Why this document exists. Under POPIA a firm using Ledger Data is the responsible party for the personal information in its data room. We are its operator. Section 21 requires a written contract between them obliging the operator to establish and maintain the security measures in section 19. Without one, the firm is not compliant — so this is as much a document the firm needs as one we need.
1. Parties and standing
This agreement is between the firm holding an account ("the Responsible Party") and Asset Disposal Consultancy (Pty) Ltd, registration number 2018/621824/07, trading as Ledger Data ("the Operator"). It forms part of the Terms of Use and applies for as long as the Operator holds personal information on the Responsible Party's behalf.
2. Subject matter
| Purpose | Operating a hosted data room so the Responsible Party can store, organise and selectively disclose documents relating to its appointments. |
|---|---|
| Duration | While the account is open, plus the 60-day export period after it closes. |
| Categories of data subject | The Responsible Party's own personnel; viewers and other outside parties it invites; and any individual whose personal information appears in documents it uploads. |
| Types of personal information | Names, email addresses, telephone numbers, company names, access and audit records, and whatever appears within the uploaded documents — which is determined by the Responsible Party, not by us. |
3. The Operator's obligations
- Only on instruction. We process personal information only for the purpose above and on the Responsible Party's documented instruction, unless required by law — in which case we will tell the Responsible Party before processing, unless the law forbids it.
- Confidentiality. Everyone we authorise to process the information is bound to confidentiality. We do not read a firm's documents except as strictly necessary to operate or support the service.
- Security. We maintain the measures set out in section 6 below, as section 19 requires, and will not materially weaken them during the term.
- Notification. If we have reasonable grounds to believe personal information has been accessed by anyone unauthorised, we will notify the Responsible Party without undue delay and give it what it needs to meet its own obligations under section 22.
- Assistance. We will assist the Responsible Party, at its cost where the work is substantial, in answering requests from data subjects and in dealing with the Regulator.
- Return or deletion. On termination we make the documents available for export for 60 days, then delete them and the personal information in them, except what the law requires us to keep.
- Demonstrating compliance. On reasonable written request, and not more than once a year unless there has been a security compromise, we will provide the information needed to show we are meeting this agreement.
4. The Responsible Party's obligations
- To have a lawful basis for the personal information it puts into its data room, and to have given the notices POPIA requires to the people concerned.
- To decide who may see what, and to keep those decisions current — including removing access when a person leaves or a viewer withdraws.
- To keep its own accounts secure, not to share them, and to turn on two-step sign-in.
5. Sub-operators
The Responsible Party authorises the following sub-operators. We will give at least 30 days' notice before adding or replacing one, and the Responsible Party may terminate rather than accept a change it objects to.
| Hetzner Online GmbH | Hosting of the application, the documents and the database. Servers in Helsinki, Finland. |
|---|---|
| Postmark (ActiveCampaign, LLC) | Sending the emails the service generates — invitations, sign-in links, notices. Receives names and email addresses, not documents. United States. |
| Microsoft (OneDrive) | Storage of backups. Backups are encrypted before they leave our control, so the contents are not readable by the storage provider. |
| Afrihost | Domain registration for ledgerdata.co.za. No personal information of users passes to them. |
Personal information is stored in Finland and email is sent through a provider in the United States. Section 72 of POPIA permits this where the recipient is subject to a law or binding agreement upholding comparable principles; our providers are engaged under written data processing terms, and Finland is subject to the GDPR.
6. Security measures
These are the measures referred to in section 3(3), and they describe what is actually in place rather than what is aspired to:
- TLS on every connection, with automatically renewed certificates.
- Passwords stored as one-way hashes; two-step sign-in by authenticator app or emailed code.
- Rate limiting on sign-in, invitation tokens and two-step codes.
- CSRF protection registered at the application, so it covers routes added later.
- Multi-tenancy enforced on every query by the firm identity held in the session, never by anything supplied in a request.
- Documents watermarked per recipient on delivery; the stored original is never altered.
- An append-only audit trail enforced by database triggers, which refuse updates and deletions.
- The application runs under a dedicated unprivileged account, listens only on localhost behind the web server, and the host firewall permits ports 22, 80 and 443 only.
- Encrypted off-site backups, with restoration tested.
Known gap: uploads are not yet scanned for malware. Files are never executed or opened on our servers, but they are delivered as they arrived.
7. Liability and law
Liability under this agreement is subject to the limits in the Terms of Use. This agreement is governed by South African law and the parties submit to the jurisdiction of the Western Cape Division of the High Court.
8. Contact
Information Officer: John Bruce Taylor · jt@asset-disposal.co.za ·
Asset Disposal Consultancy (Pty) Ltd, Cape Town, Western Cape, South Africa.
Full registered address on request, by email.