This Data Processing Agreement ("DPA") forms part of the Terms of Service between LTV Labs (Pty) Ltd (registration number [REG NO]) ("LTV Labs", the "Operator") and the customer that has accepted those Terms (the "Customer", the "Responsible Party"). It records the written contract required by sections 20 and 21 of the Protection of Personal Information Act, 2013 ("POPIA") and applies whenever LTV Labs processes Customer Personal Information on the Customer's behalf.
1. Definitions
1.1 Terms such as "personal information", "processing", "responsible party", "operator", "data subject", "special personal information" and "Information Regulator" have the meanings given in POPIA.
1.2 "Customer Personal Information" means personal information that the Customer, its users or its data subjects submit to the Service, or that the Service receives or generates on the Customer's behalf, including contact records, message content and media.
1.3 "Sub-processor" means a third party engaged by LTV Labs that processes Customer Personal Information in order to provide the Service.
1.4 "Security Compromise" means a situation where there are reasonable grounds to believe that Customer Personal Information has been accessed or acquired by an unauthorised person.
1.5 Other capitalised terms have the meanings given in the Terms of Service.
2. Roles
2.1 The Customer is the responsible party for Customer Personal Information. It decides the purpose and means of processing, including whom to message, what to send and which features to enable.
2.2 LTV Labs is the Customer's operator. It processes Customer Personal Information only on the Customer's behalf, under the Customer's authority and in accordance with this DPA.
2.3 LTV Labs is a separate responsible party for personal information about account users, billing contacts and website visitors, as described in our Privacy Policy. This DPA does not apply to that information.
3. Subject matter, duration and nature of processing
3.1 Subject matter: provision of the LTV Labs business messaging and customer engagement platform, as described in the Terms of Service.
3.2 Duration: for the term of the Customer's subscription and the retrieval and deletion periods in clause 11.
3.3 Nature and purpose: hosting, storing, organising, transmitting, displaying, analysing and deleting Customer Personal Information in order to:
- send and receive messages through WhatsApp, Facebook Messenger, Instagram, email and the website chat widget;
- maintain contact records, conversation history, tags, segments and notes;
- run templates, broadcasts, flows, automations and funnels configured by the Customer;
- generate AI-assisted replies and summaries, and transcribe voice notes, when the Customer enables those features;
- synchronise orders and customer records from connected e-commerce platforms;
- send conversion events to Meta through the Conversions API when the Customer enables it;
- provide reporting, attribution and analytics to the Customer; and
- provide support, security, backups and troubleshooting.
3.4 Categories of data subjects: the Customer's customers, prospective customers, leads, website chat visitors, subscribers and other contacts, and the Customer's own staff where they appear in conversation data.
3.5 Categories of personal information: names, phone numbers, WhatsApp and social media identifiers, email addresses, physical and delivery addresses, message content, images, documents, voice notes and their transcriptions, order and purchase history, loyalty and segment data, tags, notes, consent and opt-out status, and technical data such as IP addresses of website chat visitors.
3.6 Special personal information and children: the Service is not designed to process special personal information or personal information of children. The Customer must not submit it unless it has a lawful basis under POPIA, and remains responsible for that processing.
4. Customer obligations
The Customer warrants and undertakes that:
- it has a lawful basis under POPIA for all Customer Personal Information it submits and for every processing instruction it gives, including valid consent for direct marketing as required by section 69 of POPIA and our Acceptable Use Policy;
- it has given data subjects the notifications required by section 18 of POPIA, including that their information will be processed by service providers such as LTV Labs and its Sub-processors;
- its instructions comply with POPIA and other applicable law; and
- it will respond to data subject requests and objections that it receives.
5. Processing only on instructions
5.1 LTV Labs will process Customer Personal Information only on the documented instructions of the Customer, unless required to do otherwise by law. The Customer's instructions are: the Terms of Service and this DPA; the Customer's configuration and use of the Service (including settings, automations and integrations it enables); and any other reasonable written instructions agreed between the parties.
5.2 LTV Labs will inform the Customer if, in its opinion, an instruction infringes POPIA, and may suspend that processing until the instruction is confirmed or changed.
5.3 LTV Labs will not sell Customer Personal Information, use it for its own marketing, or use it to train AI models. LTV Labs may create aggregated or de-identified data that does not identify any data subject or the Customer, and use it to operate and improve the Service.
6. Confidentiality
6.1 As required by section 21 of POPIA, LTV Labs will treat Customer Personal Information as confidential and will not disclose it except as permitted by this DPA, with the Customer's authorisation, or as required by law.
6.2 LTV Labs will ensure that its employees and contractors who have access to Customer Personal Information are bound by written confidentiality obligations and have access only to the extent needed to perform their duties.
7. Security measures
7.1 LTV Labs will establish and maintain appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of Customer Personal Information, as required by section 19 of POPIA. These currently include:
- encryption of data in transit using TLS, and encryption at rest of third-party credentials and access tokens using AES-256-GCM;
- logical separation of each customer's data in the database, with row-level tenant isolation controls;
- role-based access control within customer accounts, and audit logs of significant actions;
- hashed passwords, passkey (WebAuthn) support and secure session management;
- restricted, least-privilege staff access to production systems, with administrative actions logged;
- verification of webhook signatures from Meta and e-commerce platforms;
- regular backups and the ability to restore;
- monitoring, logging and alerting for errors and suspicious activity; and
- vulnerability management, including keeping software dependencies up to date.
7.2 LTV Labs will regularly review and update these measures in response to new risks, and will not materially reduce the overall level of security during the subscription.
7.3 The Customer is responsible for the security of its own accounts, devices and credentials, for assigning appropriate roles to its users, and for the security of third-party accounts it connects.
8. Sub-processors
8.1 The Customer authorises LTV Labs to engage the following Sub-processors:
- Meta Platforms, Inc. and Meta Platforms Ireland Ltd: WhatsApp Cloud API, Messenger and Instagram messaging, Meta Ads and Conversions API (United States, European Union and other Meta locations);
- Anthropic, PBC: AI language models used for AI replies, summaries and suggestions (United States);
- OpenAI, L.L.C.: voice-note transcription (United States);
- PayFast (Payfast by Network): payment processing and card tokenisation (South Africa);
- [EMAIL PROVIDER]: transactional and customer email delivery ([EMAIL PROVIDER REGION]);
- [HOSTING PROVIDER, REGION]: infrastructure hosting, databases, file storage and backups; and
- Shopify Inc. and WooCommerce (via the Customer's own store): only when the Customer connects its store, for the synchronisation of orders and customer records.
8.2 LTV Labs will impose on each Sub-processor, by written agreement, data protection obligations that are no less protective than those in this DPA, to the extent applicable to the services provided. LTV Labs remains responsible to the Customer for the performance of its Sub-processors' obligations.
8.3 Some Sub-processors (in particular Meta) are also independent providers whose services the Customer uses under its own agreements with them. Meta processes WhatsApp, Messenger and Instagram messages under the Customer's own acceptance of Meta's terms.
8.4 Changes. LTV Labs will give the Customer at least 30 days' notice before adding or replacing a Sub-processor, by email to the account owner or by notice in the app, and will update the list above. The Customer may object on reasonable data protection grounds by emailing privacy@ltvlabs.co.za within that period. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer may terminate the affected part of the Service before the change takes effect, and will receive a pro rata refund of any prepaid fees for the terminated part. Where a change is urgently required for security or continuity reasons, LTV Labs may give shorter notice.
9. Cross-border transfers
9.1 The Customer acknowledges that some Sub-processors process Customer Personal Information outside South Africa, as indicated in clause 8.
9.2 LTV Labs will transfer Customer Personal Information outside South Africa only where permitted by section 72 of POPIA, including where the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection substantially similar to POPIA, or the transfer is necessary for the performance of the contract between the Customer and LTV Labs.
9.3 The Customer is responsible for informing its data subjects that their personal information may be transferred outside South Africa.
10. Security compromises
10.1 As required by section 21(2) of POPIA, LTV Labs will notify the Customer without undue delay, and where reasonably possible within 72 hours, after becoming aware of a Security Compromise affecting Customer Personal Information.
10.2 The notice will, to the extent known, describe the nature of the compromise, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed to address it, and a contact person. LTV Labs may provide information in phases as it becomes available.
10.3 LTV Labs will take reasonable steps to contain and remedy the Security Compromise and will give the Customer reasonable assistance to meet its obligation under section 22 of POPIA to notify the Information Regulator and affected data subjects. The Customer, as responsible party, is responsible for those notifications unless the parties agree otherwise in writing.
11. Return and deletion
11.1 While the subscription is active, the Customer can export contact data and other key data from the Service, and can delete individual contacts, conversations and records.
11.2 After the Customer's account is closed or terminated, LTV Labs will retain Customer Personal Information for a 30-day retrieval period, during which the Customer may request an export. LTV Labs will then delete or de-identify Customer Personal Information within a further 60 days, unless retention is required by law.
11.3 Customer Personal Information in backups will be overwritten in the ordinary backup cycle and will remain protected by this DPA until then.
12. Assistance
12.1 Data subject requests. Taking into account the nature of the processing, LTV Labs will provide the Customer with tools in the Service, and reasonable additional assistance, to respond to requests from data subjects to access, correct, delete or object to the processing of their personal information. If LTV Labs receives a request directly, it will refer it to the Customer and will not respond itself except to direct the data subject to the Customer, unless required by law.
12.2 Regulators. LTV Labs will give reasonable assistance to the Customer in dealing with the Information Regulator in connection with the processing under this DPA, and will notify the Customer of any request it receives from a regulator or authority about Customer Personal Information, unless prohibited by law.
12.3 Impact assessments. LTV Labs will provide reasonable information to help the Customer carry out any personal information impact assessment relating to the Service.
12.4 Assistance beyond what the Service provides as standard may be charged at reasonable rates agreed in advance.
13. Audits
13.1 On written request, not more than once in any 12-month period (or more often following a Security Compromise or a regulator's request), LTV Labs will provide information reasonably necessary to demonstrate its compliance with this DPA, such as a description of its security measures, completed security questionnaires and any available third-party reports.
13.2 If that information is not reasonably sufficient, the Customer may, at its own cost and on at least 30 days' notice, conduct an audit through an independent auditor bound by confidentiality, during business hours, in a way that does not disrupt the Service or compromise the security or confidentiality of other customers' data.
14. Liability
The limitations and exclusions of liability in the Terms of Service apply to this DPA. Nothing in this DPA limits the Customer's indemnity in respect of its own processing and instructions.
15. General
15.1 This DPA continues for as long as LTV Labs processes Customer Personal Information on the Customer's behalf.
15.2 If there is a conflict between this DPA and the Terms of Service regarding the processing of Customer Personal Information, this DPA prevails.
15.3 This DPA is governed by the laws of the Republic of South Africa.
15.4 Questions about this DPA may be sent to our Information Officer, Juron Maree, at privacy@ltvlabs.co.za, or by post to [ADDRESS].