LONNA Operator Agreement (POPIA)
This agreement is between the customer (the "responsible party") and Alpha Bridge Accounting (Pty) Ltd (the "operator") and is required by sections 20 and 21 of POPIA. The customer accepts it when it signs up.
1. Subject
The operator processes personal information of the responsible party's employees and other data subjects in LONNA, only to provide the payroll service described in the Terms of Service: calculating pay and deductions, producing payslips, reports and statutory and bank files, and keeping payroll records.
Types of information: names, identity numbers, contact details, employment details, remuneration, tax and bank details, leave records. Data subjects: the responsible party's employees and their contacts as needed for payroll.
2. Instructions
The operator processes the information only on the responsible party's documented instructions, which are given by using LONNA and by these terms, and treats it as confidential. It does not use it for any other purpose.
3. Security (POPIA s19 and s21)
The operator keeps reasonable technical and organisational measures in place, including those listed in the Privacy Notice, and reviews them regularly.
Operator staff may open the responsible party's data only after the responsible party approves, for a limited time, and every access is recorded and visible to the responsible party. Staff with access are bound by confidentiality.
4. Security compromises (POPIA s21(2) and s22)
If the operator has reasonable grounds to believe that personal information was accessed or acquired by an unauthorised person, it tells the responsible party without delay, and in any case within [24] hours of becoming aware, with what is known about what happened, what information is involved and what is being done. The responsible party decides about notifying the Information Regulator and the data subjects, and the operator helps.
5. Other operators
The operator uses service providers to host LONNA and send e-mail ([names]). It binds them to equivalent protection and remains responsible for them. It will tell the responsible party before it adds or replaces one that stores payroll information.
6. Helping the responsible party
The operator helps the responsible party to answer requests from data subjects to access, correct or delete information, and to meet its own POPIA duties, as far as the system allows.
7. Location
[Confirm: payroll information is stored and processed in South Africa.]
8. When the agreement ends
At the end the operator gives the responsible party its information in a usable format on request within [30] days, and then deletes it, except what the law requires it to keep.
9. Checking
The responsible party may ask the operator, once a year or after a security compromise, for written information about how it meets this agreement. The access record in LONNA is available to the responsible party at any time.