Data Processing Addendum (DPA) – POPIA Operator Terms
Effective date: 2026/03/13
This POPIA Data Processing Addendum (“DPA”) forms part of the Aim4price Dealer Terms of Service between the Dealer and Aim4price.
1. Scope and roles
1.1 For Dealer Data that contains Personal Information, the Dealer is generally the Responsible Party and Aim4price acts as the Operator, unless Aim4price is processing Personal Information for its own direct business purposes, in which case Aim4price is the Responsible Party for that specific processing.
1.2 This DPA is intended to serve as the written operator agreement between the Dealer and Aim4price for purposes of POPIA where Aim4price processes Personal Information on the Dealer’s behalf.
1.3 This DPA applies only to Personal Information processed by Aim4price as Operator for the Dealer.
2. Documented instructions and permitted processing
2.1 Aim4price will process Personal Information only with the knowledge or authorisation of the Dealer and in accordance with:
(a) the Dealer’s documented instructions;
(b) the normal operation of the Platform as configured and used by the Dealer;
(c) support or troubleshooting requests initiated or authorised by the Dealer;
(d) the Dealer Terms; and
(e) applicable law.
2.2 Aim4price may process Personal Information only to the extent reasonably necessary to:
(a) provide the Platform and requested features to the Dealer;
(b) host, store, retrieve, transmit, and display Dealer Data for authorised Users;
(c) provide support, troubleshooting, maintenance, disaster recovery, and bug fixing;
(d) maintain security, logging, backups, access controls, and service continuity;
(e) detect, prevent, investigate, and respond to fraud, misuse, or security incidents; and
(f) comply with applicable law.
2.3 Aim4price will not use Dealer Personal Information for an unrelated purpose that is inconsistent with the Dealer’s documented use of the Platform.
3. Confidentiality
3.1 Aim4price will treat Personal Information processed on behalf of the Dealer as confidential.
3.2 Aim4price will ensure that persons authorised to process such Personal Information are subject to appropriate confidentiality obligations.
3.3 Aim4price will not disclose such Personal Information except:
(a) as required by law;
(b) as necessary for the proper performance of Platform services to the Dealer;
(c) to authorised sub-operators/service providers under appropriate obligations; or
(d) on the Dealer’s lawful instructions.
4. Security safeguards
4.1 Aim4price will implement and maintain reasonable technical and organisational safeguards appropriate to the risk, taking into account the nature of the Personal Information and the processing involved.
4.2 Such safeguards may include, where appropriate, access controls, user-role controls, authentication measures, logical data separation, logging, monitoring, backups, operational procedures, and incident-response processes.
4.3 Aim4price does not warrant that processing or systems will be error-free or immune from all compromise, but will take reasonable steps appropriate to the risk.
5. Security compromise / breach notification
5.1 If Aim4price has reasonable grounds to believe that Personal Information processed on behalf of the Dealer has been accessed or acquired by an unauthorised person, Aim4price will notify the Dealer immediately after becoming aware of those reasonable grounds.
5.2 Aim4price will provide reasonably available information to assist the Dealer to understand the known facts, scope, and available mitigation steps.
5.3 The Dealer acknowledges that, as Responsible Party, the Dealer is generally responsible for notifications to the Information Regulator and affected data subjects where required by law.
5.4 Aim4price will reasonably cooperate with the Dealer in investigating, containing, and responding to the incident, subject to feasibility, confidentiality, legal restrictions, and recovery priorities.
6. Sub-operators, hosting, and infrastructure providers
6.1 The Dealer authorises Aim4price to use hosting, infrastructure, storage, communications, analytics, support, backup, and other service providers reasonably required to operate the Platform, including Wix and its processors or connected providers used in normal service delivery.
6.2 Aim4price will take reasonable steps to ensure that sub-operators who process Personal Information on behalf of the Dealer are subject to appropriate written confidentiality and security obligations.
6.3 Aim4price remains responsible for its own compliance with this DPA in relation to processing it carries out as Operator.
7. Cross-border processing
7.1 Personal Information may be processed or stored outside South Africa where this is reasonably necessary for service delivery, hosting, support, backup, infrastructure, or operational continuity.
7.2 Aim4price will take reasonable steps to support lawful cross-border processing and to ensure that such processing occurs only where lawful, subject to appropriate safeguards, contractual protections, or another lawful basis recognised by POPIA.
8. Assistance to the Dealer
8.1 Taking into account the nature of the processing and the information available to Aim4price, Aim4price will reasonably assist the Dealer, at the Dealer’s cost where substantial effort is required, with:
(a) data subject requests routed through the Dealer;
(b) security-related information reasonably required for the Dealer’s compliance;
(c) incident-related cooperation reasonably required by law; and
(d) reasonable information about the processing carried out under this DPA.
8.2 Aim4price is not required to disclose information that would compromise other customers, system security, trade secrets, or legally protected information.
9. Data subject requests
9.1 Where Aim4price receives a request that clearly relates to Personal Information for which the Dealer is the Responsible Party, Aim4price may direct the requester to the Dealer or notify the Dealer of the request, unless prohibited by law.
9.2 The Dealer remains responsible for responding to such requests where the Dealer is the Responsible Party.
10. Return, export, deletion, and retention
10.1 On termination of the Dealer’s access to the Platform, the Dealer may request export of Dealer Data where available and technically feasible.
10.2 Aim4price may delete or decommission active access to Dealer Data after termination, subject to system processes, retention schedules, technical limitations, and legal obligations.
10.3 Aim4price may retain limited backups, logs, archival records, and security records for lawful business, audit, dispute, fraud prevention, enforcement, and legal compliance purposes.
11. Aggregated and de-identified information
11.1 Nothing in this DPA prevents Aim4price from generating or retaining aggregated and/or de-identified Market Intelligence that is not designed to identify the Dealer, the Dealer’s users, or data subjects.
11.2 Such aggregated and/or de-identified information remains an Aim4price asset.
12. No transfer of ownership
12.1 This DPA does not transfer ownership of Dealer Data to Aim4price.
12.2 This DPA does not give the Dealer ownership of Aim4price software, logic, methods, analytics systems, or related intellectual property.
13. No restraint of trade; scope of restriction
13.1 This DPA is a data-processing and confidentiality document only.
13.2 It does not prohibit Kuyler Chris Geldenhuys, Aim4price, or Aim4price personnel from accepting employment, performing sales work, consulting, trading, or doing business generally.
13.3 The only restrictions created by this DPA relate to lawful handling of Personal Information, Dealer-specific non-public data, and Confidential Information.
14. Working product; no additional warranties
14.1 The Platform is an evolving software product and may contain bugs, interruptions, or limitations.
14.2 This DPA does not create any warranty that processing will be uninterrupted, error-free, or suitable for every Dealer use case.
14.3 Aim4price will, however, implement reasonable safeguards and provide reasonable support within the bounds of the Dealer Terms.
15. Order of precedence
15.1 This DPA forms part of the Dealer Terms.
15.2 If there is a conflict between this DPA and the Dealer Terms on a matter specifically relating to Personal Information processed by Aim4price as Operator, this DPA prevails to the extent of that conflict.