                    Operator for processing, including that held by the Sub Operator, whether same has been processed or not,                        and or which has been processed, together with any related documentation and / or information, all of which                        documentation must without exception, be returned to the Company within a period of 30 (thirty) days from date                of service of the termination notice.

7.3.2      to confirm in writing simultaneously when the transfer under clause 7.3.1 takes place, that all such Personal                            Information will be kept confidential as per the provisions of clause 4.1 and that it will not under any                                        circumstances use the aforementioned information for whatsoever reason.

7.4         Notwithstanding termination of the the Operator Agreement and for whatsoever reason, the clauses 4, 5, 6 and                    7.2 will survive any such termination.

 

8.       GENERAL

 

8.1     Variation

          The parties may not modify the provisions of this Operator Agreement unless such variation is reduced to writing                 and signed by the Parties.

 

8.2     Notices

          All notices to be provided in terms of the Operator Agreement must be sent to the Information Officer at:

 

 

Concluded on __________________ at ____________________________

 

 

_______________________________________

Signature on behalf of the Operator

Signature of: ____________________________

Position: _______________________________

 

 

 

Concluded on __________________ at ____________________________

 

 

_______________________________________

Signature on behalf of the Company

Signature of: ____________________________

Position: _______________________________