Operator agreement
The written agreement POPIA s21 requires between you and us. Same on every plan.
This is a plain-language notice, not legal advice and not the agreement itself. Where this page and the signed agreement differ, the agreement governs.
Last updated 17 September 2026 · legal@vumasign.com
Why this document exists
POPIA s21 requires a responsible party to have a written agreement with its operator. Your compliance file needs the document itself — not a paragraph on a website saying one exists — so this page describes what is in it and we will send you the signed version with the account.
It is the same agreement on every plan, including the free one. A tiered operator agreement would be an odd thing to offer: the duty does not scale with the invoice.
Processing only on your instruction
We process personal information in your documents to provide the service, and for no purpose of our own. If we were ever required by law to do something else with it, we would tell you unless the law forbade us from telling you.
Confidentiality
Everyone with access to production systems is bound to confidentiality, and access is limited to the people who operate them.
Security measures
The s19 measures are named in the agreement rather than referenced: residency in South Africa, row-level isolation per organisation, an append-only audit trail, encryption in transit and at rest, and restricted production access. Naming them means we can be held to them.
Notification
If there are reasonable grounds to believe personal information has been accessed by an unauthorised person, we notify you without undue delay, so that you can meet your own s22 obligation to the Regulator and to the people affected.
Helping you answer people
We assist with data subject requests you receive, and with any enquiry from the Information Regulator that concerns processing we carried out for you.
Sub-operators
We use infrastructure providers to run the service, and they are all within South Africa for the data this agreement covers. We do not appoint a sub-operator outside the country.
When it ends
On termination we return or delete your data at your election. Export everything you need first: a sealed document verifies without us, which is precisely why you should be holding your own copies.