Data Processing Agreement (EFS CRM)

Between the Customer (responsible party) and Drexopoint (Pty) Ltd t/a EFS Digital (operator), under POPIA s20 and s21. Accepted at signup with the Terms.

  1. Scope: EFS processes Customer Data only to provide EFS CRM, on the Customer's documented instructions (the Terms, app settings and support requests).
  2. Confidentiality (s20): EFS staff process only with authorisation and are bound by confidentiality.
  3. Security (s19, s21(1)): EFS maintains measures in Annex A and reviews them at least yearly.
  4. Breach (s21(2)): EFS notifies the Customer without undue delay and within 72 hours of becoming aware of a security compromise, with known details, and assists the Customer with its s22 notifications.
  5. Sub-operators: listed in Annex B. EFS gives 30 days' notice of additions; the Customer may object and cancel. Sub-operators are bound by equivalent terms.
  6. Cross-border (s72): permitted only to sub-operators meeting s72(1)(a).
  7. Data subject requests: EFS forwards requests and helps the Customer respond.
  8. Customer duties: lawful basis for all data; notice to contacts whose emails are logged (s18(4)); compliance with s69 for any automated emails; no special personal information (s26) or children's data (s34) unless agreed in writing.
  9. Staff access: support access only, with 2FA, logged, on Customer request or for security or legal reasons.
  10. Return and deletion: export for 90 days after termination, then deletion within 30 days, except copies required by law or in rolling backups (overwritten within 30 days).
  11. Audit: EFS provides reasonable information to show compliance, once a year, at the Customer's cost for on-site checks.
  12. Liability: as in the Terms.

Annex A, security: TLS encryption in transit; encryption at rest by hosting provider; per-user PIN logins; workspace isolation; staff 2FA; audit logs; backups before changes; least-privilege access. Annex B, sub-operators: Cloudflare Inc. (hosting, database, files, email routing); PayFast (billing data only, not Customer Data); Zoho (support email); Microsoft/Google/Xero only when the Customer enables a connection.