Data Processing Agreement
This agreement sets out our duties as operator of the personal information in your workspace, as section 21 of POPIA requires. It forms part of the Terms of Service and applies to every workspace without a separate signature. A signed copy is available on request.
1. Scope and instructions
This agreement is between ZA TechLabs, trading as Mavecy (the Operator) and the subscribing customer (the Responsible Party) for customer personal information processed to deliver Mavecy. It applies for the subscription term and any permitted return, retention and deletion period after it. Where it conflicts with other terms about that processing, this agreement takes precedence.
The customer decides the lawful purposes and gives documented instructions through these Terms, the features it configures and uses, and authorised requests. Processing includes collecting, hosting, organising, retrieving, transmitting, calculating and deleting information as needed for enabled features. Data subjects and categories of information are in Annex A.
The customer is responsible for its lawful grounds, required notices, permissions, accuracy, and the additional conditions for special personal information and children's information. The Operator processes only within authorised instructions unless law requires otherwise, tells the customer about such a legal requirement where permitted, and tells the customer if it reasonably believes an instruction is unlawful.
2. Confidentiality and safeguards
The Operator restricts access to authorised people who are bound by confidentiality, and keeps appropriate, reasonable safeguards in place as section 19 of POPIA requires. Annex B lists the measures and responsibilities. Access is limited to what is necessary and reviewed throughout the service.
3. Subprocessors and transfers
The customer authorises the providers listed in Annex C for the stated functions. The Operator binds them in writing to confidentiality and security duties suited to their processing, and remains accountable for its own obligations. We notify material provider changes by email to the workspace owner and on the Subprocessors page at least 30 days before use where practicable. The customer may raise a substantiated privacy or security objection at info@mavecy.com. We will look for a workable solution, and if there is none the customer may cancel and receive a pro rata refund for the unused paid period, with the export rights in section 5.
International processing meets section 72 of POPIA and other applicable conditions. Locations and safeguards are in Annex C. No processing currently requires the Information Regulator's prior authorisation.
4. Incidents and assistance
The Operator notifies the customer immediately, and in any case within 72 hours, once it has reasonable grounds to believe customer personal information has been accessed or acquired by an unauthorised person. The notice gives the available details, affected categories, likely consequences, containment steps and a contact, with updates as the investigation continues. The Operator cooperates with recovery, evidence preservation and lawful notifications. The customer makes the notifications required of a responsible party, with the Operator's help, unless law gives the Operator a separate duty.
The Operator promptly forwards data subject requests about the customer's workspace and helps with lawful access, correction, deletion, objections, assessments and Information Regulator enquiries within its role. It verifies authority before releasing information. It gives the information reasonably needed to assess compliance and agrees to proportionate reviews that protect other customers and platform security.
5. Return and deletion
When the service ends, the customer can download documents in the app for 30 days, and may ask for a complete export of workspace records in CSV format, delivered by secure download link within 10 business days, at no charge. Remaining copies are deleted or de-identified within 90 days of the service ending, except information lawfully kept for tax, accounting or legal claims. Retained information is isolated and not used further. Backups expire within 30 days after deletion, and anything restored from a backup is deleted again. We explain exceptions and confirm completion on reasonable request.
Annex A: processing particulars
| Customer and term | The organisation named in the workspace, its account owner and administrators, for the subscription term |
|---|---|
| Purposes | Providing the enabled modules: customers and suppliers, quotes and invoices, payments, expenses, projects, people and payroll, point of sale, calendar, AI drafting, support and backups |
| Data subjects | The customer's customers and their contacts, suppliers, employees and contractors, job applicants where recorded, and account users |
| Information | Identity and contact details, company and tax numbers, commercial records (quotes, invoices, payments), bank details, receipts and uploaded documents, messages, files and voice notes sent to Mavi, employment, pay, leave and payroll records |
| Special and children's information | Not required by any feature. The customer may record it only where the law allows and it is necessary (for example, a medical certificate for sick leave). AI features must not be used for it. |
| Retention, export and deletion | As in section 5 and Security and Data Handling |
Annex B: security measures
The measures in Security and Data Handling, which form part of this annex: encrypted connections, hashed passwords, sign in rate limits, workspace separation checked on every request, role based permissions, private file storage, request forgery protection, session time outs, regular automated backups, limited staff access, and incident response. The customer is responsible for its own user invitations, roles, removing leavers and protecting passwords.
Annex C: providers and locations
The current register on the Subprocessors page, including transfer safeguards, forms this annex. Changes follow section 3.