Data processing terms

1. Scope and roles

These terms form part of our terms of service. They are the written contract that the Protection of Personal Information Act 4 of 2013 ("POPIA") section 21 requires between a responsible party and its operator. They apply to the personal information of your customers, their contact people and your payout beneficiaries ("payer data") that we process when you use CentraPoint. For payer data you, the merchant, are the responsible party, and Global Software Services (Pty) Ltd ("GSS", "we") is your operator. Our own processing as a responsible party (your account, users and business verification) is covered by our privacy policy.

2. What we process and why

We process the payer data you or your payers enter, or your gateways send. That includes names, contact details, addresses and VAT numbers; invoices, quotes, statements and subscriptions; payment records and card tokens; debit order mandates with bank account details and ID numbers; signed mandate agreements; payout beneficiaries; and the emails sent to payers. We process it only to provide CentraPoint to you: to store it, show it to your users, create documents, send emails and payment requests, submit payments and debit orders to the providers you connect, reconcile, report and support you.

3. Your instructions

We process payer data only with your knowledge and on your documented instructions. Your use of CentraPoint's features, your settings and API calls, these terms, and any written request from you are those instructions (POPIA section 20(a)). We do not use payer data for our own purposes, sell it or use it for marketing. If we believe an instruction breaks POPIA, we will tell you. If a law requires us to process payer data in another way, we will tell you first, unless the law forbids that.

4. Confidentiality

We treat payer data as confidential and do not disclose it unless the law requires it or you instruct us to (POPIA section 20(b)). Only GSS staff who need access to run, secure or support the service have it, and they are bound to confidentiality.

5. Security measures

We maintain the security measures POPIA section 19 requires and our privacy policy describes (section 21(1)). These include encryption at rest of card tokens, bank account numbers, gateway credentials and mail server passwords; HTTPS; signed payment links; verified gateway notifications; role-based access and an audit log of user actions; and rate limits. You are responsible for the security measures on your side. That includes who you give access to, their roles, two-factor authentication, and the safekeeping of your API keys and of the files you export.

6. Security compromises

If we have reasonable grounds to believe that payer data has been accessed or acquired by an unauthorised person, we notify you immediately, as POPIA section 21(2) requires. We tell you what we know about the compromise, the data and payers involved, and the steps we are taking. We help you notify the Information Regulator and the affected payers under section 22.

7. Providers you connect, and our sub-operators

The payment gateways, Netcash, banks and accounting systems you connect process payer data under your own agreements with them. When you connect one, you instruct us to send it the data it needs. These are the gateways PayFast, Netcash, Ozow, Yoco, Peach Payments, PayGate, Paystack, Flutterwave, DPO Pay, Pesapal, M-Pesa and MTN MoMo, and the accounting systems Xero, QuickBooks, Zoho Books, Sage and Invoice Ninja. The same applies to your own mail server if you connect one.

The operators we use ourselves to process payer data are our outgoing email service (for emails sent from CentraPoint's address) and the servers we administer to host CentraPoint. We will give you at least 30 days' notice, by email or in the app, before we add a sub-operator that processes payer data. You may object and, if we cannot resolve the objection, cancel and receive a refund of the unused part of any fee you paid in advance. We require each sub-operator to keep payer data confidential and secure, as POPIA sections 20 and 21 require.

8. Transfers outside South Africa

Payer data goes outside South Africa when you connect a provider that operates abroad (our privacy policy lists them), because you instruct us to send it there. You are responsible for making sure that such a transfer meets POPIA section 72 for your payers. For example, you may need to tell your payers about it in your own privacy notice.

9. Helping you with payers' requests

You can view, correct and export payer data in CentraPoint, deactivate customers, and delete saved cards. If a payer asks you for access, correction, deletion or objection, and you cannot do it in the app, ask us and we will help within a reasonable time. If a payer contacts us directly, we will pass the request on to you and not answer it ourselves, unless the law requires us to.

10. Your responsibilities

• You have a lawful basis under POPIA section 11 for the payer data you put into CentraPoint, and you have told your payers how it is used, including that GSS processes it for you.
• You hold valid debit order mandates and any consent needed for direct marketing.
• You keep payer data accurate and process only what you need. Do not upload special personal information or children's information unless POPIA allows it.
• You respond to your payers' requests and complaints.

11. When your account ends

You can export payer data before your account closes (CSV exports, reports and the API). A closed account is deactivated and kept, so that it can be restored, and its financial records are kept as tax and financial laws require (generally 5 years). We do not yet delete closed accounts automatically. On your written request we will delete or de-identify payer data that no law requires us to keep, and confirm when this is done.

12. Information and audits

We will give you the information you reasonably need to show that these terms are being met, and answer reasonable questions about our security. Write to show support email.

13. Liability

The limits of liability in our terms of service apply to these terms. If these terms and the terms of service conflict on payer data, these terms apply.