Data Processing Agreement

The purpose of this DPA is to establish the responsibilities of ReviveX and the Client when ReviveX processes personal information on behalf of the Client.

The DPA is intended to support compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable data-protection requirements.

The DPA addresses matters including:

• Processing instructions
• Confidentiality
• Security
• Client data
• Data-subject requests
• Security compromises
• Subprocessors
• International processing
• Data return and deletion
• Compliance assistance

For processing covered by this DPA:

This DPA does not make ReviveX the owner of the Client's personal information.

Not all personal information processed by ReviveX is Client-controlled data.

ReviveX may act as a Responsible Party for personal information processed for ReviveX's own legitimate business purposes, including information relating to:

• ReviveX Clients
• Billing
• Account administration
• ReviveX sales enquiries
• Website visitors
• ReviveX marketing
• Business administration
• Legal and compliance records
• ReviveX support contacts

Processing for ReviveX's own purposes is governed by the ReviveX Privacy Policy rather than solely by this DPA.

For purposes of this DPA:

The personal information processed by ReviveX will depend on the service selected by the Client.

Services may include:

• ReviveX CRM
• Website Conversion
• Inbound Call Conversion
• Speed-to-Lead
• Database Reactivation
• Reputation Conversion
• Workflow automation
• Communication workflows
• Appointment workflows
• CRM configuration
• Custom AI assistants
• Custom applications
• Integrations
• Reporting
• Related implementation services

Only information reasonably necessary for the agreed service should be processed.

ReviveX will process Client-controlled personal information only:

• With the Client's knowledge or authorisation
• According to documented Client instructions
• For purposes connected to the agreed service
• Where required to perform the service
• Where otherwise required or permitted by applicable law

Documented instructions may include:

• Service Agreements
• Proposals
• Order Forms
• Statements of Work
• Workflow documentation
• Configuration instructions
• Written Client requests
• Approved implementation settings

ReviveX will not intentionally use Client-controlled personal information for unrelated purposes of its own.

ReviveX is not required to carry out an instruction that it reasonably believes would:

• Breach applicable law
• Violate privacy rights
• Breach a third-party platform's lawful requirements
• Create an unreasonable security risk
• Facilitate fraud or abuse
• Process unlawfully obtained data
• Violate an applicable opt-out or objection
• Create another material compliance risk

Where reasonably possible, ReviveX will explain the concern to the Client and work with the Client to identify an appropriate alternative.

The Client is responsible for ensuring that it has a lawful basis for collecting and processing Client Data.

This includes responsibility for:

• Appropriate privacy notices
• Consent where required
• Contractual authority where applicable
• Legitimate processing grounds where permitted
• Direct-marketing compliance
• Opt-out management
• Database lawfulness
• Industry-specific requirements
• Special personal information
• Children's information where applicable
• Appropriate retention periods

ReviveX does not independently create a lawful basis for processing information merely by providing technology.

Where a Client provides personal information for:

• Database Reactivation
• CRM import
• Lead follow-up
• Messaging
• Marketing
• Campaign activity
• Contact management

the Client confirms that it is legally entitled to provide the information to ReviveX and instruct ReviveX to process it.

The Client must not instruct ReviveX to process:

• Stolen data
• Unlawfully obtained data
• Data acquired in breach of applicable law
• Contact lists where the Client has no lawful processing basis
• Information subject to an applicable objection or opt-out where continued processing would be unlawful

ReviveX may request information about the origin or lawful use of a database where a reasonable compliance concern exists.

Where ReviveX sends or facilitates marketing or re-engagement communications on behalf of the Client, the Client remains responsible for establishing the lawful basis for those communications.

The Client is responsible for determining whether:

• Consent is required
• An existing-customer relationship permits communication
• A communication is lawful
• An opt-out must be honoured
• An objection must be respected
• Industry-specific marketing restrictions apply

ReviveX may provide technical tools to support:

• Consent records
• Opt-outs
• Suppression
• Unsubscribe processes
• Workflow exclusions

but these tools do not replace the Client's underlying legal responsibilities.

ReviveX will treat Client-controlled personal information as confidential.

Personnel, contractors and authorised parties who require access to such information should:

• Access it only where reasonably required
• Use it only for authorised purposes
• Be subject to appropriate confidentiality obligations
• Avoid unauthorised disclosure

ReviveX will not disclose Client-controlled personal information except:

• According to Client instructions
• As necessary to deliver the agreed service
• To authorised subprocessors
• Where required by applicable law
• Where otherwise lawfully permitted

ReviveX will take reasonable steps to limit access to Client Data to personnel or contractors who require that access for legitimate purposes.

Access may be necessary for:

• Implementation
• Configuration
• Support
• Troubleshooting
• Security
• Development
• Optimisation
• Client-requested changes

Access should be proportionate to the relevant role and requirement.

ReviveX will establish and maintain reasonable technical and organisational safeguards appropriate to:

• The nature of the information
• The nature of the processing
• The technology involved
• The risks reasonably identifiable
• ReviveX's role as Operator

Measures may include, where appropriate:

• Access controls
• Authentication
• Role-based permissions
• Password controls
• Secure cloud platforms
• Restricted administrative access
• Logging
• Encryption where supported and appropriate
• Backup measures
• Security monitoring
• Vendor controls
• Confidentiality requirements
• Software updates
• Credential-management practices
• Security incident processes

No internet-connected system can be guaranteed to be completely secure.

This DPA does not create a warranty that security incidents can never occur.

Security is a shared responsibility.

The Client is responsible for reasonable security measures relating to Client-controlled access, including:

• Protecting login credentials
• Using strong authentication
• Controlling staff access
• Removing former-user access
• Limiting administrator access
• Keeping Client devices secure
• Protecting connected systems
• Promptly reporting suspected compromise
• Avoiding insecure credential sharing

ReviveX is not responsible for a compromise caused solely by the Client's failure to maintain reasonable account or device security, except where ReviveX is otherwise legally responsible.

Where ReviveX has reasonable grounds to believe that Client-controlled personal information has been accessed or acquired by an unauthorised person, ReviveX will notify the Client in accordance with applicable law.

Where ReviveX acts as Operator, ReviveX will notify the Client immediately when the legal threshold for such notification is met.

The notification may initially contain information reasonably available at that time and may be supplemented as further facts become known.

ReviveX will take reasonable steps to:

• Investigate the incident
• Contain the incident where possible
• Mitigate reasonably identifiable risks
• Preserve relevant information
• Cooperate with the Client
• Provide relevant information reasonably required for the Client's legal response

Where the Client is the Responsible Party, the Client generally remains responsible for determining whether notification must be made to:

• Affected Data Subjects
• The Information Regulator
• Other regulators
• Contractual counterparties

ReviveX will provide reasonable assistance where the Security Compromise relates to processing performed by ReviveX.

Nothing prevents ReviveX from making a notification itself where ReviveX is legally required to do so.

Data Subjects may have rights relating to personal information, including rights concerning:

• Access
• Correction
• Deletion or destruction where appropriate
• Objection
• Direct marketing
• Processing information

Where ReviveX receives a request concerning Client-controlled personal information, ReviveX may:

• Notify the Client
• Refer the requester to the Client
• Assist the Client in responding
• Take another legally appropriate step

ReviveX will not ordinarily determine the Client's substantive response to a Data Subject request where the Client is the Responsible Party.

Taking into account the nature of the processing and the capabilities of the relevant technology, ReviveX will provide reasonable assistance to the Client in responding to valid Data Subject requests relating to Client Data.

Additional work may be separately chargeable where a request requires substantial:

• Data extraction
• Development
• Custom reporting
• Manual review
• Data transformation

unless such assistance is required to be provided without additional charge under applicable law or the agreed service.

Where instructed by the Client and legally appropriate, ReviveX will use reasonable available functionality to:

• Correct information
• Update information
• Delete information
• Restrict processing
• Apply suppression
• Support lawful retention requirements

Technical limitations or backup cycles may affect the timing of complete deletion from all underlying systems.

The Client is responsible for determining appropriate retention periods for Client-controlled personal information.

ReviveX may retain information where reasonably necessary to:

• Deliver the service
• Comply with Client instructions
• Maintain backups
• Resolve disputes
• Maintain security records
• Meet legal requirements
• Meet legitimate platform requirements

ReviveX should not intentionally retain Client Data indefinitely where there is no lawful or operational reason to do so.

On termination of the relevant ReviveX service, Client Data will be handled according to:

• Client instructions
• Platform functionality
• Applicable law
• The Service Agreement
• These terms
• Legitimate retention requirements

Where technically practicable and reasonably requested, the Client may be given an opportunity to export relevant Client Data before access is terminated.

Following termination and subject to applicable law, ReviveX may:

• Return Client Data
• Make Client Data available for export
• Delete Client Data
• Arrange for Client-controlled data to remain within a transferred or retained Client environment where agreed

The appropriate method will depend on:

• The service
• The underlying platform
• The agreed commercial arrangement
• Technical capability
• Legal retention obligations

Custom migration or transformation work may be separately chargeable.

Deleted data may remain temporarily within protected system backups until those backups rotate or expire.

Backup copies should not be restored or used for ordinary business purposes after deletion except where:

• Required for legitimate disaster recovery
• Required by law
• Necessary for security investigation
• Otherwise lawfully justified

ReviveX may use third-party service providers to deliver part of the ReviveX service.

These providers may process Client-controlled personal information on behalf of ReviveX.

Examples of services potentially supplied by subprocessors include:

• Cloud hosting
• CRM infrastructure
• AI models
• Telephony
• Voice technology
• Email
• SMS
• WhatsApp connectivity
• Automation
• Calendar infrastructure
• Data storage
• Security
• Analytics necessary to operate the service

Do not list a specific provider here unless it has been verified as currently used.

A current or representative list may be published on the ReviveX Subprocessors & Data Handling page.

Where a subprocessor processes Client-controlled personal information on ReviveX's behalf, ReviveX will seek to ensure that the relevant contractual or provider arrangement contains protections appropriate to:

• Confidentiality
• Security
• Data processing
• Applicable law

ReviveX remains responsible for its own obligations under this DPA notwithstanding the use of subprocessors, subject to applicable law and the relevant third-party arrangement.

Technology providers may change over time.

ReviveX may:

• Add providers
• Replace providers
• Remove providers
• Change infrastructure

where reasonably necessary to deliver, improve or maintain the service.

Material changes affecting Client-controlled personal information should be handled transparently where reasonably practicable.

Clients with specific vendor or data-location requirements should communicate those requirements before implementation.

Some ReviveX subprocessors or technology providers may process or store personal information outside South Africa.

Where cross-border transfer or processing takes place, ReviveX and the Client will seek to ensure that it is handled consistently with applicable data-protection law.

This may involve reliance on:

• Applicable foreign law providing appropriate protection
• Binding contractual safeguards
• Client instructions
• Consent where legally appropriate
• Another lawful transfer mechanism

Do not claim that all ReviveX data is stored exclusively in South Africa unless that has been specifically verified for the relevant service.

The Client must inform ReviveX before implementation if the Client requires:

• Data to remain within a particular country
• Specific hosting regions
• Specific vendor restrictions
• Specific contractual transfer provisions
• Industry-specific localisation

ReviveX will assess whether those requirements can be supported.

A requirement not disclosed before implementation may require:

• Reconfiguration
• Provider changes
• Additional cost
• A different technical approach

The Client must identify where a ReviveX workflow will process special personal information.

The Client remains responsible for establishing that such processing is legally permitted.

ReviveX may require additional:

• Safeguards
• Restrictions
• Workflow changes
• Human review
• Contractual provisions

before accepting such processing.

ReviveX may refuse an implementation where the risk cannot reasonably be managed.

The Client must inform ReviveX if a proposed service is expected to process personal information relating to children.

Such processing should not proceed until the parties have considered:

• Applicable legal requirements
• Necessary authorisation
• Appropriate safeguards
• The purpose of processing
• Whether the proposed workflow is suitable

Some ReviveX services use artificial intelligence or automated processing.

The Client acknowledges that automated systems may:

• Categorise information
• Analyse intent
• Produce responses
• Trigger workflows
• Update records
• Route enquiries
• Support qualification

The Client remains responsible for deciding whether a proposed automated workflow is appropriate for its business and legal context.

ReviveX services should not be configured to make solely automated decisions that have significant legal or similarly substantial effects on a Data Subject unless:

• The processing is lawful
• The Client has authorised the workflow
• Appropriate safeguards have been considered
• Applicable data-subject rights are respected

Where appropriate, human review should be included.

Where Client Data is processed through AI technology:

• Only information reasonably required for the relevant function should be submitted
• ReviveX will use the technology according to the relevant service configuration and provider arrangements
• Client Data must not intentionally be used by ReviveX for unrelated purposes

Specific AI-provider data-handling arrangements may depend on the technology used for the particular service.

Do not make blanket claims that no AI provider ever retains or processes information unless verified for every relevant implementation.

Clients with restrictions concerning the use of:

• Personal information
• Confidential information
• Special personal information
• Proprietary information
• AI providers

must communicate those restrictions before implementation.

ReviveX will assess whether the requested workflow can be configured accordingly.

Each party is responsible for maintaining records and documentation required for its own legal obligations.

ReviveX may maintain information concerning:

• Services provided
• Processing activities
• Subprocessors
• Security controls
• Client instructions
• Security incidents
• Data-subject requests

where reasonably required.

On reasonable request, ReviveX will provide information reasonably necessary to demonstrate compliance with ReviveX's obligations as Operator under this DPA.

This may include relevant information concerning:

• Processing arrangements
• Security measures
• Subprocessors
• Data-handling procedures

ReviveX is not required to disclose:

• Another Client's confidential information
• Security information that would create additional risk
• Proprietary source code
• Trade secrets unrelated to the compliance request
• Information prohibited from disclosure by law or contract

Where reasonably necessary to verify compliance with this DPA, the parties may agree on an appropriate review or audit process.

Any review should:

• Be proportionate to the identified risk
• Avoid unreasonable disruption
• Protect other Clients' confidentiality
• Protect security
• Be conducted during reasonable times
• Use existing certifications, reports or documentation where suitable before requiring intrusive access

Where a Client requires an extensive bespoke audit that is not caused by an identified ReviveX breach, reasonable costs may be agreed in advance.

Nothing in this clause restricts a lawful audit or investigation by an authorised regulator.

Each party will reasonably cooperate with the other where required in connection with:

• Information Regulator enquiries
• Lawful regulatory investigations
• Data-subject matters
• Security incidents
• Data-protection compliance

Each party remains responsible for its own legal obligations.

ReviveX may disclose Client Data where required by:

• Law
• Court order
• Valid regulatory process
• Another legally binding requirement

Where legally permitted, ReviveX may notify the Client of such a request.

ReviveX will not intentionally disclose more Client Data than reasonably required by the lawful demand.

The Client is responsible for the accuracy and quality of personal information supplied to ReviveX.

ReviveX may update or modify information according to:

• Client instructions
• Data Subject input
• Workflow activity
• Authorised system behaviour

ReviveX is not responsible for inaccuracies already present within Client-provided databases unless ReviveX causes or contributes to the inaccuracy.

The parties should seek to process only personal information reasonably adequate, relevant and not excessive for the identified purpose.

Where possible, ReviveX workflows should avoid requesting unnecessary personal information.

Client-controlled personal information should be processed only for the agreed and lawful purpose.

If the Client wishes to use the information for a materially different purpose, the Client is responsible for determining whether that further processing is lawful.

Where information has been genuinely de-identified so that it can no longer reasonably be linked to an identifiable Data Subject, it may no longer constitute personal information under applicable law.

ReviveX may use genuinely de-identified or aggregated information for legitimate purposes such as:

• System performance
• Technical improvement
• General reporting
• Service analysis

provided that such use does not unlawfully identify the Client or individual Data Subjects.

Do not treat merely pseudonymised information as automatically de-identified.

As between ReviveX and the Client:

Client Data remains the Client's data.

Nothing in this DPA transfers ownership of Client Data to ReviveX.

ReviveX may process that information only as permitted under:

• This DPA
• The Service Agreement
• Client instructions
• Applicable law

This DPA governs personal-information processing and does not transfer ownership of:

• ReviveX software
• Workflows
• Templates
• Prompt frameworks
• Platform architecture
• Automation methods
• General know-how
• Reusable components
• ReviveX intellectual property

Custom-development ownership is governed by the applicable Service Agreement or Statement of Work.

Liability relating to this DPA will be governed by:

• Applicable law
• The Client's Service Agreement
• The ReviveX Service Terms

Nothing in this DPA excludes liability that may not legally be excluded.

Do not insert a separate arbitrary liability cap into this DPA unless expressly approved.

This DPA takes effect when:

• The Client accepts a ReviveX service incorporating it
• The parties sign a separate DPA
• The DPA is otherwise validly incorporated into the Client agreement

It remains effective for as long as ReviveX processes Client-controlled personal information under the applicable service.

Relevant confidentiality, deletion, retention and legal obligations may survive termination where appropriate.

ReviveX may update the generally published form of this DPA where required because of:

• Legal changes
• Technology changes
• Service changes
• Subprocessor changes
• Operational changes

Updates should not retrospectively remove material contractual protections already agreed with an existing Client.

Where a Client has signed a specific negotiated DPA, that negotiated document continues to apply according to its own terms.

For matters relating specifically to Client-controlled personal information, this DPA takes precedence over inconsistent general provisions of the ReviveX Service Terms unless:

• The Client and ReviveX have expressly agreed otherwise in writing
• Applicable law requires otherwise

A signed negotiated DPA will take precedence over this standard published DPA where the two differ.

This DPA is governed by the laws of the Republic of South Africa.

The parties remain subject to applicable data-protection legislation and the jurisdiction of competent regulatory authorities and courts.

Operator:

Christopher Parry Photography (Pty) Ltd
Trading as ReviveX International

Registration Number: 2015/179935/07

Legal Status: Private Company

Country of Registration: Republic of South Africa

Physical Address:
626 32nd Avenue
Villieria
Pretoria
Gauteng
0186
South Africa

Email: chris@revivex.co.za

Telephone: +27 84 511 7736

Website: revivex.co.za

Privacy and data-processing enquiries may be directed to:

Information Officer

Christopher Parry Photography (Pty) Ltd
Trading as ReviveX International

Information Officer: [INSERT VERIFIED INFORMATION OFFICER NAME]

Email: chris@revivex.co.za

Telephone: +27 84 511 7736

Do not invent the Information Officer. Leave the placeholder until the registered Information Officer has been confirmed.

Where this DPA is incorporated into a Client agreement, the Client's details will be those contained in the applicable:

• Order Form
• Proposal
• Service Agreement
• Statement of Work
• Account record

A separately signed DPA may include a specific signature block and Client legal details.

The public website version does not require every Client to be named individually.

Security measures may include, as appropriate:

• Logical access controls
• Authentication
• User-permission management
• Confidentiality obligations
• Secure infrastructure
• Security updates
• Controlled administrative access
• Logging
• Backup measures
• Incident-management procedures
• Vendor-management practices
• Encryption where supported and appropriate
• Credential-management practices
• Reasonable internal security procedures

The specific safeguards applicable to an implementation depend on the architecture, platforms and services involved. This schedule does not constitute a representation that every listed control applies identically to every ReviveX service.

The current technology providers that may process Client-controlled personal information are maintained on the ReviveX Subprocessors & Data Handling page.

This Data Processing Agreement should be read alongside the following documents:

• Privacy Policy
• Website Terms of Use
• PAIA Manual
• Cookie Policy
• Service Terms
• AI Use & Limitations
• Acceptable Use Policy
• Subprocessors & Data Handling