Data Processing Agreement

Logo

This Data Processing Agreement (the "DPA") forms part of Infokerk's normal agreement with churches and other customers using our products and services. Infokerk reserves the right to make changes to the respective Agreements at any time without notice. Any updated versions of the aforesaid Agreements will be posted on our websites.

Introduction

This DPA applies when you sign up for our products and services, and Infokerk acts as the Processor of your Personal Data Information. When we provide these services to you, you are the Responsible Party of the Personal Data Information that you collects from your members and that we process on your behalf.

As our customers are aware, the EU's General Data Protection Regulation (GDPR) came into effect on 25 May 2018 and South Africa's Protection of Personal Information Act (POPIA) came into effect on 1 July 2021. Many organisations have geared up to comply with their regulatory obligations under data protection law by these dates. We have done the same. We are committed to complying with our obligations in data protection law, including in our role as a operator for our customers.

What role does Infokerk perform for you?

We are the responsible party of your personal data when you sign up with us. We are the operator when we store the personal data of your data subjects that you have uploaded to our servers by using our Winkerk, Backup Buddy and Winkerk Online software.

When we provide services to you, you are the resposible party for the personal data you process because you decide the purpose and means of how the personal data of your data subjects gets processed. This means that you decide how and why we process your data when we provide services to you. You are responsible or accountable for complying with data protection laws for the personal data of your data subjects.

As a processor, we merely process the personal data on your behalf, such as hosting your data on our managed hosting servers.

What are the data protection law requirements?

As the responsible party, POPIA requires you to conclude agreements with your operators when they process the personal information of your data subjects.

At Infokerk, we have taken the proactive step to update our Terms of Service in line with the requirements in terms of POPIA. This means that you do not need to use your own DPA because these requirements have been included in our DPA, Terms of Use and Privacy Statement policies.

Definitions and interpretations

  • "Responsible Party" means the person who decides why and how Personal Information will be processed. This would be you, our customer.
  • "Data Protection Law" means any and all data protection laws and regulations that apply to Infokerk’s Processing of Personal Information under the DPA including, the GDPR, the Protection of Personal Information Act 4 of 2013, and to the extent applicable, the data protection or privacy laws of any other country.
  • "Data Subject" means the person whose data is processed, which are your members.
  • "Personal Information" means any data or information that relates to an individual who can be directly or indirectly identified. For example, names, surnames, email addresses, physical addresses, phone numbers, etc. are examples of Personal Information. Location information, ethnicity, gender, biometric data, religious beliefs, web cookies, and political opinions can also be Personal Information.
  • "Personal Data Breach" means any unauthorized or otherwise unlawful processing of Personal Information.
  • "Process Processing" means any action performed on data, whether automated or manual. This would include collecting, recording, organizing, structuring, storing, using, or erasing of Personal Information. Thus, basically doing anything with data.
  • "Processor Operator" means Infokerk, a third party that processes Personal Information on behalf of a Responsible Party.
  • "Sub processor or Sub operator" means any person appointed by or on behalf of the Processor Operator to process Personal Information on behalf of Infokerk in connection with the Agreement.

Agreement Subject Matter

  1. Application. The DPA applies when Infokerk Processes your Personal Information subject to the applicable Data Protection Law.
  2. Acceptance. By using our products and services you are deemed to have read, understood, accepted, and agreed to be bound by all of the terms of the respective Agreements.
  3. Duration. Infokerk will process Personal Information until the Principal Agreement expires or terminates, unless otherwise agreed in writing.
  4. Limitations. This DPA does not apply where Infokerk Processes data on either the Responsible Party or Data Subject's behalf in terms of any activity not set out in the Principal Agreement.

Data Processing and Protection

  1. Processor's Obligations
    1. Processing of Data
      • Infokerk will comply with the applicable Data Protection Law when Processing Personal Information and will only process Personal Information as agreed upon between Infokerk and the Responsible Party.
      • Responsible Party instructs Infokerk to Process Personal Information to provide the services and related technical support in terms of the Principal Agreement.
    2. Data Transfer
      • Infokerk may only transfer Personal Information to a third country on a Responsible Party's documented instructions.
      • Infokerk must advise the Responsible Party about the legal requirement before Processing the Personal Information unless the law prohibits them from doing so in the public interest. The Parties agree that the DPA and Principal Agreement constitute the Responsible Party's documented instructions for Processing Personal Information.
    3. Processors Operator Personnel
      • Infokerk will take reasonable steps to ensure that persons authorised by Infokerk to Process any Personal Information are subject to appropriate confidentiality obligations.
      • Infokerk imposes appropriate contractual obligations upon its personnel, including relevant obligations regarding confidentiality, data protection and data security.
    4. Security Measures
      • Data Security

        • Infokerk will implement appropriate technical and organisational security measures to ensure a level of security appropriate to the risk, including, the measures referred to in Data Protection Law. In assessing the appropriate level of security, Infokerk will pay special attention to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Information transmitted, stored, or otherwise processed.

      • Personal Information Breach

        • Infokerk will notify the Responsible Party without undue delay after becoming aware of a Personal Data Information Breach.

      • Assistance to Responsible party

        • Any Personal Information breach notification Infokerk makes to assist the Responsible Party will include information Infokerk is reasonably able to disclose, taking into account:

        1. the technical and organisational measures the Responsible Party requires to fulfil its obligation to respond to requests by Data Subjects, and
        2. the nature of processing, the information available to Infokerk, and any restrictions on disclosing the information, such as confidentiality, trademarks and trade secrets.
    5. Authorised Subprocessors or Suboperators

      6. The Responsible Party authorises Infokerk to engage the following categories of Subprocessors or Suboperators that are mostly located in the European Union, for the Data Processing activities related to the services described in the Principal Agreement and our Privacy Policy:

      • Registrars for domain names;
      • Hosting services;
      • or any other services necessary to provide services to you.

  2. Responsible Party's Obligations
    1. Warranties

      2. Responsible Party warrants that it has all necessary rights to provide the Personal Information to Infokerk.

    2. Responsibilities
      • provide all necessary privacy notices to Data Subjects;
      • obtain any necessary Data Subject consent to the Processing;
      • maintain a record of such consent.

General Terms

  1. Confidentiality

    2. Infokerk will keep all Personal Information confidential and will not disclose it to any third party.

  2. Notices

    3. All notices and communications given under this Agreement must be in writing and will be sent via email. Responsible Party will be notified via email sent to the address related to its use of the Services under the Principal Agreement. Infokerk will be notified via email, sent to the address: jan@infokerk.co.za

  3. Liability and indemnity

    4. Each Party indemnifies the other and holds them harmless against all claims, actions, third party claims, losses, damages, and expenses that the other party incurs arising out of a breach of this DPA or Applicable Data Protection law by the indemnifying party.