POPIA Data Processing Agreement
Version 1.0 · Last updated 2026-10-13
Parties
Between the customer (the responsible party) and WorkForge (the operator), under the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Purpose
WorkForge processes personal information only to provide the service described in the order, and only on the customer's documented instructions (including instructions given through the assistant by authorised users).
2. Types of information
Contact details, communications (email and WhatsApp messages), calendar entries, documents and records the customer connects or uploads, which may include information about the customer's staff, clients and suppliers.
3. Confidentiality
Our staff and contractors who access personal information are bound by confidentiality.
4. Security safeguards (section 19)
We maintain appropriate safeguards, including: a separate server per customer; encrypted connections; credentials stored in a business password manager and never sent by email or WhatsApp; least-privilege access; two-step sign-in on our admin accounts; logging of the assistant's actions; backups; and prompt patching.
5. Sub-operators
The customer authorises us to use these categories of sub-operators: cloud hosting (Johannesburg region), AI model providers, Microsoft 365, WhatsApp/Meta, email delivery and payment processing. We will give notice before adding a new category.
6. Cross-border transfers (section 72)
Some sub-operators (for example AI model providers) process information outside South Africa. We use providers bound by data-protection terms offering protection substantially similar to POPIA. The customer consents to these transfers for the purpose of the service.
7. Security compromises (section 22)
We notify the customer without undue delay, and within 72 hours where possible, after becoming aware of a compromise affecting their information, with the details needed for the customer to meet its own obligations.
8. Data-subject requests
We help the customer respond to requests for access, correction or deletion within a reasonable time.
9. Return and deletion
On termination we return or export the information on request within 30 days, then delete it, except where law requires retention.
10. Audit
On reasonable notice, we provide information needed to show compliance with this agreement.