Data Processing Agreement

1. Parties & Definitions

“Responsible Party” means the Customer, who determines the purpose and means of processing personal information.

“Operator” means MapLogiQ (Pty) Ltd, who processes personal information on behalf of and under the authorisation of the Responsible Party.

“Personal Information” has the meaning given in POPIA: information relating to an identifiable, living, natural person or existing juristic person.

“Processing” means any operation performed on personal information, including collection, storage, retrieval, use, transmission, or deletion.

2. Role of the Parties

The Customer is the Responsible Party in respect of personal information it uploads to or processes via the MapLogiQ platform. MapLogiQ acts as an Operator, processing such personal information solely on the documented instructions of the Customer.

Each party shall comply with all applicable data protection laws in respect of personal information processed under this DPA.

3. Processing Instructions

MapLogiQ shall process personal information only on the documented instructions of the Customer, including those set out in the main service agreement, unless required to do otherwise by law. MapLogiQ shall immediately inform the Customer if any instruction infringes applicable data protection law.

4. Our Obligations as Operator

MapLogiQ commits to:

• Process personal information only for the purposes specified in this DPA
• Ensure that persons authorised to process personal information are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures (see Section 7)
• Assist the Customer in responding to data subject requests under POPIA
• Assist the Customer in meeting its obligations regarding security, breach notification, and data protection impact assessments
• Delete or return personal information upon termination (see Section 9)
• Provide all information necessary to demonstrate compliance with this DPA

5. Sub-Processors

The Customer provides general authorisation for MapLogiQ to engage sub-processors to assist in providing the Service. Current sub-processors include cloud infrastructure, email delivery, and monitoring services. A current list of sub-processors is available on request.

MapLogiQ shall impose data protection obligations on sub-processors that are equivalent to those in this DPA and shall remain liable for the acts and omissions of sub-processors.

6. Cross-Border Data Transfers

MapLogiQ primarily processes data within South Africa. Where data is transferred to a third country, MapLogiQ shall ensure adequate safeguards are in place in accordance with Section 72 of POPIA, including binding corporate rules, standard contractual clauses, or equivalent measures.

7. Security Measures

MapLogiQ implements and maintains the following technical and organisational security measures:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access controls and least-privilege principles
• Multi-factor authentication for administrative access
• Regular penetration testing and vulnerability assessments
• Automated backups with point-in-time recovery
• 24/7 infrastructure monitoring and alerting

8. Personal Information Breach

In the event of a confirmed personal information breach affecting Customer data, MapLogiQ shall notify the Customer without undue delay and in any event within 72 hours of becoming aware of the breach. The notification shall include the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed.

MapLogiQ shall assist the Customer in meeting any breach notification obligations to the Information Regulator or affected data subjects.

9. Deletion & Return of Data

Upon termination of the service agreement, MapLogiQ shall, at the Customer’s election and within 30 days: (a) return all personal information to the Customer in a portable format, or (b) securely delete all personal information. MapLogiQ shall provide written confirmation of deletion upon request.

Backup copies will be purged within 90 days of termination in accordance with our backup rotation schedule.

10. Audit Rights

MapLogiQ shall provide the Customer with all information reasonably necessary to demonstrate compliance with this DPA. The Customer may conduct audits or inspections with reasonable prior notice (minimum 30 days) and at the Customer’s own cost, subject to reasonable confidentiality obligations.