Data Processing Agreement

1. Parties

This DPA forms part of and is incorporated into the End User Licence Agreement (EULA) between the parties. Execution of the EULA constitutes execution of this DPA.

2. Scope of Processing

2.1 Subject Matter

The Operator processes personal information for the purpose of providing the NutriTrack NSNP management platform to the Client.

2.2 Duration

Processing continues for the duration of the EULA and for such additional period as required for data retention under clause 6.

2.3 Nature of Processing

Storage, retrieval, display, transmission, editing, deletion and export of personal information submitted through the NutriTrack platform.

2.4 Categories of Data Subjects

• School principals and NSNP coordinators
• Voluntary Food Handlers (VFH)
• District and department officials
• Learners (aggregate data only — no individual learner identification)

2.5 Categories of Personal Information

• Names, job titles and contact details of school officials and food handlers
• ID numbers of food handlers (for payment records)
• School institutional information (EMIS, address, contact details)
• Feeding and nutrition programme data
• Aggregate learner counts per grade and gender

3. Obligations of the Operator

Azania Digital Solutions (Pty) Ltd, as Operator, agrees to:

3.1 Process Only on Instructions

Process personal information only in accordance with the Client's instructions as set out in the EULA and this DPA, unless required to do so by law. The Operator will notify the Client if any instruction is believed to violate POPIA or any other applicable law.

3.2 Implement Security Safeguards

Implement and maintain appropriate technical and organisational security measures to protect personal information against:

• Unauthorised access, loss or destruction
• Unlawful processing
• Accidental loss, alteration or disclosure

Current measures include: TLS encryption in transit, bcrypt password hashing, role-based access control, server-side session management, and regular backups.

3.3 Confidentiality

Ensure that all personnel who process personal information are subject to confidentiality obligations and receive appropriate data protection training.

3.4 Sub-processors

Not engage any sub-processor (third party who processes data on the Operator's behalf) without informing the Client. Current sub-processors are listed in the Privacy Policy. The Operator will impose equivalent data protection obligations on any sub-processor.

3.5 Data Subject Rights

Assist the Client in responding to requests from data subjects exercising their rights under POPIA, including rights of access, correction, deletion and objection. Where a data subject contacts the Operator directly, the request will be forwarded to the Client within 5 business days.

3.6 Breach Notification

Notify the Client of any personal information breach without undue delay and within 24 hours of becoming aware of it. Notification will include:

• A description of the nature of the breach
• Categories and approximate number of data subjects affected
• Categories and approximate volume of records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

The Client (as Responsible Party) is obligated to notify the Information Regulator within 72 hours under POPIA s.22.

3.7 Data Protection Impact Assessments

Provide reasonable assistance to the Client in conducting data protection impact assessments where required under POPIA.

3.8 Deletion on Termination

On termination of the EULA, provide the Client with a full export of all Client Data within 30 days. After 90 days from termination, permanently delete all Client Data from active systems. Backup copies will be deleted within 180 days.

3.9 Audit Rights

Allow the Client or its designated auditor to conduct audits of the Operator's data processing activities upon 30 days' written notice, no more than once per calendar year. Audit costs are borne by the Client.

4. Obligations of the Responsible Party (Client)

The Client agrees to:

• Ensure it has a lawful basis for processing personal information through the platform
• Ensure that data subjects have been informed of the processing as required by POPIA
• Obtain any necessary consents before submitting personal information to the platform
• Only submit personal information that is necessary and relevant for NSNP administration
• Ensure that only authorised users access the platform with appropriate credentials
• Notify the Operator promptly of any changes to processing instructions
• Maintain its own registration with the Information Regulator where required

5. Cross-Border Data Transfers

All personal information is stored on servers located in the Republic of South Africa (Johannesburg). The Operator will not transfer Client Data outside South Africa without the Client's written consent and only where the destination country provides an adequate level of protection as required by POPIA s.72.

6. Retention & Deletion

7. Liability

Each party shall be liable for POPIA violations caused by its own non-compliance. Where both parties are at fault, liability shall be apportioned in accordance with each party's degree of responsibility.

The Operator shall not be liable for violations caused by the Client's instructions where the Operator has notified the Client that such instructions would breach POPIA.

8. Contact for Data Protection Matters

9. Execution

This DPA is entered into by the parties on the date the Client first accesses the NutriTrack platform or executes the EULA, whichever is earlier. No wet signature is required — electronic acceptance is valid under the Electronic Communications and Transactions Act 25 of 2002 (ECT Act).

For formal procurement purposes where a signed DPA is required by the Client's supply chain management process, a countersigned PDF version is available upon request from legal@nutritrack.co.za.