Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of our Terms of Service. It sets out how personal information is processed under the Protection of Personal Information Act 4 of 2013 (POPIA).

• Allocentra is the operator. Allocentra (Pty) Ltd processes personal information on your behalf, only to provide the Service.
• You, the MSP or organisation, are the responsible party. You decide why and how personal information is processed through the Service, including for the clients you manage.

Identity and contact data of your technicians, your clients and their staff; device and system data (device names, IP addresses, hardware identifiers, installed software); activity data (tickets, audit log entries, remote session records); and technical data (agent check-ins, patch status, alert history).

We process personal information only on your documented instructions (these Terms, this DPA and any written instructions you give us), or where the law requires it.

Encryption in transit (TLS 1.2 or later) and at rest (AES-256), role-based access with least privilege, multi-factor authentication for staff with production access, secrets held in a managed secrets store, and logical separation of each customer by tenant.

Customer data, including database backups and all inbound and outbound email, is stored and processed only with Amazon Web Services in the af-south-1 region (Cape Town, South Africa). We will not move customer data outside South Africa without first updating this DPA and giving you notice as set out in section 6.

You authorise us to use these sub-operators:

• Amazon Web Services (AWS): hosting, databases, storage, backups and email (Amazon SES) in af-south-1 (Cape Town, South Africa).
• Paystack: payment processing, billing data only, South Africa.
• Google: Android device management (Android Management API), only for customers who enrol Android devices. Google processes device data under its own data processing terms.
• Cloudflare: Turnstile bot check on our signup form. No customer data is sent to it.

We will email your account admins at least 30 days before we add or replace a sub-operator that processes your personal information. If you object on reasonable data protection grounds, tell us within that period; if we cannot address the objection, you may end the affected service without penalty and we will refund any prepaid fees for the unused period. Each sub-operator is bound by written terms at least as protective as this DPA.

We will tell you without undue delay, and within 72 hours of becoming aware, if a security compromise affects your personal information, so you can meet your duties under POPIA section 22. We will tell you what happened, what information is affected, what we have done and what you should do, and we will keep you updated as we learn more.

You can export, correct and delete most personal information yourself in the Service. Where you need our help to answer an access, correction or deletion request, we will help within 10 business days. If a data subject contacts us directly about data we process for you, we will pass the request to you and will not answer it ourselves unless you ask us to.

You can export your data at any time, including during the notice period: devices, tickets, alerts, patches, contacts and the audit log as CSV or Excel, and everything through the API. After your subscription ends we keep your data for a 90-day recovery window. On written request during that window we will give you a full export in a machine-readable format within 30 days. At the end of the window, or earlier if you ask us in writing, we delete your data; database backups that contain it expire within 7 days after that. We keep billing records for 5 years because South African tax law requires it.

We will answer reasonable written security and privacy questionnaires and give you the information you need to show that this DPA is being followed. You may ask for an audit or inspection once a year, or after a security compromise that affects you, with at least 30 days' written notice. An audit takes place in business hours, under confidentiality, without access to other customers' data, and at your cost unless it shows a material breach of this DPA.

Liability under this DPA follows the limits in our Terms of Service. South African law governs this DPA. If this DPA and the Terms conflict on a matter of personal information, this DPA prevails.

Data protection queries: privacy@allocentra.co.za.