Data Processing Agreement

SmartChat Data Processing Agreement (Operator Addendum)

This agreement forms part of the Terms of Service and is accepted when you accept the Terms.

This sets out how Ruka (Pty) Ltd, as your Operator, processes personal information on your behalf when you use SmartChat. You are the Responsible Party. Where you serve EU end users, you are the Controller and we are the Processor, and this agreement also meets GDPR Article 28.

1. Scope and instructions

We process personal information only to provide SmartChat and only on your documented instructions, which include your use of the service and these terms. We will tell you if an instruction appears to break the law.

2. Confidentiality

We keep the personal information confidential and ensure that anyone we authorise to process it is bound by confidentiality.

3. Security

We apply appropriate technical and organisational measures, including encryption in transit and at rest, role-based access control, and audit logs, in line with POPIA section 19 and GDPR Article 32.

4. Sub-processors

You authorise us to use sub-processors, including Google Cloud for hosting, Meta for WhatsApp messaging, and Google Analytics for website analytics, plus any other tools you connect. We remain responsible for their processing. We will give notice before adding a new sub-processor and you may object on reasonable grounds.

5. Cross-border transfer

We store data in South Africa. We do not yet transfer European personal information. When we begin serving European customers, any transfer of their data to South Africa will rely on Standard Contractual Clauses or another lawful mechanism.

6. Data subject requests

If an end user contacts us about their rights, we will refer them to you and help you respond.

7. Breach notification

If we discover a security compromise affecting your data, we will notify you without undue delay, give you the detail you need, and help you notify the Information Regulator through the eServices portal and any affected people.

8. Special personal information

SmartChat supports health and other special personal information. If you process it, you confirm you have a lawful basis and any consent the law requires. We apply our full security measures plus tighter access controls, limit who can see this data, and support your heavier duties.

9. Return and deletion

On termination we let you export your data for 30 days, then delete it within 90 days, unless the law requires retention.

10. Audit

On reasonable request and notice, we will give you the information you need to confirm we are meeting this agreement.