OPERATOR AGREEMENT
Data Processing Addendum
1. Parties and purpose
This Data Processing Addendum (“DPA”) forms part of the agreement between the HALO Finance customer (“Responsible Party”) and Created By Halo / HALO Finance (“Operator”) where HALO processes personal information on the customer's behalf.
2. Instructions
HALO will process customer-controlled personal information only with the knowledge or authorisation of the customer, for providing, securing, supporting and maintaining HALO Finance, or where processing is required by law. The customer is responsible for the lawfulness, accuracy and purpose of the information it instructs HALO to process.
3. Confidentiality
HALO will treat personal information it receives in the course of operating the service as confidential and will restrict access to persons or service providers that need access for authorised purposes.
4. Security measures
HALO maintains reasonable technical and organisational measures appropriate to the service, including tenant-isolated server-side access controls, prepared SQL statements, CSRF protection, secure session handling, password hashing, login throttling, audit logging, restricted executable uploads and security headers. Safeguards are reviewed and updated as risks or the platform change.
5. Security incidents
Where HALO has reasonable grounds to believe that customer-controlled personal information has been accessed or acquired by an unauthorised person, HALO will notify the customer without undue delay and provide information reasonably available to assist the customer with its POPIA obligations. The customer, as responsible party, remains responsible for notifications to the Information Regulator and affected data subjects where required.
6. Sub-operators
HALO may use hosting or infrastructure providers necessary to provide the service. HALO will take reasonable steps to ensure sub-operators processing customer personal information are subject to confidentiality and security obligations appropriate to the processing. Material changes should be recorded in HALO's subprocessor register.
7. Data subject requests
HALO will reasonably assist the customer with valid access, correction, deletion or other data subject requests relating to information HALO processes for that customer, taking account of the nature of the processing and legal retention obligations.
8. Return, export and deletion
On termination, HALO will make reasonable functionality or assistance available to export customer data where technically supported. Customer-controlled information will be deleted, de-identified or access-restricted when no longer lawfully required. Statutory financial records may be retained for the legally required period.
9. Audit and cooperation
On reasonable request, HALO will provide information necessary to demonstrate the controls applicable to the service, subject to security, confidentiality and third-party restrictions. Requests must not compromise another tenant's data or HALO's security.
10. Order of precedence
If this DPA conflicts with general service terms on the protection of personal information, this DPA prevails to the extent of that conflict.