1. Roles and instructions
The Customer is ordinarily the controller/responsible party for Customer Personal Data; Vidabug is its processor/operator where acting solely under documented instructions. Roles may differ for independently controlled account, billing or security data.
Processing is limited to the signed work order and documented customer instructions. The Customer is responsible for lawful collection and appropriate notice to data subjects.
2. Processing schedule
Subject matter: software analysis, test planning, authorised agent execution, reporting, video narration and secure delivery. Duration: the agreed service term plus lawful retention and deletion cycle. Categories: authorised developers, testers, end users and other individuals represented in necessary logs or source samples.
Personal data types may include names, account identifiers, business email, pseudonymous test events, screenshots and log records. Sensitive or regulated data requires a separately approved scope and safeguards.
3. Confidentiality, security and subprocessors
Authorised personnel must be bound to confidentiality. Vidabug must maintain documented, appropriate technical and organisational measures proportional to the risks and agreed processing; future security controls must be verified before production activation.
Vidabug will disclose and maintain a subprocessor register. The approved model provider, cloud sandbox, code host, storage host, speech provider and gateway are determined by the actual customer configuration; new subprocessors are handled under the agreed notice/objection mechanism.
4. International transfers
Transfers outside South Africa or other applicable jurisdictions require an appropriate legal transfer basis, contractual protections and, where necessary, supplementary technical measures. The Customer must receive the relevant routing and location information before activation.
5. Security incidents
Vidabug will inform the Customer without undue delay after becoming aware of a confirmed security incident involving Customer Personal Data, with enough available details to support Customer investigation and legal reporting. This contractual obligation does not replace the responsible party's POPIA notifications.
A detailed escalation matrix, emergency contact and notification timing must be finalised in the enterprise order; no invented universally applicable statutory deadline is asserted.
6. Assistance, audits and end of service
Subject to proportionality, confidentiality and agreed charges, Vidabug will assist with access requests, security assessment, impact assessments and reasonable compliance inquiries. Independent penetration-test reports can only be offered if they actually exist.
At termination, Customer may request export or deletion subject to the documented retention schedule and applicable legal holds. Subprocessor contracts must support comparable controls.
7. Execution and hierarchy
This template requires customer/entity details, authorised representatives, subprocessor schedule, technical-organisational measures, processing locations and signatures before becoming a binding DPA. It supplements the signed Master Services Agreement and does not silently bind parties merely through publication.