# Data Processing Agreement **Template - Third Party Operators and Service Providers** **Free Me South Africa (Pty) Ltd** Registration Number: 2025/384802/07 Version 1.0 | Effective Date: 24 August 2026 *This Agreement is made in terms of POPIA Section 21, which requires a responsible party to conclude a written agreement with any operator engaged to process personal information on its behalf.* --- ## Parties **Responsible Party (FMSA):** Free Me South Africa (Pty) Ltd Registration No: 2025/384802/07 Information Officer: Pierre van Staden exclusions@freemesouthafrica.co.za (hereinafter "FMSA" or the "Responsible Party") **Operator:** [Name of third-party organisation] [Registration number] [Contact person] [Email] [Phone] (hereinafter the "Operator") --- ## 1. Definitions In this Agreement: - "POPIA" means the Protection of Personal Information Act 4 of 2013 - "Personal Information" has the meaning assigned to it in POPIA Section 1 - "Processing" has the meaning assigned to it in POPIA Section 1 - "Data Subject" means any natural person to whom personal information relates - "Special Personal Information" means the categories described in POPIA Section 26 - "Breach" means accidental or unlawful access to, or destruction, loss, alteration, or unauthorised disclosure of, personal information --- ## 2. Subject Matter and Duration 2.1 FMSA engages the Operator to process certain personal information on its behalf, as further described in Schedule 1 to this Agreement. 2.2 This Agreement takes effect on the date of signature and continues for the duration of the commercial relationship between the parties, unless terminated in accordance with clause 9. --- ## 3. Operator Obligations The Operator agrees to: 3.1 **Lawfulness:** Process personal information only in accordance with FMSA's lawful instructions and for the purposes set out in Schedule 1. The Operator must immediately inform FMSA if it believes an instruction infringes POPIA or any other applicable law. 3.2 **Confidentiality:** Ensure that persons authorised to process personal information have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. 3.3 **Security:** Implement and maintain appropriate technical and organisational security measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. At minimum, these measures must include: - Encryption of personal information in transit (TLS 1.2 or higher) - Encryption of personal information at rest - Access controls and authentication for systems processing personal information - Regular security assessments 3.4 **Sub-operators:** Not engage another sub-operator without FMSA's prior written consent. Where a sub-operator is engaged, the Operator must impose obligations equivalent to those in this Agreement on the sub-operator. 3.5 **Data Subject Rights:** Assist FMSA in fulfilling its obligations to respond to data subject requests under POPIA Sections 23-25, insofar as the personal information is within the Operator's control. 3.6 **Deletion:** At FMSA's choice, delete or return all personal information after completion of the processing services, and delete existing copies unless retention is required by law. 3.7 **Audit:** Make available to FMSA all information necessary to demonstrate compliance with this Agreement, and allow for and contribute to audits conducted by FMSA or an auditor mandated by FMSA. 3.8 **Breach Notification:** Immediately (and in any event within 24 hours of becoming aware) notify FMSA of any breach involving personal information processed under this Agreement, providing: - A description of the breach - The categories and approximate number of data subjects affected - The categories and approximate volume of records affected - Likely consequences of the breach - Measures taken or proposed to address the breach --- ## 4. FMSA Obligations FMSA agrees to: 4.1 Provide the Operator with personal information that is adequate, relevant, and not excessive for the purposes set out in Schedule 1. 4.2 Ensure that data subjects have been notified of the processing by the Operator in accordance with POPIA Section 18. 4.3 Respond to the Operator's requests for guidance on FMSA's instructions and requirements within a reasonable time. --- ## 5. International Transfers Where the Operator processes personal information outside the Republic of South Africa, it must ensure that: 5.1 The recipient country has adequate data protection laws substantially similar to POPIA, OR 5.2 The transfer is subject to binding contractual safeguards equivalent to those required by POPIA Section 72, OR 5.3 The data subject has consented to the international transfer. --- ## 6. Special Personal Information Where the Operator processes special personal information (as defined in POPIA Section 26), including biometric information: 6.1 Processing must be strictly limited to the purposes set out in Schedule 1. 6.2 Enhanced security measures must apply, including encryption of all special personal information fields. 6.3 Retention must be minimised - special personal information must be deleted immediately once the processing purpose is fulfilled. --- ## 7. Liability 7.1 Each party is liable for breaches of this Agreement attributable to its own conduct. 7.2 Where both parties contributed to a breach, liability shall be apportioned according to their respective degrees of fault. 7.3 Neither party limits its liability for: - Death or personal injury caused by its negligence - Fraud or fraudulent misrepresentation - Any liability that cannot be excluded or limited by law --- ## 8. Governing Law This Agreement is governed by the laws of the Republic of South Africa. Disputes shall be referred to POPIA mediation procedures before any court proceedings. --- ## 9. Termination 9.1 Either party may terminate this Agreement on 30 days' written notice. 9.2 FMSA may terminate immediately if the Operator breaches any provision of this Agreement and fails to remedy the breach within 5 business days of notice. 9.3 Termination does not affect the Operator's obligations regarding data already in its possession, which must be returned or destroyed as directed by FMSA. --- ## Schedule 1 - Processing Details *To be completed for each specific Operator engagement:* | Item | Details | |---|---| | Purpose of processing | [e.g., DHA identity verification / SMS OTP delivery / Email delivery] | | Categories of personal information | [e.g., ID number, facial image, mobile number, email address] | | Categories of data subjects | [e.g., SE applicants] | | Duration of processing | [e.g., real-time verification only] | | Sub-operators | [e.g., None / List of authorised sub-operators] | | Countries of processing | [e.g., South Africa / List additional countries] | | Security measures | [Specific measures applicable to this processing] | | Retention period | [e.g., Not retained / X days / Until deleted by FMSA instruction] | --- ## Signatures **For Free Me South Africa (Pty) Ltd (Responsible Party):** Name: ___________________________ Title: ___________________________ Date: ___________________________ Signature: ___________________________ **For [Operator Name] (Operator):** Name: ___________________________ Title: ___________________________ Date: ___________________________ Signature: ___________________________ --- *Free Me South Africa (Pty) Ltd | Reg. 2025/384802/07 | exclusions@freemesouthafrica.co.za* *POPIA Section 21 | Processing by Operator on behalf of Responsible Party*