Operator agreement
The standard terms under which Leverpoint handles a client’s personal information as an operator. The signed version issued with each proposal governs.
This Operator Agreement forms part of the MSA between Leverpoint (Pty) Ltd (Operator) and [CLIENT] (Responsible Party). It applies to all Client Personal Information that the Operator processes for the Responsible Party. It meets the requirement for a written contract between a responsible party and an operator.
1. Definitions
Terms defined in POPIA have the same meaning here. These include personal information, processing, responsible party, operator, data subject, special personal information and security compromise. Sub-operator means a person engaged by the Operator to process Client Personal Information.
2. Roles
2.1 The Responsible Party decides the purpose and means of processing. The Operator processes Client Personal Information for it under a contract and does not come under its direct authority.
2.2 Annex 3 describes the processing: subject matter, duration, purpose, data categories, data subjects and systems.
3. Instructions
3.1 The Operator will process Client Personal Information only with the knowledge or authorisation of the Responsible Party. That means only on its documented instructions, which are the MSA, the SOW, this agreement and written instructions from the Client project lead.
3.2 The Operator will treat Client Personal Information as confidential. It will not disclose it unless required by law or in the course of performing its duties.
3.3 If the Operator believes an instruction breaches POPIA, it will tell the Responsible Party promptly. It may suspend that processing until the instruction is clarified.
3.4 The Operator will not use Client Personal Information to train or fine-tune any AI Model. It will select Third-Party Model settings or terms under which the provider does not use inputs for training, where available, and record the setting in Annex 2.
3.5 Where processing is required by law, the Operator will inform the Responsible Party before processing, unless the law prohibits it.
4. Security measures
4.1 The Operator will secure the integrity and confidentiality of Client Personal Information by taking appropriate, reasonable technical and organisational measures. These measures must prevent loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of it.
4.2 The Operator will: identify foreseeable internal and external risks; establish and maintain safeguards; verify regularly that they are effective; and update them for new risks.
4.3 The Operator will have due regard to generally accepted information security practices. Annex 1 sets out the measures.
5. Sub-operators
5.1 The Responsible Party gives general authorisation for the sub-operators listed in Annex 2, but only for the purposes stated there.
5.2 The Operator will give at least 15 Business Days’ written notice before adding or replacing a sub-operator. The notice will state its name, role, location and transfer basis. The Responsible Party may object on reasonable data protection grounds within that period. If the objection is not resolved, either party may terminate the affected services without penalty.
5.3 The Operator will put written terms in place with each sub-operator that give at least equivalent protection, or will accept the sub-operator’s standard terms where those terms give equivalent protection and cannot be negotiated. The Operator will record its assessment in Annex 2. Large providers rarely negotiate terms; the attorney must consider whether “equivalent” protection is achievable.
5.4 The Operator remains responsible to the Responsible Party for its sub-operators.
5.5 Where the Responsible Party holds the provider account itself (for example, its own AI Model API account), that provider is the Responsible Party’s operator, not the Operator’s sub-operator.
6. Security compromise notification
6.1 Where there are reasonable grounds to believe that Client Personal Information has been accessed or acquired by an unauthorised person, the Operator will notify the Responsible Party immediately.
6.2 The Operator aims to send the notice as soon as it becomes aware, and in any event within 48 hours at the latest. The 48 hours is an outer limit. It does not permit delay where earlier notice is possible.
6.3 The notice will include, as far as is known: the nature of the compromise; the categories and approximate number of data subjects and records; likely consequences; measures taken or proposed; a contact; and, if known, the identity of the unauthorised person. The Operator will supplement it as facts emerge. The notice does not need to wait for the compromise to be confirmed.
6.4 The Responsible Party is responsible for notifying the Information Regulator through its eServices portal and for notifying data subjects. The Operator will give reasonable help, including information for the portal submission. The Operator will not notify the Regulator or data subjects on the Responsible Party’s behalf unless instructed in writing or required by law.
6.5 The Operator will keep a record of all security compromises (Document 16).
7. Data subject requests and assistance
7.1 The Operator will pass any request from a data subject on to the Responsible Party within 2 Business Days and will not respond to it itself unless instructed.
7.2 The Operator will help, at reasonable cost if the work is substantial, with: access, correction and deletion requests; objections; assessments; enquiries from the Regulator; and prior-authorisation questions.
8. Return or deletion
8.1 At the end of the services, or on written request, the Operator will, at the Responsible Party’s choice, return Client Personal Information in a commonly used format or delete it. It will do this within 30 days and confirm in writing.
8.2 Backups are deleted on their normal rotation cycle of 30 days. Until then they remain protected under this agreement.
8.3 The Operator may keep a copy only where the law requires it, and only for as long as required.
9. Audit
9.1 On 30 days’ written notice, and no more than once a year (or after a security compromise), the Operator will provide reasonable evidence of compliance. This means policies, Annex 1 evidence logs and sub-operator assessments, and answers to a reasonable questionnaire.
9.2 An on-site or remote audit may be carried out by the Responsible Party or an independent auditor bound by confidentiality, at the Responsible Party’s cost, if the documentary evidence is reasonably insufficient. The scope must be proportionate to the size of the Operator and the risk.
9.3 Audits must not give access to other clients’ information.
10. Cross-border transfers
10.1 The Operator does not promise that Client Personal Information will remain in South Africa. Leverpoint’s own tools are hosted on Supabase in eu-central-1 (Frankfurt, Germany). Client systems run on Client accounts where possible.
10.2 The Operator will transfer Client Personal Information outside South Africa only to the recipients in Annex 2 and only where one of the POPIA s72(1) grounds applies, as recorded in Annex 2. The usual ground is s72(1)(a): the recipient is subject to a law, binding corporate rules or a binding agreement that gives adequate protection substantially similar to POPIA’s conditions, including on onward transfer. In some cases s72(1)(b) (consent) or s72(1)(c)/(d) (performance of a contract) may apply.
10.3 Contract terms in the style of the EU standard contractual clauses or a provider’s data processing addendum are assessed against POPIA s72(1)(a). They are not treated as automatically adequate.
10.4 Transfers of special personal information or children’s personal information to a country without adequate protection may require prior authorisation. These are excluded unless the SOW provides for them.
11. Operator’s own compliance
11.1 The Operator will process Client Personal Information only in South Africa or in the locations listed in Annex 2.
11.2 The Operator will not perform any processing that makes decisions about data subjects based solely on automated processing.
12. Liability
12.1 Liability under this agreement is governed by MSA clause 17, including the carve-out in clause 17.3(c).
13. Term
13.1 This agreement lasts for as long as the Operator processes Client Personal Information. Clauses 3.2, 6, 8 and 9 survive.
SIGNATURES
Signed for Leverpoint: Siphosethu Magubane, Director, on [DATE].
| SIGNATURE | DATE |
Signed for Responsible Party: [NAME, ROLE, DATE].
| SIGNATURE | DATE |
Annex 1 – Security measures
How to read this annex. Each control below is a commitment. A control applies only once it is marked “Implemented” with a date and evidence reference. Leverpoint does not claim that any control is in place until it is recorded here as implemented. Evidence is kept in corporate/legal-set-v3/evidence/ in the Leverpoint workspace.
| # | CONTROL | STATUS | DATE IMPLEMENTED | EVIDENCE KEPT |
|---|---|---|---|---|
| S1 | Multi-factor authentication on all Leverpoint and Client accounts used by Leverpoint | Planned | [ ] | Screenshot of settings, quarterly |
| S2 | Least-privilege access; separate credentials per client | [ ] | [ ] | Access register |
| S3 | Password manager for all credentials; no credentials in code or chat | [ ] | [ ] | Tool settings |
| S4 | Full-disk encryption on all devices | [ ] | [ ] | OS settings record |
| S5 | Encryption in transit (TLS) and at rest, where offered by providers | [ ] | [ ] | Provider documentation |
| S6 | Supabase row-level security on every table holding personal information | [ ] | [ ] | Policy export |
| S7 | AI Model data-retention and no-training settings configured | [ ] | [ ] | Settings record |
| S8 | Data minimisation: test sets use redacted or synthetic data where possible | [ ] | [ ] | Test-set log |
| S9 | Logging of access and system actions; logs kept 90 days | [ ] | [ ] | Log config |
| S10 | Backups and tested restore | [ ] | [ ] | Restore test record |
| S11 | Patch and update devices within 14 days | [ ] | [ ] | Update log |
| S12 | Removal of Leverpoint access at handover | [ ] | [ ] | Handover checklist |
| S13 | Incident response plan (Document 16) tested annually | [ ] | [ ] | Test record |
| S14 | Secure deletion at end of engagement | [ ] | [ ] | Deletion certificate |
Annex 2 – Sub-operators and transfers
No provider is used for Client Personal Information until its row is completed and the Responsible Party has been notified.
| PROVIDER | SERVICE | ROLE | DATA LOCATION | TRANSFER BASIS (POPIA S72) | PROVIDER TERMS / DPA | TRAINING ON INPUTS DISABLED? | STATUS |
|---|---|---|---|---|---|---|---|
| Supabase, Inc. | Database and hosting for Leverpoint tools | Sub-operator | EU, eu-central-1 (Frankfurt) | s72(1)(a): Supabase DPA, assessed 16 October 2026 | supabase.com/legal/dpa | N/A | Active (Leverpoint tools only) |
| Anthropic | AI Models | Sub-operator (where Leverpoint’s account is used) | United States | s72(1)(a): Anthropic Commercial Terms and DPA, assessed 16 October 2026 | anthropic.com/legal/commercial-terms; anthropic.com/legal/dpa | Yes – customer inputs are not used for training under Anthropic’s commercial terms | Proposed – activated per SOW |
| Vercel Inc. | Website and app hosting | Sub-operator (only if a Client system is hosted there) | United States and global edge network | s72(1)(a): Vercel DPA, assessed 16 October 2026 | vercel.com/legal/dpa | N/A | Proposed – only if the SOW hosts a Client system on Vercel |
| Google (Workspace) | Email, documents, storage | Sub-operator | United States, with Google data centres in other regions | s72(1)(a): Google Workspace DPA, assessed 16 October 2026 | workspace.google.com/terms/dpa_terms.html | Yes – Workspace customer data is not used to train models | Active (correspondence and documents) |
| Formspree | Web form processing | Not normally used for Client data | United States | s72(1)(a): Formspree terms and privacy policy, assessed 16 October 2026 | formspree.io/legal/privacy-policy | N/A | Active for Leverpoint’s own enquiry form only |
| No other provider is used. A new row is added, and the Responsible Party notified under clause 5.2, before any other provider touches Client Personal Information. |
Annex 3 – Description of processing
| Subject matter | [SOW reference] |
| Duration | Term of SOW plus return or deletion period |
| Purpose | [ ] |
| Data subjects | [Client staff, Client’s clients, counterparties] |
| Categories | [ ] |
| Special or children’s information | [None / specify and state the lawful basis] |
| Systems | [ ] |
Last updated 16 October 2026.