Datova Technology (Pty) Ltd · Datova Digital Office
Data Processing Agreement
Version 2026-10-draft-1 · last updated 2026-10-10
Draft — not yet reviewed by a lawyer. Highlighted text is still to be confirmed by Datova. This draft describes how Digital Office works today and will be replaced by a reviewed version.
1. Roles
This agreement forms part of the Subscription and Service Terms. For personal information in the Customer's Digital Office, the Customer decides the purposes and means ("controller" or "responsible party") and Datova Technology (Pty) Ltd processes it on the Customer's behalf ("processor" or "operator"). TO CONFIRM with counsel: terminology and requirements of the applicable laws.
2. Instructions
Datova processes the Customer's personal information only to provide the service, to provide support the Customer asks for, and as the law requires — and otherwise only on the Customer's documented instructions. The service's settings and the Customer's use of it are the Customer's instructions.
3. Categories of information and people
People: the Customer's users, employees and job candidates, and contacts at the Customer's clients and suppliers. Information: as described in Section 2 of the Privacy Policy, which may include special categories such as health information in leave evidence, as the Customer chooses to record.
4. Confidentiality and Datova staff
Only authorised Datova personnel bound by confidentiality may process the information, and only through customer-granted support access for business information.
5. Security measures
Organisation separation enforced by the database for every request; role-based permissions; restricted sensitive areas (HR, finance, confidential documents); encrypted connections; private file storage with permission-checked, short-lived links; an append-only audit log; customer-controlled, time-limited support access. TO CONFIRM: encryption at rest and backup measures as provided by the hosting providers.
6. Sub-processors
The Customer authorises Datova's current sub-processors: Supabase (database, authentication and file storage; EU — Ireland), Railway (application hosting; EU — Netherlands) and Resend (email delivery; EU — Ireland). Datova will give at least TO CONFIRM: days notice of new sub-processors, and the Customer may object on reasonable grounds.
7. Transfers
Information is processed in the European Union by the sub-processors above. TO CONFIRM with counsel: transfer safeguards required by the applicable laws.
8. Assistance, incidents and audits
Datova helps the Customer respond to requests from individuals and to meet its security obligations. Datova notifies the Customer without undue delay, and within TO CONFIRM: hours where possible, after becoming aware of a breach affecting the Customer's personal information, with the information then available. Datova provides information reasonably needed to show compliance with this agreement.
9. End of processing
At the end of the subscription Datova returns or deletes the Customer's personal information as set out in the Subscription and Service Terms, unless the law requires it to be kept.