Operator agreement

Last updated [date]. Version 1.0.

This agreement is between your agency (the responsible party) and [Company name] (Pty) Ltd, registration number [registration number], trading as Mennula (the operator). It is the written contract that sections 20 and 21 of the Protection of Personal Information Act (POPIA) require when one party processes personal information for another. It forms part of our Terms of service, and you accept it with them. Words such as "personal information", "processing", "data subject", "special personal information" and "security compromise" mean what they mean in POPIA.

1. What this agreement covers

It covers all personal information that your agency, its users or its candidates put into Mennula, or that Mennula collects for you, such as CVs received in your connected mailbox. Annex A describes the processing.

2. We only act on your instructions

• We process your personal information only to provide Mennula to you, as you instruct. Your instructions are your use of Mennula's features and settings, these terms, and any written instructions you send us.
• We don't use your personal information for our own purposes, sell it, or use it to train AI.
• If we think an instruction breaks POPIA or another law, we will tell you and may refuse to follow it.
• If the law requires us to disclose your information, we will tell you first unless the law forbids it.

3. Confidentiality

Everyone who works on Mennula is bound to keep your information confidential. Our staff can only see your agency's information when an admin at your agency gives us access for a set time, for example to help with a problem, and every look is written to your audit log.

4. Security

We keep appropriate, reasonable technical and organisational measures in place to protect your personal information against loss, damage, unauthorised access and unlawful processing, as section 19 of POPIA requires. Annex B lists them. We review them at least once a year and when we change how Mennula works.

5. Sub-operators

• You authorise us to use the sub-operators listed in Annex C.
• We will email you at least 30 days before adding or replacing a sub-operator. If you object on reasonable data protection grounds and we can't resolve it, you may cancel without penalty before the change takes effect.
• Every sub-operator is bound by a written agreement that protects your information at least as well as this one. We remain responsible to you for what they do.
• Services you choose to connect, such as your own mailbox provider, single sign-on or job boards, are your providers, not our sub-operators.

6. Information sent outside South Africa

Your information is stored in South Africa. We only send it abroad to the sub-operators in Annex C that are outside South Africa, and only the minimum each step needs. Before any CV text goes to our AI provider, we remove names, phone numbers, email addresses, ID numbers, street addresses and places that could identify someone. Each of these sub-operators is bound by an agreement that gives protection substantially similar to POPIA, as section 72 requires.

7. Helping with requests from data subjects

• Mennula gives you tools to answer requests to access, correct, delete or object: the candidate's page, exports, and the self-service link each candidate receives.
• If a data subject contacts us directly about your records, we will pass the request to you within 5 business days and won't answer it ourselves unless you ask us to.
• Data subjects may make requests free of charge through simple channels such as email and WhatsApp. We will help you meet this, and Mennula confirms to the person when a correction or deletion is done.

8. Security compromises

• If we have reasonable grounds to believe your personal information has been accessed or acquired by someone not authorised to do so, we will tell you without undue delay, and within 48 hours of becoming aware of it.
• We will tell you what happened, what information and how many people are likely affected, what we have done to contain it, and who to contact. We will update you as we learn more.
• We will help you notify the Information Regulator and the people affected, as section 22 of POPIA requires, and we will keep a record of the incident.

9. Special personal information, children and automated decisions

• By default, Mennula removes lines that state race, religion, health, disability, sex life, marital status and similar details before scoring, and never asks the AI for them. Optional employment equity fields are off unless you switch them on, and are stored encrypted.
• Mennula is not designed for information about people under 18. You agree not to upload it without a parent or guardian's consent.
• Mennula does not make decisions about data subjects on its own. Scores are advice to your staff, and every message needs a person's approval, consistent with section 71 of POPIA.

10. Keeping and deleting information

• Candidates with no activity for 24 months are deleted automatically, after a warning to you 30 days before. You can delete any record at any time.
• When your plan ends, you can download everything. 30 days later we delete your agency's database, files and encryption key, and backups are overwritten within 35 days after that. We will confirm deletion in writing if you ask.
• We keep only what the law requires us to keep, such as invoices, and nothing about your candidates.

11. Showing that we comply

We will give you the information you reasonably need to show that we meet this agreement, such as answers to a security questionnaire, once a year or after a security compromise. If you need more, you may arrange an audit with 30 days' written notice, at your cost, in a way that protects other agencies' information. We will cooperate with the Information Regulator.

12. Your responsibilities

You are responsible for having a lawful basis for the personal information you put into Mennula, for giving data subjects the notices POPIA requires (Mennula sends a standard notice on your behalf when a candidate is added by someone else), for keeping the information accurate, and for making sure your instructions are lawful.

13. Responsibility and how long this lasts

The limits of responsibility in our Terms of service apply, except where the law does not allow them. This agreement lasts for as long as we process personal information for you, including the deletion period after your plan ends. If it conflicts with the Terms of service on data protection, this agreement wins.

Annex A: The processing

Annex B: Security measures

• All servers, databases, files and backups are in South Africa: xneelo in Johannesburg, and encrypted backup copies with Amazon Web Services in Cape Town.
• Each agency has its own database, its own database login and its own encryption key. One agency's information can never appear in another's account.
• Files and sensitive fields (such as ID numbers and employment equity fields) are encrypted with AES-256. All connections use HTTPS.
• Uploaded files are virus-scanned before they are read.
• Names, contact details, ID numbers, street addresses and identifying places are removed before any text goes to the AI provider. The AI provider is asked not to keep it.
• Sign-in uses one-time links or your Microsoft or Google account. Sessions expire, and removed users lose access at once.
• Staff access only with your admin's time-limited approval, written to your audit log.
• Nightly encrypted backups kept for 35 days, with restores tested regularly.
• Monitoring and alerts for outages and unusual activity, security updates at least monthly, and a written incident plan.
• Logs never contain CV text or message content.

Annex C: Sub-operators