Vigia data processing agreement (operator agreement)
AI draft for legal review. This is a first draft prepared with AI assistance for 365solutions. It is not legal advice. It must not be published, accepted online or signed until a qualified South African attorney has reviewed it in full. Points the lawyer must confirm are marked [Lawyer: …] in the text and listed in section 20. Facts about 365solutions in square brackets are placeholders.
Version 0.1 (draft) · 9 November 2026 · forms part of the Vigia subscription agreement
1. Purpose and parties
1.1 This agreement sets out how 365 Solutions (Pty) Ltd, registration number 2013/022266/07 ("365solutions", "we", "us"), processes personal information for the security company that subscribes to Vigia (the "Customer", "you").
1.2 It is the written contract that section 21 of the Protection of Personal Information Act 4 of 2013 ("POPIA") requires between a responsible party and an operator. It is written so that it also meets the processor-contract requirements of other African data protection laws and of GDPR-style laws (see Annex 4).
1.3 It forms part of the subscription agreement. Words defined there have the same meaning here. If this agreement and the subscription agreement conflict on personal information, this agreement wins.
2. Definitions
| Term | Meaning |
|---|---|
| Applicable Data Protection Law | POPIA, and any other data protection law that applies to the processing of Customer Personal Information (for example the law of your Tenant's home country, Annex 4). |
| Customer Personal Information | Personal information in Customer Data that we process for you under the subscription agreement. |
| Data Subject | The person the personal information is about (your staff, your Clients' people, household members, witnesses, suspects, visitors). Under POPIA a data subject can also be a juristic person. |
| Operator | A person who processes personal information for a responsible party under a contract, without coming under its direct authority (POPIA section 1). Equivalent to "processor" in other laws. |
| Responsible Party | The party that decides the purpose and means of processing (POPIA section 1). Equivalent to "controller". |
| Security Compromise | Reasonable grounds to believe that Customer Personal Information has been accessed or acquired by an unauthorised person (POPIA section 22), and any other breach of security leading to its accidental or unlawful destruction, loss, alteration or disclosure. |
| Special Personal Information | The categories in POPIA section 26, including biometric information, health, and information about criminal behaviour (alleged offences and proceedings). |
| Sub-processor | A third party we engage to process Customer Personal Information. |
3. Roles
3.1 You are the responsible party for Customer Personal Information. You decide why it is processed (to run your security business) and, through your configuration of Vigia, how.
3.2 We are your operator. We process Customer Personal Information only to provide the Service.
3.3 Where we are a responsible party ourselves. We act as a responsible party, under our Privacy Statement, for: your administrators' and billing contacts' details used to manage your account and invoice you; our website and marketing; and the security records of our own staff's access. We may also count Active Guards and other billing units from Customer Data to bill you; we use only the counts for that purpose. [Lawyer: confirm this dual-role analysis, particularly for metering and for platform security logs.]
3.4 Your Clients. Where your Client (for example an estate or a business) is itself a responsible party for some information (such as its own visitor list), you are responsible for having the right contract with that Client. We act on your instructions only.
4. Your instructions
4.1 We process Customer Personal Information only on your documented instructions, which are:
(a) the subscription agreement and this agreement;
(b) your configuration and use of the Service by your Authorised Users (for example enabling an Add-on, setting a retention rule, placing a legal hold, approving a support session); and
(c) other written instructions you give us that are consistent with the agreement.
4.2 We will tell you if we believe an instruction breaks Applicable Data Protection Law, and we may decline to follow it until you confirm or change it.
4.3 We may process Customer Personal Information without your instruction only where the law requires us to. In that case, we will tell you before processing unless the law prohibits it.
4.4 Annex 1 describes the processing.
5. Your obligations
You warrant and undertake that:
(a) you have a lawful basis under Applicable Data Protection Law for every processing you instruct (for example: performance of an employment or client contract, a legal obligation, legitimate interests, or consent);
(b) you give Data Subjects the notices the law requires (a template for staff using the field app is document 10);
(c) you obtain and record any consent the law requires, in particular for face matching at clock-in (clause 10.2);
(d) where the law requires it, you obtain any prior authorisation from the Information Regulator (POPIA section 57) or the equivalent registration or licence from your country's authority before processing — for example where you process information on criminal behaviour or unlawful conduct on behalf of your Clients (section 57(1)(b)), or transfer special personal information or children's information to a third party in another country without adequate protection (section 57(1)(d)) [Lawyer: confirm whether security companies reporting incidents to their clients trigger section 57(1)(b), and advise customers accordingly];
(e) you register your Information Officer with the Information Regulator, or the equivalent in your country;
(f) your instructions comply with the law.
6. Confidentiality of our people
6.1 We make sure that everyone who can access Customer Personal Information (our staff and Sub-processors) is bound by a duty of confidentiality and has been trained on it.
6.2 Our staff can see inside your Tenant only through an approved support session (subscription agreement clause 19) or where clause 19.2 of that agreement allows. Every such access is recorded in your audit trail.
7. Security measures
7.1 We establish and maintain appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of Customer Personal Information (POPIA section 19), taking into account generally accepted information security practices. The measures are described in Annex 2 and in our public security statement.
7.2 We review the measures regularly and may update them, but we will not reduce the overall level of protection during your Subscription.
8. Security compromises
8.1 We will notify you immediately, and in any event within [24] hours of becoming aware, of a Security Compromise affecting Customer Personal Information. [Lawyer: confirm the hour limit. POPIA section 21(2) requires the operator to notify "immediately"; GDPR-style laws use "without undue delay". Some customers will ask for 24 or 48 hours.]
8.2 The notice will contain, as far as then known: what happened; when; the categories and approximate number of Data Subjects and records; the likely consequences; the steps we have taken and propose; and a contact person. We will update you as we learn more.
8.3 We will take reasonable steps to contain the compromise, preserve evidence and prevent recurrence, and will help you meet your own duty to notify the Information Regulator and Data Subjects (POPIA section 22) or your country's authority.
8.4 You decide whether and how to notify Data Subjects and regulators about Customer Personal Information. We will not notify them on your behalf unless you ask or the law requires it.
8.5 A notification by us is not an admission of fault.
9. Sub-processors
9.1 You authorise us to use the Sub-processors in Annex 3. We publish the current list at [vigia.africa/legal/sub-processors — URL to confirm].
9.2 We will give at least [30] days' notice (by email to your administrator and on the published list) before adding or replacing a Sub-processor that processes Customer Personal Information. You may object on reasonable data-protection grounds within that period. We will then discuss a solution in good faith; if none is found, you may end the affected part of your Subscription without penalty before the change takes effect.
9.3 We impose on each Sub-processor, by written contract, data protection obligations no less protective than this agreement, and we remain responsible to you for their performance.
9.4 Services you contract directly (for example your own WhatsApp business number with Meta, your mobile device management, payment gateways, fiscal devices, alarm receivers, telematics, accounting or payroll systems) are not our Sub-processors. They are your operators or independent parties under your own contracts. Vigia exchanges data with them only as you configure it.
10. Special categories and sensitive data
10.1 General. Vigia may hold Special Personal Information, information about children and location information. You decide whether and why such information is collected. We apply the extra safeguards in this clause and Annex 2.
10.2 Biometric information (face matching). Face matching at clock-in is an Add-on (Guard assurance, feature face-match) and is off unless you switch it on. If you switch it on:
(a) you must have a lawful basis — normally the Data Subject's consent (POPIA section 27(1)(a)) — and you should carry out and document a privacy impact assessment first;
(b) every guard must be offered a non-biometric alternative (supervisor confirmation) and must not suffer any detriment for refusing [Lawyer: confirm whether employee consent can be "voluntary" in this context, and whether another section 27 ground is available];
(c) Vigia records each consent and withdrawal with the notice version; a face template is created only from a recorded consent, is stored apart from photos and protected with its own key, is used only to confirm clock-in, is never shown to Clients, and is deleted as soon as consent is withdrawn or the person's employment ends;
(d) selfies taken at clock-in (with or without face matching) are kept for 90 days by default, then deleted.
10.3 Information about criminal behaviour. Incident reports may contain information about alleged offences, suspects and witnesses. Vigia supports this with confidential incidents (visible only to named roles), evidence held in a separate, immutable evidence store, logged and time-limited disclosure links approved by a manager, and legal hold. You are responsible for your lawful basis (POPIA sections 27 and 33) and any prior authorisation (clause 5(d)).
10.4 Children. Vigia is not designed for use by children, but incident reports, household members and visitor records may contain information about children. You must process it only as POPIA sections 34–35 (or your country's law) allow, for example where necessary to establish, exercise or defend a right or obligation in law, or with the consent of a competent person.
10.5 Location information.
(a) The field app collects location only while the guard is on duty (from clock-in to clock-out) and during a live panic. It does not collect location after clock-out.
(b) Viewing a person's location history outside a live event requires a stated purpose, which is logged and can be reviewed.
(c) Location samples are kept for 12 months by default (vehicle tracker positions 90 days) unless linked to an incident, a cash-in-transit run or a legal hold.
(d) You are responsible for telling your staff about location collection and for using it only for the purposes in your notice.
10.6 Sensitive fields. Duress words, alarm passwords, cash-in-transit values and routes, and identity numbers are encrypted separately in the application and can be revealed only by authorised roles through an audited reveal, with a stated purpose.
10.7 Voice and video. Where you use push-to-talk audio or CCTV or alarm clips (later releases), you are responsible for compliance with laws on interception and monitoring (in South Africa, the Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002) and for any notices or signage. [Lawyer: confirm the RICA position for recorded push-to-talk between employer and employees.]
11. Data Subject requests
11.1 Vigia includes tools to help you answer requests to access, correct, delete, object to or restrict processing of personal information (feature data-requests, in every Plan).
11.2 If we receive a request directly from a Data Subject about Customer Personal Information, we will pass it to you within [5] business days and will not answer it ourselves except to say that it has been passed to you.
11.3 Taking into account the nature of the processing, we will give you reasonable help to respond to requests within the time the law sets (under POPIA and PAIA, generally 30 days).
12. Other assistance
We will give you reasonable help, at your cost where the effort goes beyond what the Service provides, with:
(a) privacy impact assessments and prior authorisation applications about the Service;
(b) enquiries or investigations by the Information Regulator or another authority about the processing;
(c) records of processing that Applicable Data Protection Law requires.
13. Retention, return and deletion
13.1 During the Subscription. Vigia applies retention periods per type of record. Defaults are in Annex 1, part D. Where your country pack sets a different period (for example for financial records under tax law), the country pack applies. You may change retention rules within the limits the Service allows. The nightly purge deletes or anonymises expired records and media, except those under a legal hold, and records a purge report in your audit trail.
13.2 Export. You may export your Customer Data at any time, free of charge, in commonly used machine-readable formats.
13.3 At the end. When your Tenant closes, we offer you a full export and keep your data available for export for 90 days. After that we delete Customer Personal Information from the live systems, including by destroying your Tenant's encryption keys for sensitive fields, and record a purge report.
13.4 Backups. Database backups for point-in-time restore expire within 35 days. Long-term backups (weekly and monthly) expire on the schedule in [Annex 1 — long-term backup schedule to confirm]; until then they are kept encrypted, isolated, and are not restored except to recover the Service. Destroying your keys makes the sensitive fields in those backups unreadable. [Lawyer: confirm this meets the "destroy or delete" duty (POPIA section 14) for data in long-term backups, or whether long-term backups must be shortened or tenant-filtered.]
13.5 We may keep Customer Personal Information after closure only where a law requires us to keep it, or under a legal hold or court order, and only for that purpose.
14. Audits and information
14.1 We will make available the information you reasonably need to show compliance with this agreement, including our security statement, a summary of our most recent independent penetration test, and answers to a reasonable security questionnaire once a year.
14.2 If that information is not enough, or a regulator requires it, you (or an independent auditor bound by confidentiality, not a competitor of ours) may audit our compliance with this agreement, on at least [30] days' written notice, during business hours, no more than once in any 12 months (unless after a Security Compromise or at a regulator's request), at your cost, and in a way that does not compromise other customers' data or our security.
14.3 You can verify the integrity of your audit trail yourself: Vigia keeps a tamper-evident hash chain per Tenant, with daily anchors, which you can export and recompute without us.
15. Where data is held and cross-border transfers
15.1 Hosting. Vigia is hosted on Microsoft Azure. Our primary region for customer data is South Africa North (Johannesburg), with recovery in South Africa West (Cape Town) [confirm: planned — region legal review pending]. A customer may be offered a dedicated deployment in another region by agreement.
15.2 Transfers out of South Africa. Some Sub-processors (Annex 3) process limited data outside South Africa (for example email delivery, push notifications and maps). We transfer Customer Personal Information outside South Africa only where POPIA section 72 allows, normally because the recipient is bound by a binding agreement or binding corporate rules that give an adequate level of protection (section 72(1)(a)), and we keep a record of each transfer route.
15.3 Transfers from your country to South Africa. If your Tenant's home country is not South Africa, your data is transferred to South Africa for hosting. You are responsible for meeting your country's transfer conditions (for example adequacy, authorisation, registration or a contract), and we will sign any reasonable additional clauses your law requires. Annex 4 lists what we know of each country's rules; it is not legal advice.
15.4 GDPR-style transfers. If the GDPR or a similar law applies to a transfer, the parties agree to the standard contractual clauses (or equivalent) that law approves, which then form part of this agreement. [Lawyer: confirm whether to attach the EU SCCs (module 2/3) by reference.]
15.5 Special personal information abroad. We will not transfer special personal information or children's information outside South Africa to a country without adequate protection unless the law allows it and any required prior authorisation (POPIA section 57(1)(d)) has been obtained.
16. Requests from authorities
16.1 If a police officer, court, regulator or other authority asks us for Customer Personal Information, we will refer them to you, unless the law requires us to answer. If we must answer, we will tell you first (unless the law prohibits it), disclose only what is legally required, and challenge requests we believe are unlawful.
17. Liability
17.1 Each party's liability under this agreement is subject to the limits in the subscription agreement, including the data-protection cap in its clause 16.4.
18. Term
18.1 This agreement lasts as long as we process Customer Personal Information for you, including during the export period after closure.
19. Changes
19.1 We may update this agreement as the subscription agreement's clause 21 allows. We will not change it in a way that reduces the protection of Customer Personal Information without your agreement, unless the law requires it.
Annex 1 — Description of the processing
A. Subject matter, nature and purpose
Providing the Vigia security-operations platform to the Customer: hosting, storing, organising, displaying, transmitting, analysing, exporting and deleting Customer Personal Information to run guarding, patrols, the command centre and response, incidents, the client service view, workforce and rostering, and (with Add-ons) fleet, armoury, cash in transit, billing, communications and related features; plus support, security, backup and recovery.
B. Categories of Data Subjects
- Customer staff: guards, supervisors, response officers, controllers, cash-in-transit crew, drivers, technicians, office staff, applicants (with Workforce & payroll).
- Customer's Clients and their people: contacts, keyholders, portal and app users, estate residents and household members, consumer-app members.
- Third parties in records: witnesses, suspects, visitors, members of the public in incidents and evidence.
C. Categories of personal information
| Category | Examples | Notes |
|---|---|---|
| Identity and contact | Name, staff number, phone, email, photo, next of kin, language | |
| Identity numbers | National ID or passport number | Encrypted field, audited reveal |
| Licensing and vetting | Security registration (for example PSIRA) number, grade, expiry; firearm competency (Armoury) | |
| Work records | Shifts, clock-in and out, breaks, patrol scans, presence checks, occurrence book, inspections, leave, pay inputs (Workforce & payroll) | |
| Location | On-duty location samples, geofence events, panic live location, vehicle positions (Fleet) | On duty and live panic only |
| Images | Clock-in selfies; incident photos and video; site and checkpoint photos | Selfies 90 days |
| Biometric | Face templates | Only with face-match and consent |
| Incidents | Descriptions, witness and suspect details, voice notes, evidence | May include criminal-behaviour information |
| Safety events | Panic, duress, man down, welfare-check responses | |
| Client data | Site details, contacts, keyholders, alarm passwords (encrypted), contracts, invoices, payments (Billing) | |
| Devices and access | Device identifiers, app version, sign-in records, audit trail | |
| Communications | Notifications, messages, WhatsApp and SMS content (Communications), push-to-talk audio (later) |
D. Default retention periods
Defaults are business rules in Vigia. A country pack can set a different value where the law of that country requires.
| Record | Default |
|---|---|
| Location samples | 12 months; vehicle tracker positions 90 days; longer if linked to an incident, CIT run or legal hold |
| Clock-in selfies | 90 days |
| Incident evidence | 7 years |
| Shift, patrol and time records | 6 years after the end of the financial year |
| Occurrence books and inspections | 3 years, unless linked to an incident |
| Command-centre events, handover and open/close records | 3 years; push-to-talk audio and CCTV clips 30 days |
| Cash-in-transit custody records and media | 6 years |
| Financial records | The period the country pack sets from tax law |
| Staff records after exit | 6 years, then anonymised; applicants 6 months after the decision |
| Client contacts after the contract ends | 12 months, then anonymised; leads 24 months after last activity |
| Rendered message text | 90 days; non-incident message threads 12 months |
| User accounts and devices after deactivation | 12 months, then anonymised |
| Sign-in audit | 2 years |
| Audit trail, role assignments, settings history | 7 years |
[Lawyer: confirm each default against POPIA section 14, the Basic Conditions of Employment Act, tax law, the PSIRA Code of Conduct and the Firearms Control Act, and say which periods should differ in the South Africa country pack.]
E. Duration
For the term of the Subscription and the 90-day export period, then deletion under clause 13.
Annex 2 — Security measures
Summary; the detail is in our technical design and is available to customers under confidentiality.
| Area | Measures |
|---|---|
| Isolation of each customer | Every record carries its Tenant; enforced in the application, by database row-level security, and by separate storage paths; a separate data key per Tenant for sensitive fields; cross-tenant isolation tested automatically |
| Encryption in transit | TLS 1.2 or later everywhere, HTTPS only, HSTS |
| Encryption at rest | Database transparent data encryption; storage service encryption; sensitive fields (ID numbers, duress words, alarm passwords, CIT values and routes) additionally encrypted with AES-256-GCM under keys held in Azure Key Vault; encrypted database on the field app's phone |
| Access control | Role-based permissions with data scopes (sites, clients); multi-factor authentication for office, command-centre and client-administrator users; device binding and PIN for field users; lost devices locked, wiped and signed out |
| Our staff | No standing access to Tenant data; approved, time-limited, scoped and logged support sessions; least privilege; confidentiality undertakings |
| Audit | Append-only audit trail with a per-Tenant hash chain and daily immutable anchors; reveals and location-history views require a purpose and are logged |
| Evidence | Incident and CIT evidence in a separate storage account with immutability and legal hold; access by short-lived signed links (5 minutes) after a permission check |
| Uploads | File type and size checks, malware scanning before anyone else can open a file |
| Secrets | In Azure Key Vault through managed identities; never in source code or pipelines |
| Logging | Structured logs without passwords, tokens, PINs, one-time codes, duress words, CIT values or precise locations |
| Resilience | Point-in-time restore (35 days), geo-redundant backups, quarterly restore tests; recovery targets in the Service Level Statement |
| Testing | Security baseline OWASP ASVS level 2 (web and API) and MASVS L1 (mobile); dependency and secret scanning, static analysis and automated scans in every build; independent penetration test before production and annually |
| Rate limits | On sign-in, one-time codes, panic, incident submission, sync and reveals, also per Tenant |
Annex 3 — Sub-processors
The list below is a draft. Locations marked [confirm] must be checked against each provider's current contract and data processing terms before publication.
| Sub-processor | Service | Data | Location | Transfer basis |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd / Microsoft Corporation (Azure) [confirm contracting entity] | Hosting, database, storage, key management, malware scanning, monitoring; later speech-to-text | All Customer Data | South Africa North and South Africa West [confirm: planned]; support access possibly global | Microsoft Products and Services Data Protection Addendum [confirm] |
| Twilio Inc. (SendGrid) | Email delivery | Recipient email, name, message content | United States [confirm] | Twilio data protection addendum [confirm] |
| Google LLC (Firebase Cloud Messaging) | Push notifications | Device token, notification content (kept minimal) | Global [confirm] | Google data processing terms [confirm] |
| Google LLC (Google Maps Platform) | Address search, geocoding, drive-time estimates | Addresses and coordinates of sites and response units | Global [confirm] | Google Maps Platform data processing terms [confirm] |
| [SMS aggregator — to be selected per country] | SMS (sign-in codes, safety fallback, notifications) | Phone number, message content | [country] | [contract] |
| Functional Software Inc. (Sentry) [confirm use in production] | App crash reporting | Device and app diagnostics, personal information scrubbed before sending | [confirm] | [confirm] |
| 650 Industries Inc. (Expo) [confirm whether any personal information is processed] | Mobile app builds and updates | None expected | [confirm] | — |
| [Later releases] Anthropic PBC | AI summaries of incidents (Insights & AI, opt-in) | Incident text submitted for a summary | [confirm] | [confirm] |
| [Later releases] LiveKit Inc. [or self-hosted] | Voice calls and push-to-talk | Audio, user identifiers | [confirm] | [confirm] |
| [Customer support tool — to name] | Support tickets | Contact details, ticket content | [confirm] | [confirm] |
Not Sub-processors (contracted by the Customer, clause 9.4): Meta (WhatsApp business number), Microsoft Intune (device management), payment gateways, fiscal devices, alarm receivers, telematics, accounting and payroll systems.
Annex 4 — Country annex
Vigia launches in South Africa and is planned for the other SADC countries and the rest of Africa. This table records, for each country, the law we understand applies, its authority, and points to check. It is research, not legal advice; every row must be confirmed by local counsel before a country pack goes live. For each country, the processor terms in clauses 4–15 are intended to meet that law's processor-contract requirements; additional clauses are added here when counsel identifies them.
| Country | Law (to confirm) | Authority (to confirm) | Points to check |
|---|---|---|---|
| South Africa | POPIA 4 of 2013; PAIA 2 of 2000 | Information Regulator | Section 57 prior authorisation for criminal-behaviour information processed for third parties; section 72 for onward transfers |
| Zimbabwe | Cyber and Data Protection Act [Chapter 12:07] | POTRAZ (Data Protection Authority) | Data controller licence; transfer to South Africa (adequacy or authorisation); biometric data |
| Botswana | Data Protection Act 18 of 2024 | Information and Data Protection Commission | Reported requirement that a copy of transferred data remain in Botswana [unverified] |
| Namibia | [confirm whether a data protection act is in force] | [confirm] | |
| Zambia | Data Protection Act 3 of 2021 | Office of the Data Protection Commissioner | Registration; localisation of sensitive data |
| Lesotho | Data Protection Act 2011 | [confirm] | |
| Eswatini | Data Protection Act 2022 | Eswatini Communications Commission [confirm] | |
| Malawi | Data Protection Act 2024 | [confirm] | |
| Mozambique | [confirm] | [confirm] | |
| Tanzania | Personal Data Protection Act 2022 | Personal Data Protection Commission | Registration; transfer safeguards |
| Mauritius | Data Protection Act 2017 | Data Protection Office | GDPR-aligned |
| Angola | Law 22/11 on Personal Data Protection | Agência de Proteção de Dados | Authorisation for transfers |
| Democratic Republic of Congo | [confirm] | [confirm] | |
| Madagascar | Law 2014-038 | [confirm] | |
| Seychelles | Data Protection Act 2023 [confirm] | [confirm] | |
| Comoros | [confirm] | [confirm] | |
| Kenya, Nigeria and others (rest of Africa) | Kenya Data Protection Act 2019; Nigeria Data Protection Act 2023 [confirm] | ODPC (Kenya); NDPC (Nigeria) | Registration, localisation, transfer rules |
20. Points for legal review
- The dual-role analysis in clause 3.3 (metering and platform security logs).
- The breach-notice time limit in clause 8.1.
- Whether security companies reporting incidents to clients need prior authorisation under POPIA section 57(1)(b), and what Vigia should say to customers about it.
- The biometric consent approach for employees (clause 10.2): whether consent can be voluntary, and whether another ground in section 27 applies.
- RICA position on recorded push-to-talk audio (clause 10.7).
- Default retention periods (Annex 1 D) against South African law, and the long-term backup position (clause 13.4).
- Cross-border basis for each Sub-processor, and whether to attach the EU standard contractual clauses by reference (clauses 15.2–15.4).
- Each Sub-processor's contracting entity, location and data processing terms (Annex 3).
- Every row in the country annex (Annex 4), before each country pack goes live.
- Audit rights scope and frequency (clause 14).