Data Processing Agreement

This Data Processing Agreement (DPA) applies where an organisation uses Ovanta to process personal information for which that organisation determines the purpose and means of processing.

Ovanta is a product and service owned and operated by Lnq Group Technologies (Pty) Ltd. For purposes of this DPA, the organisation using Ovanta is generally the responsible party and Lnq Group Technologies (Pty) Ltd, through Ovanta, is generally the operator, to the extent those terms apply under the Protection of Personal Information Act, 2013 (POPIA).

This DPA forms part of the Ovanta Terms of Service and any applicable subscription or written service agreement between the organisation and Lnq Group Technologies (Pty) Ltd.

Lnq Group Technologies will process personal information on behalf of an organisation only as reasonably necessary to provide, secure, maintain, support and improve the Ovanta service, to comply with documented lawful instructions from the organisation, or where processing is required by applicable law.

The organisation is responsible for ensuring that its instructions and its use of Ovanta comply with applicable law and that it has an appropriate lawful basis for personal information placed in its workspace.

The organisation must not instruct Ovanta to process personal information in a manner that is unlawful or outside the intended business-management purposes of the platform.

Processing may include hosting, storing, organising, retrieving, displaying, transmitting, backing up, securing, supporting, exporting and deleting information submitted to or generated within an organisation's Ovanta workspace.

Information may relate to authorised users, employees, customers, suppliers, contacts and other individuals whose information the organisation lawfully places in Ovanta.

The categories of information depend on how the organisation uses Ovanta and may include names, contact details, organisation information, user roles, transaction references, supplier or customer records, support information and other operational data described in the Ovanta Privacy Policy.

Lnq Group Technologies will take reasonable steps to ensure that personnel authorised to access personal information are subject to appropriate confidentiality obligations and access information only where reasonably necessary for their responsibilities.

Administrative and support access to tenant information will be limited to legitimate operational, security, support or legal purposes.

Lnq Group Technologies will maintain reasonable technical and organisational safeguards appropriate to the nature of the Ovanta service and the personal information processed through it.

Safeguards may include authentication, tenant isolation, role-based permissions, row-level database controls, encrypted network communications, controlled administrative access, audit records, deployment controls, monitoring, backup and recovery measures.

The organisation remains responsible for managing its own users, roles, devices, credentials and lawful use of information within its workspace.

Lnq Group Technologies may use third-party service providers to operate Ovanta, including providers of cloud hosting, databases, authentication, email, payments, monitoring, communications and related infrastructure.

Where a service provider processes personal information on behalf of Lnq Group Technologies, reasonable steps will be taken to select providers capable of protecting that information and to impose appropriate contractual or operational safeguards where required.

The Ovanta Privacy Policy provides further information about categories of third-party providers and international processing that may apply.

Where reasonably possible and appropriate to Ovanta's role as operator, Lnq Group Technologies will assist an organisation with requests relating to access, correction, deletion or other applicable data-subject rights concerning information processed in that organisation's workspace.

If Lnq Group Technologies receives a request relating primarily to information controlled by an Ovanta customer, it may direct the requester to the relevant organisation where appropriate and lawful.

Lnq Group Technologies will investigate confirmed or reasonably suspected security incidents involving personal information processed through Ovanta and take reasonable steps to contain and remediate the incident.

Where required by applicable law or the parties' respective obligations, Lnq Group Technologies will provide the affected organisation with information reasonably available to assist it in meeting applicable notification or response duties.

Ovanta may use technology or service providers that process or store information outside South Africa. Where cross-border processing occurs, Lnq Group Technologies will take reasonable steps to use mechanisms and providers consistent with applicable POPIA requirements.

The organisation acknowledges that lawful cloud services may involve processing across more than one jurisdiction.

During an active subscription, organisations may use available Ovanta functions to access and export information subject to their permissions and the capabilities of the platform.

After cancellation or termination, organisation data may be retained for a limited period where reasonably necessary for reactivation, export, backup, audit, billing, security, legal or operational purposes.

Information that is no longer required may subsequently be deleted, de-identified or rendered inaccessible in accordance with applicable law, contractual commitments and backup cycles.

On reasonable request, Lnq Group Technologies may provide information reasonably necessary to demonstrate the safeguards relevant to Ovanta's processing obligations, subject to confidentiality, security, privilege and protection of other customers' information.

Any additional audit, assessment or enterprise assurance requirement that creates material cost or operational burden may be subject to a separate written agreement.

This DPA should be read with the Ovanta Terms of Service and Privacy Policy.

If a separately signed data-processing agreement between Lnq Group Technologies (Pty) Ltd and an organisation expressly overrides this DPA, the signed agreement will prevail to the extent of the stated inconsistency.

Nothing in this DPA removes a statutory obligation or right that cannot lawfully be excluded or limited.

Questions about this DPA or privacy matters relating to Ovanta may be sent to hello@ovanta.co.za.

Application and account support should be directed to support@ovanta.co.za.

Ovanta is owned and operated by Lnq Group Technologies (Pty) Ltd, South Africa.