Annex A: Operator terms (data processing terms)

DRAFT 0.4 for attorney review, 22 October 2026. Not published. Not in force.
Annex to the Ledgeforge Terms of Service. Required by POPIA s20 and s21.

1. Roles

1.1 For Customer Data (personal information the Customer, or its Users, put into the Services: for example its clients, suppliers, employees, staff, contacts and financial records), the Customer is the responsible party and Ledgeforge is its operator.

1.2 For Account Data (sign-in records, membership, billing and support records), Ledgeforge is the responsible party, as set out in the Privacy Notice. These Operator Terms do not apply to Account Data.

1.3 Words used here have the meaning given in POPIA.

[ATTORNEY: Brief Q1. Confirm the split.]

2. What Ledgeforge processes, and why

3. Ledgeforge's duties as operator

Ledgeforge will:

3.1 process Customer Data only on the Customer's documented instructions. The Customer's instructions are: these terms; the settings and actions of its Users in the Services (for example sending an invoice by email, running an analysis, exporting, cancelling or closing, which starts the automatic deletion in clause 8.2); and any other written instruction agreed between us. If Ledgeforge believes an instruction breaks the law, it will say so and need not follow it;

3.2 treat Customer Data as confidential and not disclose it except as these terms allow or the law requires (s21(1));

3.3 maintain the security measures in Schedule 2 (s19 and s21(1));

3.4 make sure everyone at Ledgeforge with access to Customer Data is bound by confidentiality. At present access to the production systems is limited to the director, Jeffrey Nash; every access to a Customer's data for support is logged;

3.5 notify the Customer immediately, and in any event within [24] hours of becoming aware, where there are reasonable grounds to believe Customer Data has been accessed or acquired by an unauthorised person (s21(2)), with the information in clause 6;

3.6 help the Customer, at no extra charge for reasonable requests, to answer data subjects who exercise their rights (access, correction, deletion, objection), mostly through the Services' own tools;

3.7 pass to the Customer, without answering it, any request from a data subject about Customer Data, unless the law requires otherwise;

3.8 not use Customer Data for its own purposes, sell it, or use it to train or build products for others. Counting usage for capacity and billing (for example rows imported, staff count) is part of providing the Services;

3.9 make available the information reasonably needed to show compliance with these terms, and allow an audit by the Customer or its auditor at most once a year on [30] days' notice, at the Customer's cost, in a way that protects other Customers' data. [ATTORNEY: confirm a written questionnaire is enough at first.]

4. Sub-processors

4.1 The Customer authorises Ledgeforge to use the sub-processors in Schedule 1.

4.2 Ledgeforge will impose on each sub-processor written obligations that protect Customer Data at least as well as these terms, and remains responsible to the Customer for them.

4.3 Ledgeforge will give owners at least [30] days' notice by email before adding or replacing a sub-processor that processes Customer Data. A Customer that reasonably objects may cancel the affected product without penalty before the change.

5. Transfers outside South Africa

All Customer Data is stored in South Africa (AWS Cape Town). Customer Data is not sent outside South Africa except: service emails the Customer's Users choose to send, if SES must be used from another region [CONFIRM REGION]; and as otherwise listed in Schedule 1. Any transfer will meet POPIA s72.

[ATTORNEY: Brief Q6. Note that an emailed invoice is sent to the recipient's own mail provider wherever it is; is that a transfer by the Customer rather than by us?]

6. Security compromises

6.1 A notice under clause 3.5 will include what we know at the time, and be updated as we learn more: what happened and when; which organisations, categories of data and approximate number of people are affected; likely consequences; what we have done and propose to do; whether the matter has been reported to the police or the Regulator by us; and a contact person.

6.2 The Customer, as responsible party, decides whether and how to notify the Information Regulator and affected people under POPIA s22. Ledgeforge will help, including by providing draft wording.

6.3 Ledgeforge will not notify the Customer's data subjects directly about Customer Data unless the Customer asks, the Customer cannot be reached in time and the law requires it, or the Regulator directs it.

7. Customer duties

The Customer warrants that it has a lawful basis for the Customer Data it puts into the Services, that it has given the notices POPIA requires to its data subjects, and that its instructions are lawful.

8. Return and deletion at the end

8.1 Export. The owner can export Customer Data at any time while subscribed and for 90 days after a product's last day of access (Annex C).

8.2 IMPORTANT: automatic deletion is the Customer's standing instruction. By accepting these terms, the Customer instructs Ledgeforge to delete all Customer Data held in a product automatically 90 days after that product's last day of access, as set out in Annex C, including accounting records. Ledgeforge deletes it without asking again. The Customer may cancel the instruction only by subscribing to the product again before deletion day.

8.3 The Customer keeps its own records. Ledgeforge does not keep Customer Data for the Customer after deletion day. The Customer is solely responsible for downloading, within the 90 days, any records it must keep by law. Ledgeforge keeps only its own records about the Customer (its invoices, payments received, the audit log and its notice records of emails sent), which are Account Data and not Customer Data. [ATTORNEY: confirm the record-keeping duty rests with the Customer as responsible party, so deletion on its standing instruction is lawful.]

8.3A Contact details. Warnings before deletion go to the owners' email addresses in the Services. The Customer must keep them current; Ledgeforge is not responsible for warnings that do not reach the Customer because an address was not kept up to date.

8.4 Backups. Deletion is not applied inside existing backups. Backups are kept for 35 days and then expire, so deleted Customer Data leaves the backups at most 35 days after deletion. [ATTORNEY: Q10 / O-27, confirm the 35-day backup period.] If a backup is restored, every erasure since it was taken is re-applied first.

8.5 Earlier deletion. The owner may instruct deletion before day 90 in writing to the Information Officer (Annex C clause 7).

9. Liability

The limits in the Terms of Service apply to these Operator Terms, [ATTORNEY: except for any separate cap for data protection breaches].

Schedule 1: Sub-processors

Schedule 2: Security measures

As described in the Ledgeforge Security Statement, and at least: TLS for all connections; encryption at rest for databases, files and backups; separation of each Customer's data in the application and, in Accounting and Loadwyse, at database level (row-level security), with automated tests that try to cross Customers; two-factor sign-in for staff Users; one session per person; refusal of known leaked passwords; rate limits and bot checks at sign-in; secrets held in a secret store and never in code; production access limited to named people and logged; audit logs kept 7 years; nightly encrypted backups, kept 35 days, with restore tested before launch and then [quarterly]; a written breach procedure.