POPIA Operator Agreement
Under South Africa's Protection of Personal Information Act, 2013 (POPIA), a business that has someone else process personal information for it must have a written contract with them (sections 20 and 21). This is that contract between each Tafel client and Tafel. It forms part of our Terms of Service and applies from the day your system is set up.
1. Who does what
- You, the client, are the responsible party. You decide why and how personal information about your guests, passengers, partners, chauffeurs and staff is processed in your Tafel system.
- Tafel is your operator. We process that information only to host, run, support and update your system, on your instructions, and for no purpose of our own.
Your instructions are these terms, the settings and features you choose in your system, and anything else the owner of your system (or someone they authorise) asks of us in writing.
2. The information involved
| Whose information | What it usually includes |
|---|---|
| Guests and passengers | Names, phone numbers, email addresses, flight numbers, pick-up and drop-off places and times, number of passengers, special requests, booking and payment references |
| Clients and partners (hotels, agents, DMCs, corporate accounts) | Contact people's names, phone numbers and email addresses, billing details |
| Chauffeurs | Names, phone numbers, vehicle assignments, job status updates, and vehicle or phone location while on duty |
| Your staff | Names, work email addresses, roles, and a record of what they do in the system (the audit trail) |
Card numbers never pass through Tafel: guests pay on your payment gateway's own secure page. You agree not to enter special personal information (such as health or religious details) or information about children unless it's needed for a trip, and then only as much as is needed.
3. What we commit to
- Purpose: we process the information only for the services in our Terms of Service, and only on your instructions. If an instruction would break the law, we'll tell you.
- Confidentiality: only Tafel people who need access to support or maintain your system get it, and they are bound to keep it confidential (section 20).
- Security (section 19): we keep the information safe with appropriate, reasonable technical and organisational measures, including:
- your own server, kept apart from other clients' systems, in South African data centres;
- encryption in transit (https) and at rest, including encrypted nightly backups;
- sign-in through Microsoft 365, Google Workspace, or a password plus a one-time code, with roles that limit what each person sees;
- an audit trail of who saw and changed what, and records of failed sign-ins and lock-outs;
- regular updates and security fixes.
- Breaches (section 21(2)): if we have reasonable grounds to believe someone has accessed or acquired your personal information without authority, we'll tell you without undue delay, and within 48 hours of becoming aware of it. We'll give you what we know so you can notify the Information Regulator and the people affected, and help you contain it.
- Helping you meet POPIA: we help you answer requests from people to see, correct or delete their information. Your system already lets you export one person's information and anonymise it, and clears out old personal details automatically on the schedule you set.
4. Where the information is kept
Your system and its backups are hosted by Microsoft Azure in its South African data centres (Johannesburg, and Cape Town where you choose it or for a Fleet plan's second-city backup copy). We don't move your information outside South Africa.
When you switch on an outside service, such as Google Maps, AeroDataBox flight data, Webfleet, WhatsApp Business, your email provider, your payment gateway or your accounting package, the system sends that service only the information it needs. You choose these services and hold the accounts with them, so they act for you, not for us. Some are based outside South Africa. Before switching one on, make sure your own agreement with it meets POPIA, including section 72 on cross-border transfers. Your system's Settings → Privacy & security shows which services are on and what each receives.
5. Our own sub-operators
The only provider we use to process your information is our hosting provider, Microsoft Azure, which is bound by its own data protection terms. If we want to add or replace a sub-operator, we'll tell you at least 30 days in advance. If you object on reasonable grounds and we can't resolve it, you may cancel without penalty before the change.
6. Checking our compliance
Once a year, or after a breach, you may ask us for the information you reasonably need to confirm we're keeping to this agreement, and we'll answer within 30 days.
7. When the subscription ends
We give you a full export of your data on request within 30 days. After that we delete your system, its data and its backups, including any backup copy in a second city, unless the law requires us to keep something. We'll confirm the deletion in writing if you ask.
8. Your responsibilities as responsible party
- Have a lawful reason for the information you collect, and collect only what you need.
- Tell people how you use their information. Add your privacy policy and Information Officer's details in Settings so the system shows them on your booking form and client portal.
- Register your Information Officer with the Information Regulator.
- Manage who has access to your system, and remove people who leave.
9. General
This agreement lasts as long as we hold your information. On personal information it takes priority over the Terms of Service. Otherwise the Terms of Service apply, including the limits on liability, except where the law doesn't allow them to be limited. South African law applies.
Contact for anything in this agreement: our Information Officer, Ryno Terblanche, at sales@gettafel.co.za.