Operator Agreement (data processing)

Draft for legal review. Version 2026-10-29. Words in square brackets are placeholders.

This agreement forms part of the C-Base Terms of Service between the client (the responsible party under the Protection of Personal Information Act, 4 of 2013, "POPIA") and [Legal name] (registration number [Registration number]), trading as Phoenix Online Studios (the operator).

1. What we process and why

• Personal information: names, contact details and addresses of the client's users, employees, customers, suppliers and contacts; employee details needed for payroll (ID or passport numbers, tax numbers, bank details, pay, leave); documents and photos the client uploads; and messages received through the client's website forms.
• Purpose: only to provide C-Base to the client, on the client's documented instructions (using C-Base counts as such instructions), and to keep the service secure and working.
• Duration: for as long as the client uses C-Base, plus the export period in the Terms.

2. Our obligations as operator (POPIA sections 20 and 21)

• We process personal information only with the client's knowledge and authorisation, and treat it as confidential.
• Everyone at Phoenix with access is bound to confidentiality.
• We keep appropriate technical and organisational security measures (section 3).
• We notify the client without undue delay, and within [72] hours of becoming aware, if we have reasonable grounds to believe personal information was accessed or acquired by an unauthorised person.
• We help the client answer requests from data subjects (access, correction, deletion) and the Information Regulator, as far as C-Base allows.

3. Security measures

• Each organisation's data is kept apart from every other organisation's in the application and checked on every request.
• Strong passwords, optional or required two-step sign-in, automatic sign-out after inactivity, and limits on sign-in attempts.
• Sensitive numbers (ID, tax and bank account numbers) are stored encrypted. Uploaded files are private and served only after an access check.
• Important changes are written to an audit log that cannot be edited in the application.
• Encrypted connections (HTTPS) for all access, and regular database backups.

4. Sub-operators (subprocessors)

The client authorises these sub-operators:

We tell the client before adding or replacing a sub-operator, and the client may object. Each sub-operator is bound by written terms that protect the information at least as well as this agreement.

5. Transfers outside South Africa (POPIA section 72)

When the client switches on Essential Control AI, a question and the records it looks up are sent to Anthropic, PBC in the United States to produce the answer. Anthropic's Data Processing Addendum, which includes standard contractual clauses, binds Anthropic to protect it. Anthropic does not use API data to train its models and deletes it within 30 days, except for usage-policy enforcement or legal holds. ID numbers, tax numbers, bank details and payroll records are never sent. The client may switch Essential Control off at any time.

6. End of the agreement

At the end of the agreement the client can export its data during the export period in the Terms. We then delete it from C-Base and, within [90] days, from our backups, unless the law requires us to keep it.

7. Audits

On reasonable written notice, and at most once a year unless there was a breach, we give the client the information it needs to show that this agreement is being followed.

8. Contact

Information Officer: [Information Officer name], [Information Officer email], [Physical address].