Data Processing Agreement

This Data Processing Agreement (“DPA”) is between the customer organisation that has accepted the terms of service (“Customer”, the responsible party or controller) and Digidan (Pty) Ltd (registration number 2017/184017/07), trading as DeploySeal, of 28 George Street, Mayfair, Johannesburg, 2092, South Africa (“DeploySeal”, the operator or processor). DeploySeal’s Information Officer is Danyal Motan, founder and director of Digidan (Pty) Ltd, registered with the Information Regulator under registration number 2026-068913, reachable at desk@deployseal.com.

It applies to all personal information DeploySeal processes on the Customer’s behalf in providing the service, under the Protection of Personal Information Act 4 of 2013 (“POPIA”), and, where the Customer is established in the European Economic Area or the United Kingdom or offers services there, under the GDPR and UK GDPR. Terms defined in those laws have the same meaning here. If this DPA conflicts with the terms of service on a data protection point, this DPA prevails.

DeploySeal processes personal information only on the Customer’s documented instructions. The Customer’s instructions are: the terms of service, this DPA, the configuration the Customer chooses in the service (which sites to install the widget on, whom to invite, what to mask, how long to keep evidence, which integrations to connect), and any written instruction the Customer gives later. DeploySeal will tell the Customer if it believes an instruction breaks the law, and may then pause that processing.

DeploySeal does not process the Customer’s personal information for its own purposes, except the aggregate, de-identified service metrics needed to run and improve the service, and what the law requires.

The Customer warrants that it has, and will keep, a lawful basis for the processing it instructs, including:

• authority to install the widget on each website it registers;
• a lawful basis for recording its testers’ sessions, and notice to them of the recording;
• masking of any on-page content that it has no right to record, using the masking attributes DeploySeal documents;
• a retention setting appropriate to its obligations.

DeploySeal will:

• ensure that everyone it authorises to process personal information is bound by confidentiality;
• implement and maintain the security measures in Annex 3, and keep them appropriate to the risk as the service and the threat landscape change;
• help the Customer answer requests from data subjects, using the export, correction and deletion functions in the service, and forward any request DeploySeal receives directly within five business days;
• help the Customer with its own security, breach-notification and impact-assessment obligations, taking account of what DeploySeal knows;
• on termination, keep the Customer’s data exportable for 30 days and then delete it, as the terms of service set out, except what the law requires DeploySeal to keep;
• make available the information needed to demonstrate compliance with this DPA, including the privacy policy, the security documentation on request, and, no more than once a year or after a breach, allow an audit by the Customer or an independent auditor it mandates, on 30 days’ notice, at the Customer’s cost, under confidentiality, and without disrupting other customers.

The Customer authorises DeploySeal to use the sub-processors listed in Annex 2. DeploySeal will give at least 30 days’ notice before adding or replacing one, by email to organisation owners and by updating this page. If the Customer objects on reasonable data-protection grounds and DeploySeal cannot resolve the objection, the Customer may terminate the affected service and receive a refund of prepaid fees for the unused period. DeploySeal binds each sub-processor to data-protection obligations no less protective than this DPA and remains responsible to the Customer for their performance.

DeploySeal’s primary processing takes place in South Africa. Transfers to the sub-processors outside South Africa listed in Annex 2 are made under section 72(1)(a) of POPIA, each recipient being bound by contract to protect the information to a standard substantially similar to POPIA.

For a Customer subject to the GDPR or UK GDPR, the parties agree that, on the Customer’s request, the EU Standard Contractual Clauses (Commission Decision 2021/914, module two, controller to processor) and, for the UK, the International Data Transfer Addendum, are incorporated into this DPA for any transfer from the EEA or the UK to DeploySeal, with the Customer as data exporter and DeploySeal as data importer, the optional docking clause not applied, the governing law and forum being those of the Customer’s member state, and Annexes 1 to 3 of this DPA serving as the annexes to the clauses.

DeploySeal will notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to the Customer’s personal information. The notice will describe what happened, what information and how many people are affected as far as known, what DeploySeal has done and recommends, and a contact for follow-up. DeploySeal will notify the Information Regulator where POPIA section 22 requires it of DeploySeal directly, and will support the Customer’s own notifications.

This DPA lasts as long as DeploySeal processes personal information for the Customer, and the obligations about deletion, confidentiality and assistance continue until that processing ends. It cannot be terminated separately from the terms of service.

The liability provisions of the terms of service apply to this DPA. Each party is liable for its own breaches of data protection law. This DPA is governed by the law of the Republic of South Africa, without prejudice to the governing-law choice in any Standard Contractual Clauses incorporated under section 6.

Services the Customer chooses to connect (issue trackers, chat tools, Zapier, webhook endpoints) and sign-in providers the Customer’s users choose (Google, Microsoft) are engaged by the Customer, not sub-processors of DeploySeal.

• Encryption. TLS for all traffic. Encryption at rest for the database and file storage. Integration credentials, two-factor secrets and webhook signing secrets encrypted with AES-256-GCM before storage. Passwords, refresh tokens and invitation tokens stored as hashes.
• Record integrity. Sealed records are digested and signed with a key held in Azure Key Vault that cannot be exported; each evidence package can be verified against its signature.
• Tenant isolation. Every query is filtered to the organisation of the signed-in user at the data-access layer; cross-tenant reads are covered by automated tests.
• Access control. Six organisation roles with least privilege; step-up verification for destructive actions such as purging evidence; two-factor authentication required for DeploySeal’s operations tools; passkeys and TOTP available to all users; sessions limited to ten per user and 30 days.
• Evidence handling. Typed input masked at the point of capture; site-owner masking for page content; links to evidence files expire after 15 minutes; redactions burned into images; scheduled deletion every six hours according to the retention setting.
• Platform hygiene. Dependencies and container images scanned on every change; third-party actions pinned; production configuration validated at start-up; rate limits on authentication, widget and write endpoints.
• Resilience. Daily database backups kept for 7 days; file storage geo-replicated; documented restore procedure.
• Monitoring. Error reporting with personal information stripped before it leaves the platform; audit log of security-relevant actions; public status page.

Email desk@deployseal.com with your organisation name and the signatory’s details. We return a countersigned PDF of this DPA, with the Standard Contractual Clauses attached where section 6 applies.