POPIA operator agreement
Under South Africa's Protection of Personal Information Act, 2013 (POPIA), the company that uses EngageDesk is the responsible party for the personal information in its account, and Trev The Dev (Pty) Ltd, trading as TTD Consulting ("TTD"), is its operator. This agreement is the written contract POPIA (section 21) requires between them, and forms part of EngageDesk's terms.
1. What TTD processes, and why
- The personal information the company puts into EngageDesk or connects to it: business contacts, conversations, deals, notes, and from a person's own Outlook, if they connect it, who an email or meeting was with, its subject, when and a short summary.
- Only to provide EngageDesk to the company, as it chooses to use it, and on its instructions; never for TTD's own purposes, for marketing, or to train AI.
2. Confidentiality
TTD keeps it confidential, and lets only the people who run EngageDesk reach it, under a duty of confidentiality. TTD support sees inside an account only while its owner has let TTD support in.
3. Security (section 19)
- Each company's data kept apart from every other's, and tested in every release.
- Sign-in with Microsoft work accounts, multifactor authentication, roles, and private records.
- Encryption in transit and at rest; secrets in Azure Key Vault; no stored passwords or storage keys.
- An audit trail of who changed what and when; nightly backups kept 30 days, restored into a test copy every month.
- Personal details such as email addresses, phone, ID and bank numbers taken out before anything is sent to the AI.
4. Security compromises (section 22)
If TTD has reasonable grounds to believe personal information in the company's account has been accessed or acquired by an unauthorised person, TTD tells the company's owner without undue delay, with what it knows, so the company can notify the Information Regulator and the people affected: by email to the account's owners, within 72 hours of becoming aware of it. The company tells TTD of a suspected compromise at info@ttdconsulting.net.
5. Sub-processors and outside South Africa (section 72)
- TTD uses the sub-processors listed on the sub-processors page, each bound to protect the information at least as well as this agreement does. TTD tells owners of a new one at least 30 days before it's used.
- Records are stored in South Africa. The AI features, sign-in and the web app's own files use Microsoft services that may process a request outside South Africa, under Microsoft's data protection terms. The company agrees to this transfer.
6. People's rights
EngageDesk lets the company's owner export, correct and erase a person's details, history included. TTD helps with a request the company can't meet itself.
7. When the account ends
When the account is closed or a cancelled subscription ends, the company has 30 days to export everything; then TTD deletes it all. Backups keep a copy for up to 30 more days, then it's gone. TTD keeps only what the law requires (such as its own invoices).
8. Records and questions
TTD gives the company the information it reasonably needs to show it meets POPIA, and answers its questions about how the information is processed. TTD's information officer is Treveshan Naidoo, its director, at info@ttdconsulting.net.