1. Introduction

This Data Processing Addendum ("DPA") sets out the standard terms under which Murmur Intelligence (Pty) Ltd ("we", "us", the processor, or the "operator" under POPIA) processes the personal data a customer (the controller, or the "responsible party" under POPIA) submits to llmeknow(the "Service"). It binds us and a customer when it is incorporated into an agreement with that customer or countersigned on request. It is written for customers subject to South Africa's POPIA, the GDPR, or the UK GDPR.

Enterprise customers may request a countersigned copy of this DPA, including executed transfer annexes where required, by contacting [email protected].

2. Definitions

Personal data (POPIA: "personal information"): information relating to an identified or identifiable person.
Processing: any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.
Controller (POPIA: "responsible party"): the party that decides why and how personal data is processed. Under this DPA, that is the customer.
Processor (POPIA: "operator"): the party that processes personal data on the controller's behalf. Under this DPA, that is us.
Subprocessor: a third party we engage to process personal data as part of providing the Service.
Data subject: the person the personal data relates to.

3. Scope and roles

We process customer personal data only to provide the Service as described in our Privacy Policy. The customer instructs the processing by using the Service and configuring campaigns, and remains responsible for the lawfulness of the personal data it submits.

4. Our obligations

We process personal data only on the customer's documented instructions.
We ensure that personnel authorised to process personal data are bound by confidentiality.
We implement the technical and organisational measures described in the Privacy Policy, including encryption in transit, access controls, row-level security in our database, and secret management.
We give the customer reasonable assistance with requests from data subjects to exercise their rights.
We notify the customer without undue delay of a personal data breach affecting their data.
We make available the information reasonably necessary to demonstrate compliance with this DPA.

5. POPIA operator terms

Where POPIA applies, we act as an operator under sections 20 and 21 of POPIA: we process personal information only with the responsible party's knowledge or authorisation, we treat personal information that comes to our knowledge as confidential, and we notify the responsible party immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

6. Subprocessors

The customer gives general authorisation for the subprocessors listed in section 6 of our Privacy Policy. Each subprocessor is bound by a data processing agreement or equivalent contractual protections. We will update the published list before adding a new category of subprocessor. The customer may object to a change on reasonable grounds relating to data protection by contacting us.

7. International transfers

Processing may occur in the regions named in the Privacy Policy, including South Africa, the European Union, and the United States. International transfers rely on appropriate safeguards, including standard contractual clauses offered by our subprocessors.

8. Return and deletion

Retention and deletion follow section 7 of our Privacy Policy. On account deletion, personal identifiers are anonymised as described there. Customers may request earlier deletion where the law allows.

9. Liability

Liability under this DPA is subject to the limitations and exclusions in our Terms of Service.

10. Governing law

This DPA is governed by the laws of South Africa, consistent with the Terms of Service.

11. Contact

Data processing enquiries: [email protected]