Data processing agreement

Version and last updated: 29 October 2026

This agreement is between the business that uses ScripDock ("the company") and ScripDock ("we"), as named in our terms of service. It is part of those terms and is accepted with them. It is the written contract that sections 20 and 21 of the Protection of Personal Information Act (POPIA) require between a responsible party and its operator.

1. Roles

• The company is the responsible party for the personal information it puts into ScripDock about its staff and others ("company records"). It decides why and how that information is used.
• ScripDock is the company's operator: we process company records on the company's behalf, only to provide ScripDock.
• For the account details of people who sign in, we are the responsible party; our privacy policy covers that.

2. What is processed

• Whose information: the company's employees and job applicants, and their emergency contacts.
• What information: names, contact details, ID or passport numbers, addresses, job titles and departments, availability, shifts, clock times, leave (including reasons, which may include health information), written warnings and hearings (which may concern alleged offences), contracts, pay rates and uploaded documents.
• Why: to provide ScripDock's features to the company: rosters, clocking, staff records, warnings, leave, contracts, pay estimates, exports and the emails the company asks ScripDock to send.
• For how long: while the company uses ScripDock, and afterwards as in section 9.

3. Our duties as operator

• We process company records only on the company's instructions. Its use of ScripDock (what it enters, exports, changes or deletes) and these terms are those instructions. We do not use company records for our own purposes, sell them or use them for advertising.
• We treat company records as confidential, and only people working for ScripDock who need to (for example, to give support the company asked for) can reach them, under a duty of confidentiality.
• If the law requires us to disclose company records, we tell the company first, unless the law forbids it.

4. Security

We keep appropriate, reasonable technical and organisational measures in place to protect company records against loss, damage and unlawful access (section 19 of POPIA), including:

• encryption in transit (HTTPS) and at rest, by our database provider;
• separation of each company's records from every other company's, enforced in the database, and access inside the company by the roles it sets;
• private document storage with short-lived links;
• restricted administrative access with strong passwords and two-step sign-in;
• a change history the company can check;
• testing of the separation between companies after changes.

5. Other operators we use

The company agrees that we use these providers to run ScripDock: Supabase (database, sign-in, file storage), Cloudflare (website), Resend (email) and, once online payment is offered, Paystack (payments). Each is bound to protect the information at least as well as this agreement requires. We tell owners at least 30 days before adding or replacing one; the company may cancel if it objects.

6. Outside South Africa

Some providers store or process information outside South Africa. We only allow that where section 72 of POPIA permits it, as explained in the privacy policy.

7. Security breaches

If we have reason to believe that company records were accessed or obtained by someone without authority, we tell the owner without delay and in any case within 72 hours of finding out. We say what happened, what information was affected and what we are doing, and we help the company notify the Information Regulator and the people affected, as section 22 of POPIA requires.

8. Helping the company

• The company can see, correct, export and delete its records in ScripDock itself. Where it needs more help to answer a request from a person about their information, or a question from the Information Regulator, we help as far as reasonably possible.
• If a person asks us directly about company records, we refer them to the company.

9. When the company leaves

• The company can export its records to Excel at any time, including while closed after cancelling.
• When the owner deletes the company, its records and documents are deleted straight away. After a cancelled subscription, they are deleted two months after the company closes, as in our cancellation policy.
• Backup copies are removed as the backups expire, within [number, e.g. 7] days. We keep nothing else, except what the law requires.

10. The company's duties

• The company makes sure it has a lawful reason to process each piece of information it puts into ScripDock, including special personal information such as health information, and that it is accurate and not more than it needs.
• It tells its staff that it keeps their records in ScripDock and why, as section 18 of POPIA requires.
• It gives logins and roles only to people who should have them, and removes access when people leave.
• It tells us straight away if it suspects that one of its accounts has been misused.

11. Checks

On request, we give the company the information it reasonably needs to show that this agreement is being kept, such as a description of our security measures. [Lawyer: decide whether to allow audits, and on what notice and cost.]

12. Liability and order of documents

The limits on liability in section 15 of the terms of service apply to this agreement too, except where the law does not allow them. If this agreement and the terms differ about company records, this agreement applies.