Data Processing Agreement

1. Introduction

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Teleios IT Consulting Pty Ltd (Registration No. 2025/487193/07), trading as StoreSuite (“Processor”, “we”, “us”), and you (“Controller”, “you”).

This DPA sets out the terms on which we process personal data on your behalf when you use the StoreSuite platform and related services (the “Service”). This DPA is designed to comply with the South African Protection of Personal Information Act (POPIA), the EU General Data Protection Regulation (GDPR), and other applicable data protection laws.

2. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person that is processed by us on your behalf through the Service.
• “Processing” means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• “Sub-processor” means any third party engaged by us to process Personal Data on your behalf.
• “Data Breach” means any unauthorised or unlawful access to, acquisition of, or disclosure of Personal Data.

3. Roles and Responsibilities

You (Controller): You determine the purposes and means of processing Personal Data. You are responsible for ensuring you have a lawful basis (e.g., consent, contractual necessity, legitimate interest) for collecting and sharing Personal Data with us.

We (Processor): We process Personal Data only on your documented instructions and solely for the purpose of providing the Service. We do not sell, rent, or otherwise commercially exploit your Personal Data.

4. Scope of Processing

4.1 Categories of Data Subjects

Personal Data processed through the Service may relate to the following categories of individuals:

• Your users: Employees, contractors, and agents who access the Service on your behalf
• Your customers: Individuals whose data you store in the CRM, sales, and invoicing modules
• Your suppliers: Supplier contact persons whose data you manage through the procurement module
• Your employees: Staff whose data you manage through the employee management module

4.2 Types of Personal Data

• Identity data: Names, job titles, departments, positions
• Contact data: Email addresses, phone numbers, physical addresses
• Financial data: Payment records, invoice details, tax identification numbers, credit limits, hourly rates
• Technical data: IP addresses, browser user agents, device information, login timestamps
• Business data: Inventory records, production data, sales records, purchase orders, serial numbers

4.3 Processing Activities

We process Personal Data for the following purposes:

• Providing and operating the Service
• User authentication and access control
• Data storage and backup
• Sending transactional emails (order confirmations, password resets, system notifications)
• Technical support and troubleshooting
• Security monitoring and incident response

5. Our Obligations

As your data processor, we undertake to:

• Process Personal Data only on your documented instructions, unless required by law
• Ensure that all personnel authorised to process Personal Data are bound by obligations of confidentiality
• Implement appropriate technical and organisational security measures (see Section 7)
• Assist you in responding to data subject requests (access, rectification, erasure, portability)
• Notify you of any Data Breach without undue delay and in any event within 72 hours of becoming aware
• Assist you with data protection impact assessments and prior consultations with supervisory authorities where required
• Delete or return all Personal Data upon termination of the Service, at your choice, within 30 days
• Make available all information necessary to demonstrate compliance with this DPA

6. Sub-processors

You provide general authorisation for us to engage the following sub-processors. We will notify you of any changes to this list and give you 30 days to object before engaging a new sub-processor.

Each sub-processor is bound by data processing agreements with obligations no less protective than those set out in this DPA.

7. Security Measures

We implement the following technical and organisational measures to protect Personal Data:

• Encryption in transit: All data transmitted between your devices and our servers is encrypted using TLS 1.2 or higher
• Encryption at rest: All data stored in our databases and backups is encrypted using AES-256
• Access control: Role-based access control (RBAC) and PostgreSQL Row-Level Security (RLS) for complete tenant data isolation
• Authentication: Secure token-based authentication with automatic rotation
• Password security: Passwords are hashed using industry-standard algorithms and never stored in plain text
• Audit logging: All data access and modifications are logged for audit purposes
• Backup: Automated daily backups with point-in-time recovery capability
• Network security: Firewalls, intrusion detection, and DDoS protection via Cloudflare
• Incident response: Documented incident response procedures with defined escalation paths

8. International Transfers

Your primary data is stored in the EU (Ireland, AWS eu-west-1). Where Personal Data is transferred to sub-processors outside the European Economic Area or South Africa, we ensure appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs) for transfers to the United States (SendGrid, Sentry)
• Adequacy decisions where available
• Binding corporate rules of the sub-processor, where applicable

9. Data Retention and Deletion

We retain Personal Data for the duration of your subscription and apply the following retention schedule after account closure:

• Active account data: Retained for the duration of your subscription
• Post-cancellation: Data is available for export for 30 days after subscription ends, then permanently deleted
• Financial records: Retained for 7 years as required by tax and accounting regulations
• Audit logs: Retained for 3 years for security and compliance purposes
• Login and security logs: Retained for 90 days
• Backups: Purged within 30 days of data deletion from primary systems

You may request earlier deletion of your data by contacting us at privacy@storesuite.co.za.

10. POPIA Compliance (South Africa)

For data subjects in South Africa, processing is conducted in accordance with the Protection of Personal Information Act, 2013 (POPIA):

• Information Officer: Sachen Govender, privacy@storesuite.co.za
• We process personal information in accordance with POPIA Sections 19–22 (security safeguards, notification of breaches)
• Data subjects may lodge complaints with the Information Regulator at www.justice.gov.za/inforeg

11. Audits

Upon reasonable written request (no more than once per year), and subject to appropriate confidentiality obligations, we will make available information necessary to demonstrate compliance with this DPA. Any audit must:

• Be conducted during normal business hours
• Not unreasonably interfere with our operations
• Be at your expense unless the audit reveals material non-compliance

12. Term and Termination

This DPA takes effect when you begin using the Service and continues for as long as we process Personal Data on your behalf. Obligations regarding data deletion, confidentiality, and security survive termination.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service. Our total aggregate liability for all claims arising from or related to this DPA shall not exceed the total fees paid by you to StoreSuite in the three (3) months preceding the claim.

14. Governing Law

This DPA shall be governed by and construed in accordance with the laws of the Republic of South Africa. For controllers established in the European Union, nothing in this DPA shall affect mandatory rights under GDPR. Any disputes arising from this DPA are subject to the dispute resolution provisions in our Terms of Service.

15. Contact Us

Questions about this Data Processing Agreement?

• Information Officer: Sachen Govender
• Email: privacy@storesuite.co.za
• Legal enquiries: legal@storesuite.co.za