Data Processing Agreement

1. Definitions

In this Agreement:

• Responsible Party / Data Controller — the company or individual who subscribes to Insyte Tracker and determines the purpose of data processing (you, the client)
• Operator / Data Processor — Insyte Tracker, who processes personal data on behalf of the Responsible Party
• Data Subject — any individual whose personal data is processed through the platform, including field technicians and employees
• Personal Information — any information relating to an identifiable natural person, as defined under POPIA
• Processing — any operation performed on personal data, including collection, storage, analysis, use and deletion

2. Roles and Responsibilities

You, as the Responsible Party, determine the purpose and means of processing personal data through the Insyte Tracker platform. This includes the decision to record, upload and analyse video footage of your field technicians.

Insyte Tracker acts as the Operator and processes personal data solely on your instructions and for the purpose of providing the Service. We do not process personal data for any purpose beyond what is necessary to deliver the platform's functionality.

As the Responsible Party, you are responsible for:

• Ensuring you have a lawful basis for processing your technicians' personal data
• Informing data subjects (your technicians and employees) that their video footage and performance data is being processed
• Obtaining any necessary consent from individuals who appear in uploaded video footage
• Complying with all applicable data protection laws in your jurisdiction

3. Categories of Personal Data Processed

Through your use of Insyte Tracker, the following categories of personal data may be processed:

• Names and contact details of account holders and administrators
• Names and employee identifiers of field technicians
• Video footage of technicians performing field work
• Performance scores, behavioural assessments and safety evaluations derived from video analysis
• Location data associated with job sites
• Job dates, incident records and compliance data

4. Purpose of Processing

Personal data is processed for the following purposes only:

• Analysing uploaded video footage using AI to generate performance and safety reports
• Building technician performance profiles based on submitted job reports
• Providing compliance tracking and audit log functionality
• Delivering the dashboard, reporting and analytics features of the platform
• Sending transactional communications related to your account and reports

We do not use your data or your technicians' data for any secondary purpose, including marketing, advertising or AI model training without explicit written consent.

5. POPIA Compliance

Insyte Tracker is committed to compliance with the Protection of Personal Information Act 4 of 2013 (POPIA). In accordance with POPIA, we process personal information only:

• For a specific, explicitly defined and lawful purpose
• In a manner that does not infringe on the privacy of the data subject
• With appropriate technical and organisational security measures in place
• For no longer than is necessary for the purpose for which it was collected

As the Responsible Party, you are required to appoint an Information Officer under POPIA and register with the Information Regulator of South Africa where required by law.

Data subjects whose information is processed through your use of the platform have the right to request access to, correction of or deletion of their personal information. Such requests should be directed to you as the Responsible Party in the first instance.

6. GDPR Compliance

For clients based in the European Economic Area or who process data of EEA residents, Insyte Tracker processes personal data in accordance with the General Data Protection Regulation (GDPR). The lawful basis for processing is the performance of a contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)).

Where required, we will enter into standard contractual clauses or other appropriate transfer mechanisms for the transfer of personal data outside the EEA.

7. Data Retention

Personal data is retained only for as long as necessary to provide the Service:

• Video footage — retained according to your chosen retention policy (30, 60, 90 or 365 days), after which it is permanently and irreversibly deleted
• AI-generated reports — retained for the duration of your active subscription
• Account and profile data — retained while your account remains active and deleted within 30 days of account termination
• Audit logs — retained for 12 months from the date of creation

8. Security Measures

Insyte Tracker implements the following technical and organisational security measures to protect personal data:

• All data encrypted at rest using AES-256 encryption
• All data transmitted over TLS 1.2 or higher (HTTPS)
• Each client's data stored in isolated environments with no cross-account access
• Access to production systems restricted to authorised personnel only
• Regular security reviews and vulnerability assessments
• Automatic daily backups with point-in-time recovery
• Row-level security enforced at the database level

9. Subprocessors

We use the following subprocessors to deliver the Service. All subprocessors are contractually bound to protect personal data to the same standard as this Agreement:

We will notify you of any changes to our subprocessors that may affect your data protection obligations.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, Insyte Tracker will notify you without undue delay and within 72 hours of becoming aware of the breach, in accordance with POPIA and GDPR requirements.

The notification will include the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences of the breach and the measures taken or proposed to address it.

11. Data Subject Rights

Data subjects whose personal information is processed through the platform have the following rights, which you as the Responsible Party are obligated to facilitate:

• The right to access their personal information
• The right to correct inaccurate personal information
• The right to request deletion of their personal information
• The right to object to the processing of their personal information
• The right to data portability where applicable

To assist with data subject requests, contact us at [email protected] and we will respond within 30 days.

12. International Data Transfers

Some of our subprocessors are located outside South Africa and the EEA. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including standard contractual clauses, adequacy decisions or other legally recognised transfer mechanisms.

13. Term and Termination

This DPA remains in force for the duration of your subscription to Insyte Tracker. Upon termination of your subscription, we will delete all personal data processed on your behalf within 30 days, unless retention is required by applicable law.

14. Contact and Information Officer

For any queries relating to this Data Processing Agreement, data subject requests or data protection matters, please contact:

• Email: [email protected]
• Website: www.insytetracker.com

For complaints relating to the processing of your personal information under POPIA, you may also contact the Information Regulator of South Africa at inforeg.org.za.