NUVATION BUSINESS SOLUTIONS

Operator and Data Processing Terms

Version 1.0 · Effective 7 August 2026 · South Africa

1. Parties and incorporation

These Operator and Data Processing Terms ("Processing Terms") are between the business account owner or business represented by that owner (the "Customer") and Jaco du Toit, a South African sole proprietor trading as NuVation Business Solutions ("NuVation").

These Processing Terms supplement the NuVation Terms of Service. They apply while NuVation processes Customer Personal Information to provide the ERP. If these Processing Terms conflict with the Terms of Service only on the processing of Customer Personal Information, these Processing Terms govern that processing. Mandatory law always prevails.

2. Definitions

• Customer Personal Information means personal information entered into, generated from or otherwise processed through the ERP for purposes determined by the Customer, excluding information for which NuVation independently determines the purpose and means.
• Data subject, operator, personal information, processing and responsible party have the meanings given in POPIA.
• POPIA means the Protection of Personal Information Act 4 of 2013.
• Security compromise means circumstances giving reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.
• Service means the subscribed NuVation Business ERP functionality available to the Customer.

3. Roles of the parties

The Customer generally decides the purpose and means of processing its customer, supplier, employee, Professional and operational records and is generally the responsible party for that information. NuVation processes that information to provide the Service and generally acts as the Customer's operator.

NuVation is separately the responsible party for processing whose purpose and means NuVation determines, including NuVation account administration, authentication, subscription fulfilment, service security, abuse prevention, support, legal compliance and NuVation's own business records. NuVation's Privacy Policy applies to that processing.

4. Customer instructions and authority

The Customer instructs NuVation to process Customer Personal Information only as reasonably necessary to provide, secure, support, maintain and lawfully operate the Service according to the Customer's authorised use, selected features and documented requests.

NuVation will process Customer Personal Information only with the Customer's knowledge or authorisation, except where South African law requires otherwise. If NuVation reasonably believes an instruction is unlawful, materially unsafe or outside the Service, NuVation may decline or pause that instruction and explain the reason where legally permitted. Customer instructions cannot require NuVation to break the law, weaken another customer's protections or disclose another business's records.

5. Details of the processing

Subject matter: operation of the Customer's subscribed ERP workspace.

Duration: the period during which NuVation provides the Service, followed by the limited deletion, restriction, recovery and lawful-retention periods described in these Processing Terms and the Privacy Policy.

Nature of processing: collecting, recording, organising, storing, retrieving, displaying, linking, calculating, generating, printing, transmitting to authorised recipients, restricting, correcting and deleting information as required by an authorised Service workflow.

Purposes: business administration, bookkeeping records, subscribed operational workflows, authorised collaboration, user-requested documents and reports, support, security, integrity and lawful service operation.

Categories of data subjects: the Customer and its owners, administrators, employees, Professionals, customers, suppliers, contacts, payers, drivers, service providers and other people lawfully recorded by the Customer.

Types of information: names, business contact details, addresses, identifiers, membership and permission information, transaction and payment records, customer and supplier information, invoice and quote information, bookkeeping entries, inventory and order information, operational records and other information supported by the subscribed modules.

6. Excluded and restricted use

The Service is intended for ordinary internal business administration. It is not designed for children's information or medical, biometric, criminal-record or credit-reporting information. The Customer must not use the Service as a credit bureau, regulated reporting system or professional decision system, and must not enter passwords, complete payment-card credentials, unlawful material or information it has no authority to process.

If a proposed use could involve special personal information, children's information, prior-authorisation processing or another regulated purpose, the Customer must not begin that use unless it has independently confirmed the lawful basis, authorisation, safeguards and notices and NuVation has expressly agreed in writing that the Service supports the proposed use.

7. NuVation's operator commitments

For Customer Personal Information, NuVation will:

• process it only with the Customer's knowledge or authorisation and for the purposes described in these Processing Terms;
• treat it as confidential and not disclose it except for proper performance of the Service, the Customer's authorised instruction or a lawful requirement;
• limit access to people and providers who require it for an authorised purpose and are subject to appropriate confidentiality duties;
• maintain appropriate and reasonable technical and organisational safeguards having regard to foreseeable risks, the information and the Service;
• review safeguards and address material deficiencies identified through reasonable testing, monitoring or incident investigation;
• assist the Customer, within the Service's capabilities and to a reasonable extent, with lawful access, correction, deletion, restriction, security and regulator requests relating to Customer Personal Information; and
• notify the Customer immediately when NuVation has reasonable grounds to believe that Customer Personal Information has been accessed or acquired by an unauthorised person.

8. Security measures

Measures are selected according to the nature and risks of the relevant processing. They may include authenticated access, role and permission controls, tenant separation, restricted server operations, input validation, rate limiting, security-event records, provider access controls, testing and incident response. NuVation does not promise that any system is invulnerable or continuously available.

NuVation may change a measure where the replacement maintains an appropriate level of protection and does not materially reduce the safeguards required by POPIA.

9. Security compromises

NuVation's operator notification will provide the material facts then known, the affected information or accounts known at that time, reasonable containment or remediation information, and available information that may help the Customer meet its duties. NuVation may provide facts in stages as the investigation develops and will not delay the initial notice merely because every detail is not yet known.

The Customer, as responsible party, decides and carries out any notice required to the Information Regulator and affected data subjects for Customer Personal Information. NuVation will provide reasonable cooperation. NuVation remains responsible for notices concerning a compromise of information for which NuVation is itself the responsible party.

10. Service providers and subprocessors

The Customer authorises NuVation to use hosting, authentication, database, storage, email, security, support and payment providers where reasonably necessary to provide the Service. NuVation will limit each provider to the relevant purpose and will use contractual, technical or legal safeguards appropriate to the provider's role and the processing.

Current provider categories and material changes are described in the Privacy Policy. NuVation will give reasonable notice before a new provider materially changes the processing of Customer Personal Information where notice is required or reasonably practicable. The Customer may stop using the affected future service before the change takes effect, subject to the Terms of Service and applicable law.

11. Cross-border processing

NuVation will transfer Customer Personal Information outside South Africa only where section 72 of POPIA permits the transfer, including where the recipient is subject to an adequate law or binding agreement, the data subject has validly consented where appropriate, or the transfer is necessary for an applicable contract. A provider may not further transfer Customer Personal Information without an applicable lawful safeguard.

12. Data-subject and PAIA requests

The Customer is responsible for receiving, verifying, deciding and responding to requests concerning Customer Personal Information. If NuVation receives such a request directly, it may refer the requester to the Customer unless law requires NuVation to respond. NuVation will not disclose Customer Personal Information to a requester without verifying authority and a lawful disclosure basis.

Where a supported Service feature allows the Customer to access, correct, export, restrict or delete information, the Customer should use that feature. NuVation will provide additional reasonable assistance where technically possible and legally required. Any charge for exceptional work must be lawful, reasonable and disclosed before the work begins.

13. Return, deletion, restriction and retention

The Customer must export and retain independent copies of records it is legally required to keep. Before requesting destructive organisation deletion, the Customer should obtain every export it needs. Destructive deletion may not be reversible.

When an organisation is lawfully deleted, NuVation will remove Customer Personal Information from the active Service or de-identify it as soon as reasonably practicable, except where retention or restriction remains authorised by law, is reasonably required for a lawful purpose, is required by contract, or protects another person's rights. NuVation may separately retain limited agreement, payment, security, request and audit evidence as responsible party for those lawful purposes.

Deleted information may remain temporarily in protected recovery copies until the applicable recovery copy expires. Such information will not be restored for ordinary use and will remain subject to access restrictions. If restoration is required for service recovery, the deletion instruction will be reapplied where reasonably practicable.

Where POPIA requires processing to be restricted rather than deleted, NuVation will limit use to permitted storage, proof, consented processing, protection of rights or public-interest grounds until the restriction can lawfully be lifted.

14. Customer responsibilities

The Customer will:

• process personal information lawfully, fairly, minimally and for a specific purpose;
• provide every required privacy notice and maintain an appropriate lawful basis;
• keep information reasonably accurate and correct material errors;
• configure roles and permissions according to actual work needs;
• verify every employee, administrator and Professional recipient before granting access;
• revoke access promptly when it is no longer authorised;
• protect credentials, devices, exported records and source documents;
• respond to data subjects, the Information Regulator and lawful requests as responsible party;
• notify NuVation promptly of suspected unauthorised access or misuse; and
• not instruct NuVation to process information unlawfully or outside the intended Service.

15. Information and compliance evidence

On a reasonable written request related to the Customer's POPIA duties, NuVation will provide available information reasonably necessary to demonstrate the operator commitments in these Processing Terms. NuVation may protect other customers, confidential security information, trade secrets, privileged material and system integrity. A request does not create a right to penetration-test the Service, obtain secrets or access another customer's information.

16. Separate project services

Graphic design, website, marketing or administrative project work is separate from the ERP. These Processing Terms apply to such work only if the applicable written project agreement incorporates them or says that NuVation will process personal information as an operator for that project.

17. Changes and termination

NuVation may update these Processing Terms to reflect legal, provider or Service changes. A material change will receive a new version and will be communicated before it applies where required. An update cannot remove a mandatory right or retrospectively authorise unlawful processing.

Termination or expiry of paid access does not by itself delete the Customer's organisation or records. Processing after expiry is limited to storage, export, account administration, security, lawful retention and other functions described in the Terms of Service and Privacy Policy until access is renewed or the organisation is lawfully deleted.

18. Contact

Data-processing and privacy enquiries may be sent to Jaco du Toit, Information Officer, at nuvationsolutions@gmail.com, or by telephone at 061 051 3710.