POPIA Data Processing

Roles

For personal information in the Customer's own business records, the Customer will ordinarily be the responsible party and Epicore will act as an operator only to the extent Epicore processes that information for the Customer.

Epicore remains a separate responsible party for personal information it processes for its own account administration, licensing, billing, fraud prevention, legal compliance and similar purposes under the Epicore Privacy Policy.

Customer instructions

Epicore will process Customer personal information only with the Customer's knowledge or authorisation, for the documented support/service purpose, or where law requires otherwise.

Processing details

The agreed order or support request identifies the service, purpose, duration and approved processing location. This may include implementation, support, migration, diagnostics or separately agreed hosting.

Records may concern your staff, customers, suppliers and contacts and include contact, account, transaction, operational and support data. Provide only what is needed for the approved purpose.

Special personal information or children’s information requires specific lawful authorisation and an agreed scope before sharing.

Confidentiality

Epicore will ensure people authorised to process Customer personal information are bound by confidentiality obligations appropriate to their role.

Security measures

Access limited to authorised support/technical personnel with a genuine need.

Role-based or account-based access controls and strong authentication where available.

Reasonable protection of data in transit and stored support copies.

Security updates, malware protection and system-hardening measures appropriate to Epicore-controlled systems.

Audit or work records for material support activity.

Deletion or secure disposal of temporary Customer copies when no longer required.

Backups appropriate to Epicore-controlled support/hosted systems; Customer backups remain governed by the Backup Schedule.

Security compromise

If Epicore, acting as an operator, has reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, it must notify the customer immediately and provide reasonably available information to assist the response.

The customer remains responsible for applicable notifications as the responsible party. Epicore remains responsible for its own statutory duties and any expressly agreed assistance.

Sub-operators

Epicore may use sub-operators needed to provide the agreed service, such as hosting, email, support or infrastructure providers. Epicore will use appropriate written arrangements and remain responsible for its own selection and management of those providers to the extent required by law and contract.

Cross-border processing

Epicore will not intentionally transfer Customer personal information across borders except under a basis permitted by POPIA and the agreed service architecture. The Customer must be informed of material cross-border hosting where it is part of the service.

Assistance with data-subject requests

Where the Customer receives a lawful access, correction, deletion or objection request relating to information Epicore processes only as operator, Epicore will provide reasonable assistance available within the system and support scope.

Return and deletion

At the end of the processing service, Epicore will return or delete Customer personal information under its control when reasonably possible and lawful, except copies that must be retained by law or remain temporarily in protected backups under normal retention cycles.

Audit and evidence

On reasonable request, Epicore will provide information reasonably necessary to show compliance with this addendum. Any intrusive audit, penetration test or on-site inspection must be agreed in advance, protect other customers/security, and be proportionate to the risk.

Customer responsibilities

Ensure it has a lawful basis to collect and disclose the personal information to Epicore for the requested service.

Give Epicore only the information reasonably needed.

Maintain its own user permissions, security and backups.

Notify Epicore if a support request involves special personal information or children's information before providing it.

Perform its own POPIA responsible-party duties, including notices and security-compromise reporting.

Applying this addendum

Use this addendum with a documented service order or support agreement identifying the parties and processing scope. Contact Epicore to record any service-specific requirements before sharing a database or sensitive information.