Operator Agreement

When you store personal information about your own clients in Pinion CRM — their names, contact details, job history, invoices, photos — you are the “responsible party” and we are your “operator” as those terms are defined in the Protection of Personal Information Act 4 of 2013 (“POPIA”). Section 21 of POPIA requires the two of us to have a written contract governing that relationship. This Agreement is that contract. It forms part of our Terms of Service and applies automatically to every account — there is nothing to sign.

In this Agreement, “Customer Data” means the personal information about your clients and other data subjects that you or your users submit to the Services. “we”, “us” and “the Company” mean Propagated Gradients (Pty) Ltd (reg. 2024/567783/07), trading as Pinion CRM.

1. Our obligations as operator

1. Processing only on your instructions. We process Customer Data only with your knowledge and authorisation, and only as necessary to provide, maintain, and support the Services — never for our own purposes (section 20(a) of POPIA).
2. Confidentiality. We treat all Customer Data as confidential and do not disclose it unless required by law or in the course of the proper performance of our duties (section 20(b) of POPIA).
3. Security. We maintain appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of Customer Data, as section 19 of POPIA requires: encryption in transit and at rest, per-organization isolation enforced by database row-level security, and least-privilege administrative access.
4. Breach notification. If we have reasonable grounds to believe that Customer Data has been accessed or acquired by an unauthorised person, we will notify you as soon as reasonably possible (section 21(2) of POPIA) with enough information for you to meet your own notification duties under section 22.
5. Assistance. We will provide reasonable assistance when a data subject exercises rights against you (access, correction, deletion) in respect of Customer Data we hold, and with any lawful request from the Information Regulator.

2. Sub-operators

We use a small set of third-party providers to run the Services. Each acts as a sub-operator of Customer Data under terms at least as protective as this Agreement. The current list, with locations and purposes, is published at pinioncrm.com/subprocessors. We may change sub-operators; the list is updated whenever we do, and continued use of the Services after an update constitutes acceptance.

3. Where Customer Data is processed

Customer Data is stored on Supabase infrastructure in the eu-west-1 region (Republic of Ireland, European Union), and delivered through Cloudflare's global network, as disclosed in our Privacy Policy in terms of section 72 of POPIA. The EU's data protection law provides safeguards substantially similar to POPIA's conditions for lawful processing.

4. Return and deletion of Customer Data

You can export your Customer Data (for example, by downloading invoice PDFs) at any time while your account is active. If you ask us to delete your account, Customer Data is permanently removed from active systems within 30 days and from provider backups within 60 days, after which it cannot be recovered.

5. Your obligations as responsible party

1. You are responsible for the lawfulness of the Customer Data you put into the Services: having a lawful basis to process your clients' personal information, collecting it directly and openly, and using it compatibly with the purpose you collected it for.
2. You are responsible for responding to your own data subjects' requests (access, correction, objection, deletion) and for your own notification duties; we assist as described above.
3. You may not use the Services to process special personal information or children's personal information beyond what POPIA permits you, as responsible party, to process.

6. Term

This Agreement applies for as long as we hold Customer Data for you, and ends when that data has been deleted as described in section 4. Questions about this Agreement: [email protected].