Data Protection
How Veld handles personal information as your operator under POPIA — incorporated into each client’s signed Service Order that refers to them.
These Data Processing Terms apply whenever Veld Data (Pty) Ltd (“Veld”, “we”, “us”) processes personal information on behalf of a client (“you”) under a Service Order. Once incorporated into a signed Service Order, they form the written contract required by section 21(1) of POPIA, and they are the operator / data-processing agreement referred to in section 8 of Veld’s Managed Service Terms & Conditions (the “Managed Service Terms”). Where these Data Processing Terms and the Managed Service Terms deal with the same data-protection matter, these Data Processing Terms apply; where your Service Order says something specific, the Service Order applies.
You are the responsible party for Client Personal Information, and Veld is your operator.
Veld processes Client Personal Information only with your knowledge or authorisation, only for the purposes of your Service Order, and on your documented instructions. Your Service Order, these Data Processing Terms and any further instructions from your main contact within the scope of your Service Order (email is enough) are your documented instructions.
If Veld believes an instruction would breach POPIA, it will tell you and may pause the affected processing until the matter is resolved.
You are responsible for having a lawful basis for the personal information held in your own systems and for the instructions you give. Veld configures the Data Layer to leave out the categories of data your Service Order excludes. If Veld finds that excluded data has been copied, for example inside a free-text field, it deletes it and tells you.
Veld treats Client Personal Information as confidential and does not disclose it except as these Data Processing Terms, your Service Order or the law allow.
Only Veld staff and contractors who need access to deliver the service may access Client Personal Information, and Veld ensures that each of them is bound by confidentiality obligations.
Veld secures the integrity and confidentiality of Client Personal Information by taking appropriate, reasonable technical and organisational measures to prevent its loss, damage or unauthorised destruction, and its unlawful access or processing.
Having due regard to generally accepted information security practices and procedures, including any industry or professional rules that apply to it, Veld takes reasonable measures to:
Your Service Order records any specific measures agreed for your engagement, such as read-only access to your systems, categories of data left out at the source, access limited by role, and a log of requests made through Veld’s connector.
Veld notifies you immediately where there are reasonable grounds to believe that Client Personal Information has been accessed or acquired by an unauthorised person. Veld gives notice by email to your main contact and follows up by phone.
Veld’s notice states, as far as then known, what happened and when, the categories of personal information and data subjects affected, the likely consequences, the steps taken or proposed, and the identity of the unauthorised person, if known.
Veld then takes reasonable steps to contain the compromise, keeps you informed as more becomes known, and helps you notify the Information Regulator and affected data subjects under section 22 of POPIA. As responsible party, you decide on and make those notifications.
Veld may use sub-operators, such as cloud hosting providers, to deliver the service. They include Veld’s own business tools, such as email, video calls and ticketing, where Client Personal Information is shared through them. Before Client Personal Information is loaded, Veld tells you in writing (in your Service Order or by email) which sub-operators process Client Personal Information and where.
Veld gives you written notice before adding or replacing a sub-operator. You may object on reasonable data-protection grounds, and the parties will then discuss alternatives in good faith.
Veld uses only sub-operators bound by written terms that require them to process Client Personal Information only on instructions, keep it confidential and maintain security measures consistent with section 19 of POPIA. Veld remains responsible to you for their processing of Client Personal Information.
Veld transfers Client Personal Information outside South Africa to a sub-operator only if that sub-operator and its location have been notified to you under section 6. Veld ensures that each such sub-operator is bound by a written agreement that provides an adequate level of protection, as described in section 72(1)(a) of POPIA, including on any onward transfer.
Where you instruct Veld to send Client Personal Information to a third party outside South Africa, including an AI tool, such as Claude, that you connect under your own agreement with its provider (for example through Veld’s connector), the provider processes it under that agreement. As responsible party, you are responsible for that transfer meeting section 72 of POPIA, including any prior authorisation that section 57 requires for special personal information or children’s personal information.
Veld does not use Client Personal Information to train AI models.
Veld does not put Client Personal Information into any AI service other than (a) AI tools you use under your own account and (b) AI services notified to you as sub-operators under section 6, unless you approve it in writing first (an email from your main contact is enough).
If Veld receives a request from a data subject about Client Personal Information, it passes the request to you promptly and does not respond itself unless you instruct it to.
Veld gives you reasonable help to respond to data subjects’ requests to access, correct, delete or object to the processing of their personal information, and to deal with the Information Regulator in connection with the service.
Veld keeps Client Personal Information only for as long as it is needed to deliver the service, and applies any retention rules agreed with you.
When your Service Order ends, Veld returns your data as your Service Order sets out. Within the period in your Service Order or, if none is stated, within thirty (30) days after the return, Veld deletes Client Personal Information from the Data Layer and the other production environments it controls, and confirms this in writing.
Copies in backups are overwritten in Veld’s normal backup cycle and are not restored or used in the meantime. Client Personal Information held incidentally in Veld’s business records, such as emails and support tickets, stays subject to these Data Processing Terms until it is deleted in the ordinary course. Veld keeps Client Personal Information where the law requires it to.
On reasonable written notice, Veld answers your reasonable written questions about how it protects Client Personal Information, including questions raised by your own clients or regulators, and gives you the information reasonably needed to show that it complies with these Data Processing Terms. Unless there has been a security compromise or the Information Regulator requires the information, Veld answers these questions no more than once a year.