Operator Agreement

This agreement forms part of the Terms of Service between EPromotions (Pty) Ltd (“Yasenza”, the operator) and the practice that uses Yasenza (“you”, the responsible party). It sets out how we process your clients’ personal information, as section 21 of the Protection of Personal Information Act, 2013 (POPIA) requires.

1. What we process and why

• Whose information: your clients, and people who book or ask to book with you.
• What: names, phone numbers, email addresses and birthdays where given, appointments, venues booked, invoices and payments, messages prepared for you to send, and each client’s booking consent.
• Why: only to provide Yasenza to you: your booking page, diary, reminders and follow-ups you send, invoices and receipts, and the other features you switch on.

2. Your instructions

We process your clients’ information only on your instructions, which are these terms and the settings you choose in Yasenza, unless the law requires otherwise. We do not use it for our own purposes, sell it, or use it to contact your clients ourselves.

3. Special personal information

Yasenza is not designed for health or other special personal information and has no fields for it. You agree not to enter such information in Yasenza, including in names, notes, messages or file names.

4. Confidentiality

Everyone at Yasenza who can access your clients’ information is bound to keep it confidential and may access it only to provide or support the service.

5. Security

We keep appropriate, reasonable technical and organisational measures in place, as section 19 of POPIA requires, including encryption in transit, protected passwords, role-based access, a strict separation between practices, backups and audit logs. We review them as risks change.

6. Other operators

We use providers for hosting, storage, security and email (see the Privacy Policy). Each is bound by a written agreement to protect the information to the same standard. We remain responsible to you for their part. We will tell you before we add a provider of a new kind.

7. Information outside South Africa

Your clients’ information may be stored outside South Africa (currently [the United Kingdom and the European Union]) by providers that protect it to a standard substantially similar to POPIA, as section 72 allows.

8. Breaches

If we have reasonable grounds to believe your clients’ information has been accessed or acquired by someone without authority, we will tell you as soon as reasonably possible [and within 72 hours], with what we know, so that you can notify the Information Regulator and the clients affected, as section 22 of POPIA requires. We will help you with that.

9. Requests from your clients

If one of your clients asks us to see, correct or delete their information, we will pass the request to you. Yasenza lets you correct a client’s details and stop messages to them; for anything else, we will help you respond within the time POPIA allows.

10. When your account closes

On request before closure we give you a copy of your client list. Within [30] days after closure we delete or anonymise your clients’ information, except records the law requires us to keep, which we keep only for as long as required.

11. Information and checks

On reasonable written request, we give you the information you need to show that this agreement is being met.

12. Liability and duration

The liability terms in the Terms of Service apply to this agreement. It lasts for as long as we process your clients’ information.