AEGIS Intelligence Systems (Pty) Ltd Reg. 2026/521302/07
Republic of South Africa
Information Officer: info@aegis.org.za

Operator Agreement

1The parties

The Firm is the responsible party. AEGIS is the operator. The Firm determines the purpose and means of processing the personal information in its client books. AEGIS processes it only on the Firm's instruction, and has no authority to determine the purpose or means of that processing.

2What is being processed — Schedule 1

Required by s21 to be specified. This is the whole of what we may lawfully touch.

3Our obligations as operator

1. We process only on your instruction. AEGIS will process the personal information only with the knowledge and authorisation of the Firm, and only for the purpose in Schedule 1. Your use of the platform, and any written instruction you give us, constitutes that instruction. We will not process it for any purpose of our own.
2. If we believe an instruction is unlawful, we will tell you rather than simply carry it out, and we may decline to act on it.
3. Confidentiality. AEGIS treats all personal information as confidential and will not disclose it, unless required by law or in the course of the proper performance of its duties (s20). Every person at AEGIS with access is bound by a written confidentiality undertaking that survives the end of their engagement.
4. Security (s19). AEGIS will secure the integrity and confidentiality of the personal information by taking appropriate, reasonable technical and organisational measures — set out in Schedule 2 — to prevent loss of, damage to, or unauthorised destruction of, and unlawful access to or processing of, the information. We will continually review and update these measures in response to new risks and deficiencies.
5. Assistance. AEGIS will assist the Firm, at the Firm's request, to respond to data-subject requests under POPIA ss23–25, and to fulfil the Firm's own obligations to the Information Regulator.
6. People. AEGIS will ensure that only those of its personnel who need access in order to deliver the service have it, and that every such access is logged.
7. No AI training. AEGIS will not use the personal information, or any part of the client books, to train, fine-tune or evaluate any artificial-intelligence model — not raw, not aggregated, not anonymised, not de-identified — unless the Firm instructs it in writing for the Firm's own purpose. Automated processing performed within the platform to deliver the service to the Firm (for example, extracting figures from a supplier invoice) is permitted and is done on the Firm's instruction.
8. No sale, no mining, no benchmarking. AEGIS will not sell, licence, rent or otherwise commercialise the personal information, and will not use it for market research, benchmarking, or any product of its own.

4Your obligations as responsible party

1. You warrant that you have a lawful basis to process the personal information you load, and the mandate of each client to appoint an operator.
2. You will give instructions that are lawful, and you will keep your own POPIA obligations — including notifying data subjects, and your own Information Officer registration.
3. You will manage your own users' access, and remove them promptly when they leave your firm.
4. You remain responsible for the accuracy of the data you load. The platform is built to refuse rather than guess, and you will not defeat those refusals.

5Breach notification (s22)

1. The duty to notify the Information Regulator and the affected data subjects is yours, as responsible party. You cannot discharge it if we delay telling you. So we will not delay.
2. Our notification will include, so far as we know it: what happened, when, which categories of information and data subjects are affected, the likely consequences, and what we are doing about it.
3. We will provide reasonable assistance, at our cost where the breach arose from our failure, to enable you to make your notification and to mitigate the harm.
4. We will not make a public statement about a breach affecting your clients without consulting you first, unless the law compels us to.

6Sub-operators

You authorise AEGIS to appoint the sub-operators listed in Schedule 3. Each is bound by written terms no less protective than this agreement. AEGIS remains fully liable to you for the acts and omissions of its sub-operators as if they were its own. We will give you 30 days' notice before adding or replacing a sub-operator, and if you reasonably object on data-protection grounds you may terminate without penalty.

7Cross-border transfer (s72)

Some sub-operators process outside South Africa. AEGIS relies on binding contractual terms with each of them that uphold principles of protection substantially similar to POPIA, as s72(1)(a) permits. The primary database and file storage are hosted in the European Union, under the GDPR. Schedule 3 states the location of each sub-operator.

8Audit and assurance

1. On reasonable written notice, and not more than once a year (unless a breach has occurred), AEGIS will provide the Firm with the information reasonably necessary to demonstrate compliance with this agreement.
2. AEGIS will make available, on request: the current security measures (Schedule 2), the sub-operator list (Schedule 3), and the platform's access-log and audit-trail records relating to the Firm's own data.

9Return and deletion

1. You may export your data at any time, unaided, in open formats. Export is a function of the platform, not a favour.
2. On termination, AEGIS will make a full export available for 60 days.
3. Thereafter AEGIS will delete the personal information on your written instruction, and will confirm the deletion in writing — except where AEGIS is required by law to retain it, or where it forms part of the append-only audit trail, which is not deletable by design and which exists to protect the integrity of the records you signed.
4. AEGIS will not withhold your data as leverage in any dispute, including a dispute about money.

10General

1. This agreement is supplemental to the Terms of Service (Document 02). Where it conflicts with them on any matter of personal information, this agreement prevails.
2. It endures for as long as AEGIS processes personal information on the Firm's behalf, and the confidentiality, security and deletion obligations survive termination.
3. Governed by the laws of the Republic of South Africa.
4. The parties agree that an electronic signature is valid and binding under the Electronic Communications and Transactions Act 25 of 2002.

S2Schedule 2 — security measures (POPIA s19)

S3Schedule 3 — approved sub-operators