Data Processing Addendum

1. Scope and order of precedence

1.1 This Data Processing Addendum ("DPA") forms part of the Trident Terms of Service between Assegai Analytics ("Assegai", the "Processor") and the organisation that subscribes to Trident Protect ("you", the "Controller"). It applies whenever Assegai processes personal information on your behalf in providing Trident.

1.2 If this DPA conflicts with the Terms of Service on the processing of personal information, this DPA prevails. If you have appointed Assegai as your Data Protection Officer (through the DPO Appointment Service or Plan Plus), the DPO terms govern that role; this DPA still governs Assegai's processing of your data.

1.3 In this DPA, the Act means the Cyber and Data Protection Act [Chapter 12:07]; SI 155 means the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024; the Authority means the Data Protection Authority (POTRAZ); Customer Data means personal information you or your users submit to Trident, or that Assegai processes for you; Security Incident means an actual or reasonably suspected breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data; Sub-processor means a third party Assegai engages to process Customer Data.

2. Roles

2.1 You are the controller of Customer Data and Assegai is your processor. Assegai processes Customer Data only to provide Trident and the services you order, and for no other purpose.

2.2 Assegai is a separate controller for information it uses for its own purposes: account administration, billing, security, and aggregated, anonymised service statistics. Its Privacy Notice covers that processing.

2.3 You are responsible for having a lawful basis under the Act for the Customer Data you put into Trident, including any written consent required for sensitive, health, biometric or children's information (sections 11 and 12 of the Act; CDPG 2 of 2024), and for the accuracy of your instructions.

3. Your instructions

3.1 Assegai processes Customer Data only on your documented instructions (section 17 of the Act). This DPA, the Terms of Service, your configuration of Trident and the actions your authorised users take in it are your complete instructions. Additional instructions must be in writing and consistent with the Terms.

3.2 Assegai will tell you promptly if it believes an instruction breaks the Act, and may suspend that processing until the instruction is confirmed or changed.

3.3 Assegai will not sell Customer Data, use it for its own marketing, or combine it with other customers' data except in aggregated, anonymised form that cannot identify you or any individual.

4. Artificial intelligence

4.1 Where you use an AI-assisted feature, Assegai sends only the content needed for that task to the AI Sub-processor that serves that feature (listed in Annex 3) and returns a draft for your review. AI output is a draft; you decide whether to use it.

4.2 Assegai does not use Customer Data to train or improve AI models, and its contract with each AI Sub-processor prohibits that provider from doing so. Each AI Sub-processor deletes the content within 30 days unless a shorter period applies. Annex 3 may list more than one AI Sub-processor. Each AI feature uses one of them at a time, and Assegai may switch a feature between the AI Sub-processors listed in Annex 3 without further notice. Assegai will not send Customer Data to any AI provider that is not listed in Annex 3; adding one is a change under clause 7.

5. Confidentiality and personnel

Assegai ensures that everyone it authorises to process Customer Data is bound by a duty of confidentiality, receives data-protection training, and has access only to what their role requires.

6. Security

6.1 Assegai implements and maintains the technical and organisational measures in Annex 2, appropriate to the risk and designed to protect the confidentiality, integrity and availability of Customer Data and the ability to restore it (section 18 of the Act; SI 155 section 16).

6.2 Assegai may update the measures, but will not materially reduce the overall level of protection during your subscription.

7. Sub-processors

7.1 You give Assegai general authorisation to engage the Sub-processors listed in Annex 3.

7.2 Assegai will give you at least 30 days' notice before engaging a new Sub-processor or changing where one processes Customer Data, by updating Annex 3 and notifying account owners by email and in the platform. An emergency change is one needed to prevent or respond to a security incident or a service outage that would otherwise stop you using Trident; for an emergency change Assegai notifies you within 72 hours of the change and the objection right in clause 7.3 then applies from that notice.

7.3 You may object on reasonable data-protection grounds within 30 days of the notice. The parties will discuss the objection in good faith. If Assegai cannot offer a reasonable alternative, you may terminate the affected service without penalty and receive a pro-rata refund of prepaid fees for the unused period.

7.4 Assegai imposes on each Sub-processor, by written contract, data-protection obligations no less protective than this DPA (section 18(4)–(5) of the Act) and remains responsible to you for its Sub-processors' performance.

8. Transfers outside Zimbabwe

8.1 Trident is hosted in the European Union (Frankfurt, Germany), and some Sub-processors process Customer Data in other countries listed in Annex 3.

8.2 Assegai transfers Customer Data only where (a) the destination provides adequate protection, assessed on the factors in the Authority's Guideline CDPG 4 of 2025 (legal framework, data subject rights, security, international commitments); or (b) where adequacy is not established, under a written agreement with the recipient containing standard data protection clauses, with the security measures in Annex 2, or another safeguard the Act and that Guideline recognise (paragraph 4.3; sections 28 and 29 of the Act). A transfer rests on adequacy or one of those safeguards. It does not rest on your instruction alone, and an instruction cannot make an unlawful transfer lawful.

8.3 As controller you are responsible for any notification to, or authorisation from, the Authority that your own transfers require (CDPG 5 of 2024; CDPG 4 of 2025). Assegai will give you the information you reasonably need for that notification and for your transfer impact assessment, including the details in Annex 3 and a summary of the safeguards.

9. Security Incidents

9.1 Assegai monitors its systems continuously for Security Incidents. It will notify you without undue delay, and in any event within 12 hours, after becoming aware of a Security Incident affecting Customer Data, so that you can meet your duty to notify the Authority within 24 hours (section 19 of the Act; SI 155 section 17(1)). Assegai gives that notice even if the information is not yet complete, with more to follow in phases.

9.2 The notice will describe, as far as then known: the nature of the incident; the categories and approximate number of data subjects and records affected; the likely consequences; the measures taken or proposed; and a contact for more information. Where information is not yet available, Assegai will provide it in phases as it becomes available.

9.3 Assegai will take reasonable steps to contain the incident and limit its effects, will cooperate with your investigation, and will give you what you reasonably need to complete Form DP3, inform affected data subjects within 72 hours where required (SI 155 section 17(3)), answer the Authority within 14 days, and submit the final report within 21 days (SI 155 section 17(5)).

9.4 Assegai's notification is not an admission of fault.

10. Assistance

Taking into account the nature of the processing, Assegai will assist you, through Trident's features and otherwise on request, with:

• responding to requests from data subjects exercising their rights under section 14 of the Act — Assegai will pass on any request it receives directly and will not respond itself unless you instruct it;
• data protection impact assessments and transfer impact assessments relating to Trident;
• consultations with, and requests from, the Authority; and
• your security and accountability duties (sections 18 and 24).

Assistance beyond the platform's standard features and reasonable effort may be charged at the rates in your plan.

11. Return and deletion

11.1 During the subscription you can export Customer Data from Trident at any time, in a common machine-readable format (CSV or JSON), with the documents you uploaded or generated in their original format.

11.2 When your subscription ends, you have 30 days to export Customer Data. Assegai then deletes it from its active systems within a further 60 days, and from backups as they are overwritten in the normal backup cycle, which is no longer than 35 days, unless the law requires Assegai to keep it. On request Assegai will confirm deletion in writing.

11.3 Assegai may keep information it needs as a separate controller under clause 2.2 (for example billing records and the account profile), for the periods stated in its Privacy Notice.

12. Audits and information

12.1 Assegai will make available the information reasonably necessary to demonstrate compliance with this DPA, including its security measures, Sub-processor list and any independent assessments it holds.

12.2 If that information does not reasonably satisfy you, or the Authority requires it, you may audit Assegai's compliance on at least 30 days' written notice, no more than once a year (except after a Security Incident or at the Authority's request), during business hours, through an auditor bound by confidentiality, and in a way that does not compromise other customers' data.

12.3 Each party bears its own costs of an audit. Assegai may charge its reasonable costs of an audit beyond the first in a year, other than one following a Security Incident or required by the Authority.

13. Liability

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where the Act or other law does not allow liability to be limited.

14. Term

This DPA lasts for as long as Assegai processes Customer Data for you, including after the subscription ends until deletion under clause 11.

Annex 1 — Details of processing

• Subject matter and duration: providing Trident Protect and any services you order, for the subscription and the wind-down in clause 11.
• Nature and purpose: hosting, storing, organising, displaying and analysing compliance records; generating documents, filings and reports (including AI-assisted drafts on request); sending notifications; providing support and, where contracted, DPO services.
• Categories of data subjects: your staff and authorised users; and the individuals reflected in your compliance records, such as your customers, employees, suppliers' contacts, data subjects making requests and people affected by incidents.
• Categories of personal information: identity and contact details; job title and organisation; information in records of processing, risk and vendor registers, assessments, incident and breach records, data subject requests and supporting documents; audit-trail information.
• Sensitive information: only as you choose to record it (for example in a breach or DPIA record). You must ensure you have written consent or another basis the Act permits.
• Frequency: continuous, for the subscription.

Annex 2 — Technical and organisational security measures

• Tenant isolation: row-level security in the database on every customer table; each organisation can read only its own records, enforced by the database, not only by the application.
• Encryption: TLS for all data in transit; encryption at rest by the hosting and database providers.
• Access control: role-based permissions inside each organisation; staff access limited by role, least privilege and logged; privileged database functions guarded and reviewed; re-authentication for sensitive changes such as payment details.
• Accountability: audit trail of user actions; a compliance activity log for each organisation.
• Application security: automated checks on every release (security policies on the database, dependency and configuration checks); error monitoring and alerting; continuous monitoring for security events.
• Resilience: managed database with automated daily backups; hosting across the provider's data-centre infrastructure.
• Abuse prevention: bot protection on public forms; disposable-email sign-ups blocked; rate limits on AI features.
• Incident response: documented breach response procedure aligned to the Act's 24-hour and 72-hour timelines.
• Personnel: confidentiality undertakings and data-protection training.

Annex 3 — Sub-processors

These providers can process Customer Data (or, for Stripe, billing information) in delivering Trident.

Assegai's public website also uses Plausible (cookieless website analytics), Cal.com (demo booking) and Google Fonts. These serve only our public pages and do not receive Customer Data. Assegai does not use Google Analytics.