POPIA Compliance

1. Our Commitment to POPIA

OneDash is fully POPIA compliant: it processes customer data lawfully, secures information with technical and organisational controls, and supports data subject rights across its messaging, CRM, invoicing, and AI services.

Fadaeco (Pty) Ltd, trading as OneDash ("OneDash", "we", "us", or "our"), is fully committed to complying with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPIA") of the Republic of South Africa. As both a responsible party and an operator (processor) of personal information, we have implemented comprehensive measures to ensure the lawful, fair, and transparent processing of personal information.

POPIA is South Africa's primary data protection legislation, aligned with international standards including the EU General Data Protection Regulation (GDPR). It establishes conditions for the lawful processing of personal information and grants data subjects specific rights regarding their personal data.

2. Roles & Responsibilities

OneDash as Responsible Party

When we collect personal information directly from users (account registration, support interactions, website visits), OneDash acts as the responsible party under POPIA. We determine the purpose and means of processing this data.

OneDash as Operator

When our customers use the OneDash platform to process their own customers' personal information (e.g., CRM contacts, chat messages, invoicing records), OneDash acts as an operator (data processor). Our customers remain the responsible party for that data, and we process it solely on their instructions and in accordance with our Data Processing Agreement.

3. POPIA Conditions for Lawful Processing

We adhere to all eight conditions for lawful processing as defined in POPIA:

3.1 Accountability

We have appointed an Information Officer responsible for ensuring POPIA compliance, handling data subject requests, and liaising with the Information Regulator. All staff receive POPIA awareness training.

3.2 Processing Limitation

We only collect personal information that is adequate, relevant, and not excessive for the purpose for which it is processed. We obtain consent where required and provide alternative legal bases (contractual necessity, legitimate interest, legal obligation) where applicable.

3.3 Purpose Specification

Personal information is collected for specific, explicitly defined, and lawful purposes. We do not process personal information for secondary purposes incompatible with the original purpose without additional consent.

3.4 Further Processing Limitation

Any further processing of personal information is compatible with the original purpose of collection. We assess compatibility based on the nature of the information, potential consequences, and the relationship between ourselves and the data subject.

3.5 Information Quality

We take reasonable steps to ensure personal information is complete, accurate, not misleading, and updated where necessary. Users can update their information through their account settings or by contacting us.

3.6 Openness

We maintain transparency about our processing activities through this POPIA policy, our Privacy Policy, and our registration with the Information Regulator. Data subjects are notified at the time of collection about how their data will be used.

3.7 Security Safeguards

We implement appropriate technical and organisational measures to protect personal information, detailed in Section 5 below.

3.8 Data Subject Participation

We respect and facilitate data subject rights, detailed in Section 6 below.

4. Lawful Grounds for Processing

We process personal information under the following lawful grounds:

• Consent: Where you have given explicit consent (e.g., marketing communications, cookie preferences).
• Contractual Necessity: Processing required to fulfil our agreement with you (e.g., account creation, service delivery, billing).
• Legal Obligation: Processing required by South African law (e.g., tax records, regulatory reporting).
• Legitimate Interest: Processing necessary for our legitimate business interests, balanced against your rights (e.g., platform security, service improvement, fraud prevention).

5. Security Measures

In accordance with Section 19 of POPIA, we maintain the following security safeguards:

Technical Measures

• Encryption: All data encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Access Control: Role-based access control (RBAC) with granular, module-level permissions.
• Authentication: Secure password hashing, JWT-based session management.
• Audit Trails: Comprehensive logging of all data access, modifications, and system events.
• Infrastructure: Primary data centre in Johannesburg with disaster recovery; 99.9% uptime SLA.
• Secure Storage: Documents and media stored on encrypted cloud storage (Cloudflare R2).

Organisational Measures

• POPIA awareness training for all employees.
• Data processing agreements with all third-party operators.
• Regular security assessments and vulnerability testing.
• Incident response procedures for data breaches.
• Access on a need-to-know basis only.

6. Data Subject Rights

Under POPIA, you have the following rights regarding your personal information:

To exercise any of these rights, submit a request to our Information Officer at [email protected]. We will respond within 30 days as required by POPIA Section 18.

7. Cross-Border Transfers

Your data is primarily stored and processed in South Africa. Where personal information is transferred to another country (e.g., for AI processing services), we ensure:

• The recipient country has adequate data protection legislation, or
• Appropriate safeguards are in place (binding agreements, standard contractual clauses), or
• The data subject has consented to the transfer, or
• The transfer is necessary for the performance of the contract.

8. Data Breach Notification

In the event of a security breach that compromises personal information, we will:

• Notify the Information Regulator as soon as reasonably possible, as required by Section 22 of POPIA.
• Notify affected data subjects unless identity cannot be established.
• Provide details of the nature of the breach, likely consequences, and measures taken to address it.
• Customers (as responsible parties) will be notified immediately so they can fulfil their own notification obligations.

9. Retention & Disposal

We do not retain personal information longer than necessary for the purposes for which it was collected, unless:

• Retention is required by South African law (e.g., Companies Act, Tax Administration Act).
• Retention is required for historical, statistical, or research purposes with adequate safeguards.
• The data subject has consented to extended retention.

When personal information is no longer needed, it is destroyed, deleted, or de-identified in a manner that prevents reconstruction.

10. For Our Customers (Responsible Parties)

If you use OneDash to process your customers' personal information, you are the responsible party under POPIA. You must:

• Ensure you have a lawful basis to collect and process personal information through the platform.
• Provide your customers with appropriate POPIA notifications.
• Configure appropriate data retention settings within the platform.
• Use the platform's RBAC features to restrict access to personal information on a need-to-know basis.
• Report any suspected breach to us immediately.

OneDash has a Data Processing Agreement available upon request to formalise the operator relationship.

11. Information Officer

Our appointed Information Officer can be contacted at:

• Email: [email protected]
• Address: Johannesburg, South Africa

You also have the right to lodge a complaint with the Information Regulator:

• Website: www.justice.gov.za/inforeg
• Email: [email protected]