Operator Addendum

1. What this addendum is, and how it applies

This Operator Addendum ("Addendum") governs the processing by Xinnace (Pty) Ltd, registration number 2025/316516/07, of 22 Umhlanga Boulevard, Umhlanga, 4321, South Africa ("Xinnace", "we", "us") of personal information on behalf of a client organisation ("Client", "you") in the course of providing the Xinnace HRMS Platform.

It forms part of, and is incorporated into, our Terms and Conditions as contemplated in clause 10 of those Terms. Where this Addendum and the Terms conflict on the processing of personal information, this Addendum prevails. Words defined in the Terms carry the same meaning here.

This Addendum is accepted electronically by the Client's account holder inside the platform. In terms of section 12 of the Electronic Communications and Transactions Act 25 of 2002, an agreement recorded in a data message that is accessible for later reference satisfies a requirement that it be in writing, and section 21(2) of POPIA requires this contract to be in writing. We record the date, the name and email address of the person who accepted, and the version accepted, and we will provide that record to you on request.

Where you and Xinnace have signed a separate negotiated data processing agreement, that agreement governs and this Addendum does not apply to you.

2. Definitions

• "POPIA" means the Protection of Personal Information Act 4 of 2013.
• "Client Data" means personal information that you, your users or your data subjects submit to, or that is generated in, your workspace on the HRMS Platform.
• "data subject", "operator", "personal information", "processing", "responsible party" and "special personal information" carry the meanings given to them in POPIA.
• "security compromise" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Data.
• "sub-operator" means a third party engaged by Xinnace to process Client Data on our behalf.

3. Roles of the parties

For Client Data, you are the responsible party and Xinnace is your operator. You determine the purpose and means of processing. We process Client Data only for you.

You remain responsible for: having a lawful basis for the processing, meeting POPIA's conditions for lawful processing in your own organisation, issuing any notices your employees or applicants are entitled to, and for the accuracy and lawfulness of the instructions you give us. We are not in a position to assess whether you may lawfully hold a given record about your own staff, and we do not attempt to.

Xinnace is a responsible party in its own right for a separate and limited set of information: the contact details of your administrators and billing contacts, our own account, billing and support records, and information collected through our public website. That processing is described in our Privacy Policy and is not governed by this Addendum.

4. Subject matter of the processing

Section 21 requires the arrangement between us to be defined rather than open-ended, so the scope is set out here.

Nature and purpose: hosting and operating a human resource management platform, so that you can administer employment records, attendance and rostering, leave, payroll inputs, performance and KPIs, disciplinary and grievance matters, recruitment, engagement surveys and related HR functions.

Duration: for as long as your subscription is active, plus the deletion period in clause 12.

Categories of data subject: your employees and former employees, their dependants and emergency contacts where you record them, job applicants and referred candidates, and your own users of the platform.

Categories of personal information: identifying and contact details, employment and remuneration details, attendance and leave records, performance and disciplinary records, recruitment records including uploaded documents such as CVs and identity documents, and such other fields as you choose to configure.

Special personal information: the platform supports fields that are special personal information under section 26, including race and disability status where you capture them for Employment Equity reporting, and health or criminal-behaviour information where your own processes record it. You are responsible for establishing that section 27 or section 28 authorises your processing of those fields. We treat them as special personal information for security purposes wherever they appear.

Children's information: the platform is not designed for the processing of personal information of children as defined in POPIA, other than dependant details you may record. You should not use it for that purpose without first satisfying yourself that section 35 permits it.

5. Our obligations as operator

In terms of sections 20 and 21 of POPIA, Xinnace will:

• Process only on your instructions. We process Client Data only with your knowledge and authorisation, for the purpose of providing the platform and the support you ask for, and not for any purpose of our own. Your use of the platform, your configuration of it, and the support requests you send us are your documented instructions. We do not sell Client Data, and we do not use it to train machine learning models.
• Treat it as confidential. We treat Client Data as confidential and do not disclose it except as this Addendum permits.
• Keep it secure. We establish and maintain the security safeguards described in clause 6, as section 21(1) read with section 19 requires.
• Tell you if it is compromised. We notify you of a security compromise as set out in clause 8, as section 21(3) requires.
• Follow the law. Where we are required by law to process Client Data otherwise than on your instructions, we will tell you before doing so unless that law forbids us from telling you.
• Limit who can see it. Access by Xinnace personnel is limited to those who need it to operate the platform or to answer a support request. Staff access to a workspace is through a single-use, short-lived token, is recorded on both our audit trail and yours, and displays a banner for the duration of the session. Our personnel are bound by confidentiality obligations that survive the end of their engagement.

6. Security safeguards

We maintain appropriate, reasonable technical and organisational measures as required by section 19. The measures currently in place include:

• Tenant isolation. Every client workspace has its own separate database, and the lookup that maps a workspace to its database fails closed: an unknown or suspended workspace is refused rather than falling back to another client's data.
• Encryption in transit. Connections use HTTPS with TLS. Plain HTTP is refused rather than redirected, and HTTP Strict Transport Security is sent with a one-year lifetime covering workspace subdomains.
• Credential protection. Passwords are stored as salted bcrypt hashes and are never stored in a readable form. Our staff cannot retrieve a password, only trigger a reset. Integration keys are stored hashed, carry only the scopes you grant, and are individually rate limited and revocable.
• Access control. Permissions are granular, set per action rather than per module, and enforced on the server for every request rather than only in the interface. Sign-in can optionally be restricted to your own IP ranges.
• Brute-force and session protection. Sign-in attempts are rate limited per IP address, repeated failures are locked out, session cookies are HTTP-only, secure and SameSite-restricted, and the session identifier is regenerated on sign-in.
• Audit logging. Record changes are logged with previous and new values, together with who made the change, from where and when. Failed sign-ins, permission denials and settings changes are logged separately from data changes.
• Backups. Server-level backups are taken by our hosting provider.

Our security overview describes these controls in full, is kept current, and is the authoritative description of them. It also names what is not yet in place, currently including multi-factor authentication, independent penetration testing, scheduled vulnerability scanning, a published patch cadence, and tested restore figures. We would rather you assessed us on what we can demonstrate than on a list that reads well. Nothing in this Addendum should be read as claiming a certification: we hold none.

We may change these measures from time to time, provided the level of protection is not materially reduced.

7. Sub-operators

You authorise us to engage sub-operators to process Client Data, on condition that each is bound by obligations no less protective than those in this Addendum, and that we remain responsible to you for their processing.

The sub-operators in use are:

• Our hosting provider. Hosts the application, databases and uploaded documents on a dedicated server in a South African data centre, and holds server-level backups.
• Google (email delivery). Transmits platform email, such as invitations, password links, notifications and reminders. Message content and recipient addresses are processed outside South Africa.

We will give you reasonable notice before adding or replacing a sub-operator that processes Client Data. If you reasonably object to a new sub-operator on data protection grounds, tell us at privacy@xinnace.co.za and we will work with you to find an alternative. If we cannot, you may terminate the affected part of the service without penalty, and clause 12 applies.

8. Security compromises

Section 21(3) requires an operator to notify the responsible party immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

Accordingly, on becoming aware of a security compromise affecting Client Data we will notify you without undue delay, using the account holder and administrator contact details on your account, and will include what we know at the time: what happened, when, which categories of Client Data and roughly how many records are affected, what we are doing about it, and what we recommend you do. Where the full picture is not yet available, we will notify you first and follow up as we establish more, rather than delaying the first notification until the investigation is complete.

We will assist you with the notifications you must make. Reporting a compromise to the Information Regulator and to affected data subjects under section 22 is your obligation as responsible party, not ours, because it is your relationship with those data subjects. We will not make that notification on your behalf unless you ask us to in writing.

To report a suspected security issue to us, email security@xinnace.co.za. We aim to acknowledge within one business day.

9. Data subject requests

Requests from your employees or applicants to access, correct or delete their information are yours to answer, since it is your record and your relationship. Most such requests can be answered by you directly in the platform, which is the fastest route for everyone.

Where you need our help, we will provide reasonable assistance. If a data subject approaches us directly about Client Data, we will not respond to the substance of the request. We will tell them to approach you and, where we can identify your organisation, let you know that they made contact.

Recruitment records can be erased on request under section 24, with uploaded documents such as CVs and identity copies removed from storage before the record itself. Employee records are subject to statutory retention periods under the Basic Conditions of Employment Act and the Tax Administration Act, which are not the data subject's to waive and which we will not override on request.

10. Your obligations

• Give lawful instructions, and only process Client Data through the platform where POPIA permits you to.
• Give your employees, applicants and other data subjects any notice they are entitled to under section 18, and obtain any consent your processing relies on.
• Manage your own users: grant the least access each person needs, remove access promptly when someone leaves, and keep your account holder and administrator contact details current, since those are the addresses a breach notice goes to.
• Do not send us Client Data through insecure channels, and do not include employee or candidate personal information in support requests or security reports where a workspace reference would do.
• Tell us if you become aware of a compromise affecting your workspace, including one originating on your side.

11. Cross-border transfers

Primary Client Data, meaning the application, databases and uploaded documents, is hosted in South Africa. Section 72 permits a transfer of personal information outside the Republic in defined circumstances, including where the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection.

The transfers that occur are limited to the email delivery described in clause 7, where message content and recipient addresses are processed outside South Africa, and to any server-level backup storage held by our hosting provider outside the Republic. Where such a transfer takes place we require an adequate level of protection by agreement with the recipient, as section 72 contemplates. If your assessment needs the full picture for your file, ask us at privacy@xinnace.co.za and we will set it out.

12. Retention, return and deletion

We retain Client Data for as long as your subscription is active. On termination or expiry, and at your election, we will return your Client Data to you or delete it.

You can export your main registers, including employees, attendance, payroll and recruitment, to CSV at any time during your subscription, and our REST API lets you pull your data on your own schedule. Taking an export before your subscription ends is the most reliable way to keep your records, and we recommend it rather than relying on a request afterwards.

Unless you ask us in writing to do so sooner, or a longer period is agreed, we will delete your workspace database and uploaded documents within 90 days of termination. This gives you a window to ask for an export or to reactivate, and it is not an invitation to leave your data with us: ask us to delete earlier and we will. Copies held in routine server-level backups are overwritten in the ordinary backup cycle. We may retain information we are required by law to keep, such as invoicing and tax records, which are not Client Data.

13. Audit and information

On reasonable written notice, and no more than once in any 12-month period unless a security compromise or a Regulator's requirement makes a further request necessary, we will make available the information reasonably needed to demonstrate our compliance with this Addendum, and will respond to a reasonable security assessment questionnaire.

Because the platform is shared infrastructure, an on-site inspection of the hosting environment by a client is not something we can offer, and testing against the live platform is not permitted. Send technical and vendor-assessment questions to security@xinnace.co.za, and where a control matters to your assessment we will arrange a demonstration of it.

14. Liability

The limitations and exclusions of liability in the Terms and Conditions apply to this Addendum, and liability under this Addendum counts towards the same aggregate cap. Nothing in this Addendum limits liability that cannot be limited in law, including liability for a party's own wilful misconduct, or either party's own liability to a data subject or to the Information Regulator under POPIA.

15. Duration and changes

This Addendum takes effect when you accept it, or when you first use the HRMS Platform after its effective date, and continues for as long as we process Client Data for you. Clauses 8, 12 and 14 survive its termination.

We may update this Addendum from time to time, for example when a sub-operator changes or the law does. We will notify a material change by email to your account holder or through the platform before it takes effect. Where a change materially reduces the protection given to Client Data and you do not accept it, you may terminate the affected service without penalty by telling us within 30 days of the notice.

16. Contact

Xinnace (Pty) Ltd
Data protection and POPIA: privacy@xinnace.co.za
Security issues and assessments: security@xinnace.co.za
Legal and compliance: compliance@xinnace.co.za
22 Umhlanga Boulevard, Umhlanga, 4321
South Africa

You have the right to complain to the Information Regulator. Their contact details, and how to lodge a complaint, are set out in our Privacy Policy.