Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between DOMI VERA, registration number 2026/151747/07, trading as Domi Vera (“Domi Vera” or the “Operator”), and the business that holds a Domi Vera account (the “Customer” or “Responsible Party”). It applies whenever Domi Vera processes personal information for the Customer in providing the platform. It is the written contract required by section 21 of the Protection of Personal Information Act 4 of 2013 (“POPIA”). Words defined in the Terms of Service have the same meaning here.

1 Roles and instructions

The Customer decides the purpose and means of processing the personal information in its account and is the responsible party. Domi Vera is the operator: it processes that information only with the Customer’s knowledge or authorisation, on the Customer’s instructions given through its use and configuration of the platform, under the Terms of Service and applicable law. Domi Vera processes without an instruction only where South African law requires it, and will tell the Customer before doing so unless that law forbids it. If Domi Vera believes an instruction breaks data-protection law, it may pause the affected processing and tell the Customer.

Each party remains a responsible party for personal information it processes for its own business purposes, such as its staff, contracting, billing, legal compliance and security.

2 What is processed

The processing supports the platform’s property, lease, user, billing, document, support and portal functions. It may include collecting, recording, organising, storing, retrieving, calculating, consulting, sharing with authorised users, sending, restricting, correcting, exporting and deleting information.

The people concerned may include the Customer’s staff and managers, property owners, tenants, co-tenants, guarantors, next of kin, vendor contacts, signatories and anyone else whose information the Customer lawfully enters. The categories of information are described in the Privacy Policy and include identity, contact, property, lease, financial, banking, employment, meter, document, communication and audit information.

Processing continues for as long as the Customer’s account is active, and afterwards for the return and deletion periods in section 10.

3 Customer obligations

The Customer must make sure that its instructions are lawful; give the people concerned the notices POPIA requires; have a lawful basis for the processing; limit information to what is necessary; set up user access correctly; keep information accurate; respond to requests from the people concerned; and not upload special personal information or children’s information unless the law requires or permits it and Domi Vera has agreed to the use.

4 Confidentiality and staff

Domi Vera limits access to staff who need it, are bound by confidentiality and are instructed in privacy and security. Domi Vera will not use Customer Data for advertising or to train artificial-intelligence models.

5 Security safeguards

Domi Vera maintains the security measures required by sections 19 and 21 of POPIA: reasonable, risk-appropriate technical and organisational safeguards, including separation of each customer’s data at the database level, role-based access, a private database that is not reachable from the internet, encryption in transit and at rest, password hashing, expiring sign-in links, restricted and logged administrative access, document-sharing controls, daily backups and audit records.

Domi Vera identifies reasonably foreseeable internal and external risks, maintains safeguards against them, regularly checks that the safeguards work, and updates them when risks change. It will give the Customer the information it reasonably needs for its own section 19 assessment.

6 Subprocessors

The Customer authorises Domi Vera to use these subprocessors:

Subprocessor	Service	Location
Amazon Web Services	Hosting, database, file storage, backups and logs	Cape Town, South Africa
Amazon Simple Email Service	Sending emails, invoices and statements	Cape Town, South Africa
Amazon CloudFront	Website delivery	Global
ImprovMX	Forwarding email sent to Domi Vera addresses	Outside South Africa
Google (Gmail)	Domi Vera’s support mailbox	Outside South Africa

Each subprocessor is bound by written terms that require confidentiality and security. Domi Vera remains responsible to the Customer for the processing it entrusts to a subprocessor. Domi Vera will give at least 30 days’ notice by email before adding or replacing a subprocessor that processes Customer Data, and the Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Customer may end its account under the Terms of Service.

7 Transfers outside South Africa

The platform’s database, files and backups are stored in South Africa. Domi Vera will transfer Customer-controlled personal information outside South Africa only as section 72 of POPIA allows. Personal information that reaches Domi Vera by email, for example when the Customer sends a support request, is processed by ImprovMX and Google outside South Africa, under terms and laws that give protection substantially similar to POPIA.

8 Requests from the people concerned

If Domi Vera receives a request about information in the Customer’s account, it will promptly pass it to the Customer unless the law requires Domi Vera to respond directly. Domi Vera will give reasonable help with access, correction, deletion, restriction, objection and complaint handling, taking into account the nature of the processing.

9 Security compromises

Domi Vera will notify the Customer immediately, as section 21(2) of POPIA requires, once it has reasonable grounds to believe that Customer-controlled personal information has been accessed or acquired by an unauthorised person. It will not wait for a complete investigation before doing so. It will give the information reasonably available about what happened, the information and people affected, the likely consequences, and the containment and remedial steps, will keep the Customer updated as it learns more, and will preserve relevant evidence.

As operator, Domi Vera will not notify the people affected or the Information Regulator on the Customer’s behalf unless the Customer instructs it to or the law requires it. The Customer, as responsible party, is responsible for those notifications, with Domi Vera’s reasonable help.

10 Return, deletion and retention

While its account is active, the Customer can export and download its records using the functions in the platform. When the account ends, the Customer may ask for its records for 90 days. After that, Domi Vera deletes the Customer Data from the platform within 30 days, and it leaves the backups when they expire, 7 days later. Domi Vera may keep the minimum records it needs as evidence of the contract, of security events and of legal compliance, and anything the law requires it to keep.

11 Audit and compliance information

On reasonable request, Domi Vera will give the Customer the information needed to show that it complies with this DPA, including its current subprocessor list and a description of its safeguards, subject to confidentiality and security. Any other audit must be agreed in writing in advance, including its scope, timing and cost. No customer may see another customer’s information or security-sensitive material.

12 Requests from authorities

Domi Vera will disclose Customer Data to an authority only where the law requires or allows it. Where permitted, it will tell the Customer first and disclose only what is required.

13 Priority and liability

If this DPA conflicts with the Terms of Service about processing Customer-controlled personal information, this DPA prevails to the extent of the conflict. Liability under this DPA is governed by the liability provisions of the Terms of Service.

14 Acceptance

This DPA is accepted electronically together with the Terms of Service, by the Customer’s authorised representative. Domi Vera records the version accepted, the Customer, the person who accepted it, and how and when. Its contact details are in the Terms of Service.