Mutual NDA and POPIA Agreement

SCHEDULE OF PARTIES

Complete one schedule per party. This Agreement is entered into between Entegri Connect and each Supplier or Client (as applicable) on the Platform.

1. BACKGROUND

1.1 Entegri Connect operates the Entegri Connect Platform, a marketplace connecting vetted professional services Suppliers with Clients. In the course of Platform registration, the Bid process, and individual Engagements, the parties will exchange Confidential Information of a commercial, technical, personal, and client-sensitive nature.

1.2 This Agreement records the standing terms on which each party will treat Confidential Information received from the other. It takes effect from first contact on the Platform and continues in force for the duration of the party’s registration and thereafter in accordance with clause 11.

1.3 Where a Supplier Platform Participation Agreement or Client Platform Participation Agreement has been or is subsequently executed, this Agreement continues in force alongside it. In the event of conflict between this Agreement and the relevant Platform Agreement in respect of confidentiality, the provision affording greater protection to the Disclosing Party prevails. In respect of the allocation of POPIA roles, the Platform Agreement prevails.

1.4 This Agreement comprises Part A (Mutual Non-Disclosure), Part B (POPIA Operator Terms) and Part C (Entegri Connect as Operator). Part A applies to all parties at all times. Part B applies only in the limited circumstances set out in clause 8.4. Part C applies only in the limited circumstances set out in clause 8.3B.

2. DEFINITIONS

“Affiliate” means any entity that controls, is controlled by, or is under common control with a party.

“Agreement” means this Mutual Non-Disclosure Agreement and POPIA Agreement, comprising Part A, Part B and Part C.

“Authorised Personnel” means employees, partners, members, or contractors of a party who have been authorised in writing to Process Personal Information for the Permitted Purpose.

“Bid” means a written proposal submitted by a Supplier through the Platform in response to a Client’s Service Requirement.

“Business Day” means any day other than a Saturday, Sunday, or public holiday in the Republic of South Africa.

“Confidential Information” means all non-public information of any kind disclosed by one party (the “Disclosing Party”) to the other (the “Receiving Party”), in any form, whether or not marked confidential, including: (a) Client identities, financial data, working papers, and Engagement content; (b) commercial information, fee structures, Bid details, and Platform methodologies; (c) personal information of directors, employees, and data subjects; (d) the existence, scope, and terms of any Engagement; and (e) any analysis or derivative work based on the foregoing.

“Data Subject” means as defined in POPIA.

“Engagement” means any professional services agreement entered into between a Supplier and a Client following Bid acceptance through the Platform.

“GDPR” means Regulation (EU) 2016/679 and the United Kingdom General Data Protection Regulation, as the context requires.

“Introduction” means the event triggered by a Client’s acceptance of a Supplier’s Bid through the Platform, at which point Entegri Connect facilitates direct contact between the Supplier and the Client.

“Operator” means as defined in POPIA, an entity that processes Personal Information on behalf of a Responsible Party.

“Personal Information” means as defined in POPIA.

“Permitted Purpose” means the registration, assessment, and conduct of Engagements through the Entegri Connect Platform.

“Platform” means the Entegri Connect marketplace as defined in the relevant Supplier or Client Platform Participation Agreement.

“Platform Administration Data” means Personal Information disclosed by Entegri Connect to a Supplier or Client for the administration of the Platform only, including counterparty contact details released following Bid acceptance, account administration data, and Platform communications records. It does not include Personal Information that a Supplier collects from, or is given directly by, a Client in the course of performing an Engagement.

“POPIA” means the Protection of Personal Information Act 4 of 2013, as amended, and any regulations issued thereunder.

“Processing” means as defined in POPIA.

“Representatives” means in relation to a party, its directors, members, partners, employees, and (with the prior written consent of the Disclosing Party) its professional advisers, in each case who have a need to know Confidential Information for the Permitted Purpose.

“Responsible Party” means as defined in POPIA, the entity that determines the purpose and means of processing Personal Information.

“Security Compromise” means as defined in POPIA, any unauthorised access, loss, damage, or destruction of Personal Information.

“Service Requirement” means a description of professional services posted by a Client on the Platform.

“Special Personal Information” means as defined in POPIA.

“Sub-Operator” means any third party engaged by an Operator to Process Personal Information on its behalf.

“Workspace Document” means any document, file, or record uploaded by a Client or a Supplier to an Engagement workspace on the Platform.

PART A: MUTUAL NON-DISCLOSURE

3. CONFIDENTIALITY OBLIGATIONS: MUTUAL

3.1 Each Receiving Party shall: (a) use the Confidential Information only for the Permitted Purpose; (b) treat the Confidential Information with at least the same degree of care it applies to its own confidential information of equivalent sensitivity, and in no event less than reasonable care; (c) limit access to Confidential Information to Representatives with a genuine need to know for the Permitted Purpose, and ensure that each Representative is bound by written obligations of confidentiality no less protective than those in this Agreement; (d) not copy, reproduce, decompile, reverse-engineer, or create derivative works from the Confidential Information except as necessary for the Permitted Purpose; (e) be responsible for any breach of this Agreement by its Representatives as if it were a breach by the Receiving Party itself; and (f) promptly notify the Disclosing Party in writing of any actual or suspected unauthorised use, disclosure, loss, or compromise of Confidential Information.

3.2 The obligations in clause 3.1 do not apply to information that the Receiving Party can demonstrate by contemporaneous written record: (a) was lawfully in its possession, free of any obligation of confidence, before disclosure; (b) is or becomes publicly available through no act or omission of the Receiving Party or its Representatives; (c) was lawfully received from a third party who was not, to the Receiving Party’s knowledge, under any obligation of confidence; or (d) was independently developed without reference to the Confidential Information.

3.3 For the avoidance of doubt, the obligations in clause 3.1 are mutual and apply equally to Entegri Connect as Receiving Party in respect of any Confidential Information disclosed by the Supplier or Client. Entegri Connect undertakes to treat all business, commercial, financial, and personal information disclosed by the Supplier or Client with the same standard of care, and for the same limited Permitted Purpose, as is required of the Supplier or Client under clause 3.1. Nothing in this Agreement shall be construed as imposing a higher or more onerous standard of confidentiality on the Supplier or Client than on Entegri Connect in respect of equivalent categories of Confidential Information.

4. PLATFORM-SPECIFIC CONFIDENTIALITY

4.1 Pre-acceptance integrity. Prior to Bid acceptance, Supplier direct contact details are withheld from Client view in accordance with the Platform’s design. Neither party shall attempt to establish direct contact outside the Platform before Bid acceptance, and neither party shall disclose or solicit information for the purpose of circumventing the Platform’s Bid process.

4.2 Post-acceptance. Following Bid acceptance and the release of contact details, the identity, contact details, and commercial information of each party remain Confidential Information subject to this Agreement and the non-circumvention provisions of the relevant Platform Agreement. This obligation continues for five (5) years from the end of the relevant Engagement.

4.3 Engagement content. All Service Requirements, Bids, deliverables, working papers, and Client financial information exchanged through the Platform are Confidential Information of the highest sensitivity. The Receiving Party must not disclose them to any third party at any time. This obligation is perpetual.

4.4 No representation of Client relationships. Neither a Supplier nor a Client shall represent to any third party, including on its website, social media, marketing materials, in any pitch or proposal, or in any list of references, that it has provided or received services in connection with a counterparty introduced through the Platform, save with that counterparty’s express prior written consent on a case-by-case basis. This obligation continues for five (5) years from the end of the relevant Engagement.

4.5 Duration of platform-specific obligations. Clause 4.3 is perpetual and survives termination of this Agreement and any related Platform Agreement without limit. Clauses 4.2 and 4.4 continue for the period stated in each, running from the end of the relevant Engagement, rather than perpetually.

5. PERMITTED DISCLOSURES

5.1 A Receiving Party may disclose Confidential Information to the extent required by law, court order, or a request from SARS, the Information Regulator, IRBA, SAICA, SAIPA, SAIT, or another regulator acting within its lawful powers, or in connection with any legal proceedings between the parties to enforce this Agreement.

5.2 The Receiving Party must, to the extent legally permitted, give the Disclosing Party prompt prior written notice, limit disclosure to the minimum required, and cooperate with any efforts to limit or oppose the disclosure.

6. NON-USE AND NON-CIRCUMVENTION

6.1 Each party undertakes not to use Confidential Information received under this Agreement to approach, solicit, or contract with any counterparty introduced through the Platform, outside of the Platform, during the term of this Agreement and for twenty-four (24) months after the last Engagement with that counterparty. This obligation operates in parallel with, and not in substitution for, the non-circumvention provisions in the relevant Platform Agreement.

6.2 Neither party shall use Confidential Information to induce or attempt to induce any counterparty to terminate, reduce, or modify its relationship with the other party.

6.3 Nothing in this clause restricts either party from independently sourcing and contracting with parties not introduced through the Platform, or from conducting its ordinary business without use of the Confidential Information.

7. OWNERSHIP AND NO LICENCE

7.1 All Confidential Information remains the property of the Disclosing Party. Nothing in this Agreement grants any licence, right, or interest in or to any intellectual property of the Disclosing Party, save the limited right to use the Confidential Information for the Permitted Purpose.

7.2 No representation or warranty is made as to the accuracy, completeness, or suitability of any Confidential Information disclosed. Liability for any decision made by the Receiving Party in reliance on Confidential Information rests with the Receiving Party.

8. PERSONAL INFORMATION AND POPIA: ALLOCATION OF ROLES

8.1 This clause 8 allocates POPIA roles across the distinct processing contexts that arise on the Platform. The correct allocation determines whether Part B or Part C of this Agreement applies.

8.2 Platform registration and operation. Entegri Connect is the Responsible Party in respect of all Personal Information collected from Suppliers and Clients during registration and use of the Platform. Entegri Connect’s processing in this capacity is governed by the Platform Privacy Policy.

8.3 Marketplace Engagements, Supplier as Responsible Party. Where a Supplier performs an Engagement through the Platform in its own professional capacity, the Supplier is an independent Responsible Party in respect of all Personal Information processed in the course of that Engagement. The Supplier is independently responsible for compliance with POPIA in respect of such processing, including its own registration of an Information Officer, its own security safeguards under section 19 of POPIA, and its own breach notification obligations to the Information Regulator and affected Data Subjects. Part B and Part C do not apply to this processing.

8.3A Marketplace Engagements, Client as Responsible Party. Where a Client discloses Personal Information to a Supplier in the course of a Service Requirement or an Engagement, including Personal Information relating to its own directors, employees, customers, suppliers, and beneficial owners, the Client is an independent Responsible Party in respect of that Personal Information. The Client warrants that it has a lawful basis under POPIA, and where applicable under the GDPR, to make that disclosure, that the disclosure is compatible with the purpose for which the Personal Information was originally collected, and that it has given any notice required by section 18 of POPIA to the relevant Data Subjects. The Client is independently responsible for its own compliance obligations in respect of that Personal Information, including the appointment and registration of an Information Officer where required, its own security safeguards under section 19 of POPIA, and its own notification obligations under section 22. Neither Entegri Connect nor the Supplier is the Client’s Operator in respect of that Personal Information by reason only of receiving it through the Platform. Part B and Part C do not apply to this processing.

8.3B Workspace Documents, Entegri Connect as Operator. Where a Client or a Supplier uploads a document to an Engagement workspace on the Platform, Entegri Connect stores and makes that document available to the parties to the Engagement, and does so on their instructions and for their purposes. In respect of the content of Workspace Documents, Entegri Connect acts as an Operator and not as a Responsible Party. Entegri Connect will not access the content of a Workspace Document except as necessary to operate, secure, support, or back up the Platform, to scan it for malicious content, to comply with a lawful request, or on the instruction of a party to the Engagement. The terms on which Entegri Connect processes Workspace Documents as Operator are set out in Part C. For the avoidance of doubt, Entegri Connect remains the Responsible Party in respect of the metadata generated by the Platform in the course of storing a Workspace Document, including the identity of the uploading user, upload time, file name, and access records.

8.4 Platform Administration Data, recipient as Operator. Where Entegri Connect discloses Platform Administration Data to a Supplier or Client, the recipient acts as Operator on Entegri Connect’s documented instructions in respect of that data only. Part B applies to this processing, and to this processing only.

8.5 Related company. Entegri Enterprises (Pty) Ltd, registration number 2013/137202/07, a separate company related to Entegri Connect, may participate on the Platform as a Supplier. Where it does, it is a Supplier for all purposes of this Agreement, including clause 8.3, and is bound by this Agreement on the same terms as any other Supplier. Where an individual who works for both companies processes Personal Information while performing Platform operations, support or administration, they do so for Entegri Connect under a written operator agreement between the two companies.

8.6 Each party must process Personal Information received through the Platform only for the Permitted Purpose, in compliance with POPIA’s conditions for lawful processing, and subject to the security measures in Schedule 1.

8.7 The allocation of roles in this clause 8 is consistent with, and shall be interpreted alongside, the data protection provisions of the relevant Platform Agreement. In the event of conflict as to role allocation, the Platform Agreement prevails.

PART B: POPIA OPERATOR TERMS

Applicable only to Platform Administration Data under clause 8.4

Part B operationalises the obligations of a party acting as Operator in respect of Platform Administration Data. It does not apply to Personal Information processed by a Supplier as an independent Responsible Party under clause 8.3, by a Client as an independent Responsible Party under clause 8.3A, or to Workspace Documents under clause 8.3B, which are governed by Part C.

B1. SCOPE AND RELATIONSHIP TO PART A

B1.1 This Part B applies only where and to the extent that a Supplier or Client processes Platform Administration Data disclosed to it by Entegri Connect, in which case that party is the Operator and Entegri Connect is the Responsible Party.

B1.2 Where this Part B conflicts with Part A in respect of the protection of Personal Information, the provision affording greater protection to Data Subjects prevails.

B1.3 For the avoidance of doubt, nothing in this Part B converts a Supplier into an Operator in respect of Personal Information processed in the course of an Engagement. That processing is governed by clause 8.3, under which the Supplier is an independent Responsible Party.

B2. SCOPE OF PROCESSING

B2.1 Subject matter: administration of Platform accounts, facilitation of contact following Bid acceptance, and Platform communications.

B2.2 Duration: for the duration of the relevant Platform Agreement and any tail-period required for return, destruction, or legally-mandated retention.

B2.3 Nature and purpose: processing necessary to establish and maintain contact between introduced counterparties, administer Platform accounts, and maintain records of Platform communications.

B2.4 Categories of Personal Information: identification details, business and personal contact details, and Platform account and communications records. Special Personal Information shall not be Processed under this Part B unless specifically agreed in writing.

B2.5 Categories of Data Subjects: directors, employees, and authorised representatives of Suppliers and Clients registered on the Platform.

B3. OPERATOR OBLIGATIONS

B3.1 The Operator shall:

• Process Platform Administration Data only on Entegri Connect’s documented instructions and only for the Permitted Purpose;
• not Process Platform Administration Data for its own purposes, for marketing, or for any purpose unrelated to the Permitted Purpose;
• ensure that Authorised Personnel are bound by written confidentiality obligations no less protective than those in Part A, and receive appropriate POPIA or data-protection awareness and instruction for their role;
• limit access to Platform Administration Data to Authorised Personnel on a strict need-to-know basis;
• implement and maintain the technical and organisational security measures specified in section 19 of POPIA and Schedule 1;
• provide reasonable assistance to Entegri Connect in responding to Data Subject access requests, complaints to the Information Regulator, and impact assessments relating to Platform Administration Data;
• notify Entegri Connect of any binding legal request from a regulator, court, or revenue authority relating to Platform Administration Data before responding, where lawful to do so.

B4. SECURITY MEASURES

B4.1 The Operator shall implement, and keep current, the security measures set out in Schedule 1, which represent the minimum standard. The Operator shall periodically review and update these measures in light of evolving threats and the state of the art.

B4.2 The Operator shall not store Platform Administration Data on personal devices, removable media, or unencrypted cloud services, and shall apply multi-factor authentication to all access points capable of supporting it.

B5. SECURITY COMPROMISE NOTIFICATION

B5.1 The Operator shall notify Entegri Connect without undue delay, and in any event within twenty-four (24) hours, of becoming aware of any actual or reasonably-suspected Security Compromise affecting Platform Administration Data.

B5.2 Each notification shall, to the extent then known, identify the nature and scope of the Compromise, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the remedial steps taken or proposed.

B5.3 The Operator shall not notify the Information Regulator or affected Data Subjects in respect of Platform Administration Data without Entegri Connect’s prior written consent, save where required by law. The parties shall cooperate to enable Entegri Connect to fulfil its statutory notification obligations under section 22 of POPIA.

B5.4 For the avoidance of doubt, this clause B5 does not limit a Supplier’s independent obligation, as Responsible Party under clause 8.3, to notify the Information Regulator and affected Data Subjects of a Security Compromise affecting Personal Information processed in the course of an Engagement. That obligation rests with the Supplier alone. The Supplier shall additionally notify Entegri Connect and the affected Client within seventy-two (72) hours of becoming aware of any such Compromise, in accordance with the relevant Platform Agreement.

B6. SUB-OPERATORS

B6.1 The Operator shall not engage any Sub-Operator to Process Platform Administration Data without Entegri Connect’s prior written consent, which Entegri Connect may withhold or condition in its reasonable discretion.

B6.2 Where consent is given, the Operator shall impose on each Sub-Operator written terms no less protective than those in this Part B, and shall remain fully liable to Entegri Connect for the acts and omissions of each Sub-Operator as if they were its own.

B7. CROSS-BORDER TRANSFERS

B7.1 The Operator shall not transfer Platform Administration Data across the borders of the Republic of South Africa without Entegri Connect’s prior written consent, save where the transfer is made to a cloud service the Operator uses in the ordinary course of its own business and the requirements of section 72 of POPIA are met in respect of that service. The Operator shall on request identify each such service and the country in which it processes the data.

B7.2 Where a transfer is made, the Operator shall implement contractual, technical, and organisational measures sufficient to ensure that the Personal Information continues to enjoy a level of protection substantially similar to that required under POPIA. Where Personal Information originates in the European Economic Area or the United Kingdom and applicable law requires an additional transfer safeguard, the Operator shall put an appropriate lawful transfer mechanism in place before the transfer occurs, which may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or another legally recognised safeguard.

B7.3 The Operator acknowledges that Entegri Connect hosts the Platform outside the Republic of South Africa, in Frankfurt, Germany, on the bases set out in clause 11 of the Platform Privacy Policy, and that Platform Administration Data is therefore already processed outside South Africa before it is disclosed to the Operator. Nothing in this Part B requires the Operator to treat the fact of that hosting as a breach by Entegri Connect.

B8. AUDIT AND ASSURANCE

B8.1 The Operator shall, on reasonable written notice and not more than once per calendar year (save where there is a known Security Compromise or material non-compliance), permit Entegri Connect or its appointed auditor to inspect and audit the Operator’s Processing of Platform Administration Data, and the records and security measures relevant to this Part B.

B8.2 The Operator shall provide reasonable assistance to such audit, and shall promptly remediate any non-compliance identified, at its own cost.

B8.3 An audit under this clause B8 extends only to the Operator’s handling of Platform Administration Data. It does not entitle Entegri Connect to inspect Client working papers, Engagement deliverables, or any Personal Information processed by a Supplier as an independent Responsible Party under clause 8.3.

B8.4 An audit under this clause B8 shall be proportionate to the volume, sensitivity and risk of the Platform Administration Data actually held by the Operator. Where the nature and scale of the processing present a low risk, Entegri Connect may, in the first instance, accept a written self-assessment against Schedule 1, supported by such evidence as Entegri Connect reasonably requests, in place of an on-site or remote inspection. Entegri Connect may require a more detailed audit where the nature, volume or sensitivity of the processing, a security incident, or reasonable concerns regarding compliance justify it. Entegri Connect shall bear its own costs of an audit, save where the audit establishes material non-compliance, in which case the Operator shall reimburse Entegri Connect’s reasonable costs. An audit shall be conducted during business hours, on not less than fifteen (15) Business Days’ notice, and in a manner that does not unreasonably disrupt the Operator’s business.

B9. RETURN AND DESTRUCTION

B9.1 On termination of the relevant Platform Agreement, or on earlier written request by Entegri Connect, the Operator shall, at Entegri Connect’s election, return all Platform Administration Data in a structured, commonly-used, machine-readable format, or permanently destroy it by means appropriate to its sensitivity, and certify such return or destruction in writing within ten (10) Business Days.

B9.2 The Operator may retain Platform Administration Data solely to the extent required by applicable law, regulation, or its bona fide record-retention policies, in which case the obligations of this Part B continue to apply for as long as it is retained.

B9.3 Nothing in this clause B9 requires a Supplier to return or destroy Personal Information that it is required to retain as an independent Responsible Party under professional, regulatory, or statutory record-retention obligations arising from an Engagement.

B10. LIABILITY AND INDEMNITY

B10.1 Breach of this Part B by the Operator shall be deemed a breach of the relevant Platform Agreement.

B10.2 The Operator indemnifies Entegri Connect against all losses, damages, fines, penalties, and reasonable costs arising from any breach of POPIA or this Part B by the Operator or its Authorised Personnel or Sub-Operators, in respect of Platform Administration Data.

PART C: ENTEGRI CONNECT AS OPERATOR

Applicable only to Workspace Documents under clause 8.3B

C1. Scope

This Part C applies where Entegri Connect processes the content of Workspace Documents on behalf of a Client or a Supplier. In that context the uploading party is the Responsible Party and Entegri Connect is the Operator. Where the Responsible Party is established in the European Economic Area or the United Kingdom, or the processing is otherwise subject to the GDPR, this Part C is intended to satisfy Article 28(3) of the GDPR and is to be interpreted accordingly.

C2. Subject matter, duration, nature and purpose

Entegri Connect stores Workspace Documents, makes them available to the parties to the relevant Engagement, and backs them up and deletes them in accordance with clause 12 of the Platform Privacy Policy. Workspace Documents are also scanned for malicious content through Scanii before being made available to other users.

C3. Categories of data and Data Subjects

As determined by the Responsible Party, being whatever it chooses to upload. The Responsible Party warrants that it has a lawful basis to upload the content, and that it will not upload Special Personal Information, special category data, or information relating to a child without first notifying Entegri Connect in writing.

C4. Entegri Connect’s obligations

Entegri Connect shall:

1. (a)process Workspace Documents only on the documented instructions of the Responsible Party, which instructions are constituted by this Agreement, the applicable Platform Agreement, and the Responsible Party’s use of the Platform’s functions, and shall inform the Responsible Party if it believes an instruction infringes POPIA or the GDPR;
2. (b)not process Workspace Documents for its own purposes, and specifically shall not use them for marketing, for product development, for training any machine learning model, or to inform any Bid or engagement of Entegri Enterprises (Pty) Ltd;
3. (c)ensure that personnel authorised to access Workspace Documents are bound by written confidentiality obligations and receive appropriate data-protection and security awareness when access is granted;
4. (d)implement the technical and organisational measures described in the Information Security Statement and required by section 19 of POPIA and Article 32 of the GDPR;
5. (e)engage sub-operators only as listed in Annexure A to the Platform Privacy Policy, impose on each sub-operator terms no less protective than this Part C, remain fully liable for each sub-operator’s acts and omissions, and give the Responsible Party at least thirty (30) days’ notice of any intended change to that list so that the Responsible Party may object;
6. (f)assist the Responsible Party, taking into account the nature of the processing and by appropriate technical and organisational measures, to respond to requests from Data Subjects exercising their rights;
7. (g)assist the Responsible Party in complying with its obligations in respect of security, security compromise notification, and impact assessments;
8. (h)notify the Responsible Party without undue delay, and in any event within twenty-four (24) hours, of becoming aware of any Security Compromise affecting Workspace Documents;
9. (i)on termination, and at the Responsible Party’s election, return the Workspace Documents in a commonly used machine-readable format or delete them, in accordance with clause 12.2 of the Platform Privacy Policy, save to the extent retention is required by law; and
10. (j)make available to the Responsible Party the information necessary to demonstrate compliance with this Part C, and allow for and contribute to audits, which for these purposes shall in the first instance be satisfied by provision of the Information Security Statement and answers to a reasonable due diligence questionnaire.

C5. International transfers

The Responsible Party acknowledges that Entegri Connect processes Workspace Documents using Platform infrastructure located outside South Africa, including in Frankfurt, Germany, as further described in clause 10 of the Platform Privacy Policy, and instructs Entegri Connect to process Workspace Documents in those locations.

Where personal information is transferred to a country or recipient for which an applicable data-protection law requires additional safeguards, Entegri Connect shall ensure that an appropriate lawful transfer mechanism is in place before the transfer occurs. This may include, where applicable, the European Commission’s Standard Contractual Clauses, the United Kingdom International Data Transfer Agreement or Addendum, or another legally recognised safeguard.

Where such standard contractual terms are required for a particular Responsible Party or transfer, the parties shall complete and enter into the applicable terms, including any required annexures, schedules or transfer-risk documentation.

C6. Relationship to Part B

Part B and Part C address different data and different directions of processing. Part B governs the counterparty as Operator for Platform Administration Data disclosed by Entegri Connect. Part C governs Entegri Connect as Operator for Workspace Documents uploaded by the counterparty. Neither limits the other.

GENERAL PROVISIONS

9. RETURN AND DESTRUCTION OF CONFIDENTIAL INFORMATION

9.1 On termination of the relevant Platform Agreement, or on written request by the Disclosing Party, the Receiving Party shall return or permanently destroy all Confidential Information in its possession and certify such return or destruction in writing within ten (10) Business Days.

9.2 A Receiving Party may retain Confidential Information solely to the extent required by law or its bona fide record-retention policies, in which case the obligations of this Agreement continue to apply for as long as it is retained.

10. REMEDIES

10.1 The parties acknowledge that damages alone may be an inadequate remedy for breach of this Agreement. The Disclosing Party is entitled to seek interim and final interdictory relief, specific performance, and any other equitable remedy in respect of any actual or threatened breach.

10.2 The Receiving Party indemnifies the Disclosing Party against all losses, damages, costs (including legal costs on the attorney-and-own-client scale), fines, and penalties arising from any breach of this Agreement by the Receiving Party or its Representatives.

11. TERM AND SURVIVAL

11.1 This Agreement commences on the Effective Date and continues for as long as Party B is registered on the Platform. Clause 11.2 sets out the obligations that continue after that.

11.2 The obligations in this Agreement survive termination as follows: clauses 3, 5, 7, 9, 10, Part B and Part C, five (5) years from last disclosure; clauses 4.2 and 4.4, five (5) years from the end of the relevant Engagement; clause 4.3 and clause 6, perpetually; clause 8 in respect of Personal Information, perpetually or for the maximum period permitted by law.

11.3 Termination is without prejudice to any rights or remedies accrued prior to termination.

12. GENERAL

12.1 Entire Agreement. This Agreement constitutes the entire agreement between the parties in respect of confidentiality and POPIA obligations on the Platform. It continues in force in parallel with any Platform Agreement; in the event of conflict in respect of confidentiality, this Agreement prevails, and in respect of POPIA role allocation, the Platform Agreement prevails. In respect of Entegri Connect’s processing of Workspace Documents, Part C prevails over any inconsistent provision of a Platform Agreement.

12.2 Variation. No variation is effective unless in writing and signed by both parties, save for revisions made by Entegri Connect on written notice in accordance with the applicable Platform Agreement.

12.3 No Waiver. No failure or delay in exercising any right operates as a waiver.

12.4 Assignment. Neither party may assign or cede this Agreement without the prior written consent of the other, save that Entegri Connect may assign or cede to any Affiliate or successor in title.

12.5 Notices. Notices shall be in writing and delivered to the email addresses recorded in the Schedule of Parties. Notice is deemed given on the next Business Day, absent a delivery failure notification.

12.6 Governing Law. This Agreement is governed by the laws of the Republic of South Africa. The parties consent to the non-exclusive jurisdiction of the High Court of South Africa, Gauteng Division, Johannesburg.

12.7 Dispute Resolution. The parties shall attempt in good faith to resolve any dispute by mediation under AFSA rules. Failing resolution within thirty (30) days, the dispute shall be referred to final and binding arbitration under the AFSA Commercial Arbitration Rules in Johannesburg before a single arbitrator. Either party may approach a court of competent jurisdiction at any time for interim or interdictory relief.

12.8 Independent Contractors. Nothing in this Agreement creates any agency, partnership, joint venture, or employment relationship between the parties.

12.9 Electronic Signatures. This Agreement may be signed electronically and in counterparts. Electronic signatures are valid and binding.

12.10 Severability. If any provision is invalid or unenforceable, the remainder continues in full force.

SCHEDULE 1: MINIMUM TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

Each party must implement and maintain, at minimum, the following measures in respect of all Personal Information and Confidential Information processed in connection with the Platform.

A. Access Control

• Role-based access on a need-to-know basis, reviewed periodically and whenever a person’s role or access requirements change.
• Multi-factor authentication on all administrative and remote-access accounts.
• Strong password policy (minimum 12 characters, complexity, no reuse) with rotation on suspected compromise.

B. Data Protection in Transit and at Rest

• TLS 1.2 or higher for all data in transit.
• Full-disk encryption (AES-256 or equivalent) on all devices used to process Personal Information.
• Encrypted backups stored separately from primary systems.

C. Network and Endpoint Security

• Up-to-date anti-malware and endpoint detection on all devices.
• Patch management programme with critical patches applied within 14 days of release.
• Secure configuration baselines for laptops, mobile devices, and servers.

D. Operational Controls

• Documented incident response plan with a named Information Officer and escalation path.
• Personnel handling Personal Information are required to comply with applicable privacy, confidentiality and information-security requirements and are made aware of their responsibilities when access is granted.
• Audit logs of access to Personal Information, retained for at least 12 months.
• Secure destruction of paper and electronic media (cross-cut shredding or cryptographic erasure).
• Where an AI or machine learning service is used to process Personal Information, it must be a commercial tier under which the provider is contractually prohibited from using submitted content to train or improve its models. Free and consumer tiers must not be used.

E. Vendor and Sub-Operator Management

• Documented register of all Sub-Operators engaged in respect of Platform Administration Data, with prior written approval from Entegri Connect.
• Written data-protection terms back-to-back with Part B imposed on each Sub-Operator.