Data Processing Agreement

1.1 This Agreement is between you (the "Controller", or "Responsible Party" under POPIA) and the SORMALITICS entity that provides the Services to you (the "Processor", or "Operator"):

• Polompa Investments Limited (company no. 15079461, England & Wales) — if you are in the UK or the EU
• AlloBTeQ (Pty) Ltd (registration no. 2023/270245/07, South Africa) — if you are anywhere else

1.2 It applies to personal data you upload or generate about third parties — your clients, their employees, their customers and their contacts. It does not apply to your own account information, for which we are the controller and the Privacy Policy applies.

1.3 It forms part of, and is governed by, our Terms of Service. Where the two conflict on the processing of client personal data, this Agreement prevails.

1.4 It takes effect when you accept it, and continues for as long as we process client personal data for you.

Article 28(3) requires this to be set out specifically, so:

3.1 You warrant that you have a lawful basis for every piece of personal data you put into SORMALITICS, and the authority to instruct us to process it.

3.2 You are responsible for giving privacy notices to the people whose data you upload. They do not have a relationship with us, and we cannot notify them on your behalf.

3.3 Your instructions to us must be lawful. If we believe an instruction breaches data protection law, we will tell you and may decline to act on it.

3.4 You are responsible for the accuracy of what you upload, and for handling requests from your clients' data subjects. See section 7.

3.5 Where your own client engagement makes your client the controller and you their processor, you must have the corresponding agreement in place with them. This Agreement covers our relationship with you, not yours with them.

4.1 We process client personal data only on your documented instructions. Your use of the Services, the configuration you choose, and this Agreement together constitute those instructions.

4.2 We do not process client personal data for our own purposes. Specifically, we do not use it to train machine-learning models, we do not sell or share it, and we do not use it for marketing or analytics.

4.3 If law requires us to process beyond your instructions, we will tell you first unless that law prohibits it on important grounds of public interest.

(a) Documented instructions. We process only on your documented instructions, including on transfers to a third country, unless required otherwise by law.

(b) Confidentiality. Everyone we authorise to process client personal data is bound by a duty of confidentiality that survives the end of their engagement.

(c) Security. We take the measures in section 6.

(d) Sub-processors. We engage sub-processors only on the terms in section 8.

(e) Assisting with data subject rights. We provide the technical measures in section 7 so that you can meet requests from your clients' data subjects.

(f) Assisting with your obligations. We assist you, taking into account what we know and what is available to us, with security, breach notification, impact assessments and prior consultation.

(g) Deletion or return. At the end of the Services we delete or return client personal data as set out in section 9.

(h) Audit. We make available the information needed to demonstrate compliance with this Agreement, and allow for audits as described in section 11.

Our technical and organisational measures, appropriate to the risk:

• TLS encryption in transit on every connection
• Encryption at rest through our infrastructure providers
• Additional application-level encryption for agreement content
• Passwords hashed with bcrypt; never stored in readable form
• Two-factor authentication, enabled by default
• Role-based access control, with per-account data isolation applied at query level
• Rate limiting, bot filtering and application firewall rules
• Malware scanning of uploaded files
• Audit logging of significant actions, with signature audit trails
• Automated DNS and TLS certificate monitoring
• A documented and exercised incident response plan

6.2 We review these measures periodically and may change them, provided the level of protection is not reduced.

7.1 If one of your clients' data subjects contacts us directly, we will not respond substantively. We will tell them to contact you and, where we can identify you as the controller, let you know.

7.2 The Services give you the means to answer most requests yourself — you can view, correct, export and delete client records from your practitioner account without asking us.

7.3 Where you need help beyond that, we will assist. We do not charge for reasonable assistance.

7.4 Deletion of client data through the Services is subject to the statutory retention rules in section 9 — the same rules that apply to your own records.

8.1 You give general authorisation for us to engage sub-processors, on the conditions below.

8.2 The current list is published in section 4 of our Privacy Policy and forms part of this Agreement. It names every third party that processes personal data on our behalf — hosting, database, caching, payments, email, SMS, error reporting, malware scanning and, with consent, analytics.

8.3 Each sub-processor is bound by written terms imposing obligations no less protective than these. We remain fully liable to you for their performance.

8.4 Changes. We will give you at least 30 days' notice by email before adding or replacing a sub-processor that handles client personal data. If you object on reasonable data-protection grounds within that period, we will work with you to find an alternative; if we cannot, you may terminate the affected Services and we will refund any unused prepaid period.

8.5 Two sub-processors are worth your attention specifically:

• Malware scanning. Uploaded files may be submitted to a third-party scanning service that shares submissions with its security-vendor network. If your clients' documents are sensitive enough that this matters, tell us and we will configure local-only scanning for your account.
• Session analytics. Never runs on signed-in pages, so no client data is ever recorded by it.

9.1 You can export client data at any time from your account, in a machine-readable format, at no charge.

9.2 When you remove a client profile or close your account, there is a 30-day grace period in which you can retrieve or restore the data.

9.3 After that period:

• Working data — client records, templates, agreements, uploaded files — is deleted
• Financial and payroll records are anonymised rather than deleted, because tax and company law require the underlying record to be retained

9.4 Anonymised records are retained only to meet those obligations and are not processed for any other purpose.

9.5 Deleted data may persist briefly in encrypted backups before those are cycled out. It is not restored to live systems.

10.1 We will notify you without undue delay, and in any event within 48 hours, of becoming aware of a breach affecting client personal data we process for you.

Forty-eight hours, not seventy-two: your own 72-hour clock to your regulator starts when we tell you, so you need the time to act.

10.2 Our notification will describe the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point for more information. Where we cannot provide it all at once, we will provide it in phases.

10.3 Notifying your supervisory authority and the affected data subjects is your responsibility as controller. We will not do it on your behalf, because we do not hold your relationship with them — but we will give you what you need.

10.4 We will assist with your investigation and remediation, and will not require payment for reasonable assistance.

11.1 On reasonable written request, and no more than once a year unless a breach or a regulator requires otherwise, we will provide the information reasonably needed to demonstrate compliance with this Agreement.

11.2 That will normally take the form of written answers, our security documentation and our sub-processor list. Where that is genuinely insufficient for your regulator, we will discuss an on-site or remote audit, at reasonable notice, during business hours, under confidentiality, and without disrupting the Services or exposing other customers' data.

11.3 You bear your own audit costs. We bear ours, unless the audit reveals a material breach by us, in which case we bear both.

12.1 Client personal data may be processed outside South Africa, the UK and the EU, because our infrastructure providers operate internationally. We do not own or operate data centres, and we do not currently offer data residency on any plan.

12.2 Transfers are made under the appropriate safeguard for the route: UK and EU Standard Contractual Clauses (with the UK Addendum where applicable), an adequacy decision where one exists, or POPIA section 72 for transfers out of South Africa.

12.3 Where the UK or EU SCCs apply, they are incorporated into this Agreement, with you as data exporter and us as data importer, Module Two (controller to processor). The technical and organisational measures in section 6 populate Annex II, the details in section 2 populate Annex I, and our sub-processor list populates Annex III.

12.4 If your engagement requires data residency in a particular jurisdiction, SORMALITICS cannot currently meet that requirement. We would rather say so here than at procurement.

13.1 Liability. Each party's liability under this Agreement is subject to the limitations in the Terms of Service, except where data protection law does not permit that limitation.

13.2 Term. This Agreement runs for as long as we process client personal data for you. Sections 9, 10 and 13 survive its end.

13.3 Changes. We may update this Agreement where the law or our processing changes. For a material change we give at least 30 days' notice and ask you to accept the new version. Each version is numbered and your acceptance is recorded against it.

13.4 Governing law. As set out in the Terms of Service — England & Wales for Polompa customers, South Africa for AlloBTeQ customers.

13.5 Precedence. Where this Agreement conflicts with the Terms of Service on the processing of client personal data, this Agreement prevails. Where it conflicts with the SCCs, the SCCs prevail.

13.6 Severability. If a provision is unenforceable, the rest continues to apply.