Terms of Service

1. About these terms

1.1 These terms govern the use of Trident Protect ("Trident"), a data-protection compliance platform, and related services provided by Assegai Analytics of Harare, Zimbabwe ("Assegai", "we", "us"). Our company and licence particulars are given on request at dposervices@assegai.africa.

1.2 Trident is for organisations, not for individuals acting as consumers. By creating an account, accepting these terms in the platform, or using Trident, you agree to them on behalf of the organisation you represent ("you", the "Customer"), and you confirm you are authorised to bind it. If you do not agree, do not use Trident.

1.3 These terms include the Data Processing Addendum (which governs our processing of personal information for you), the Privacy Notice, the Cookie posture, and any order, invoice or plan selection you make in the platform (an "Order"). Where you appoint us as your Data Protection Officer, Schedule A (DPO Appointment Service) or the Plan Plus Engagement Terms (shown to you when you buy Plan Plus) also apply. If documents conflict, the order of priority is: the DPA (for personal information), the Plan Plus Engagement Terms or Schedule A (for the DPO role), the Order, then these terms.

1.4 Definitions. The Act means the Cyber and Data Protection Act [Chapter 12:07]. The Authority means the Data Protection Authority (POTRAZ). Customer Data means information you or your users put into Trident. Plan means the subscription tier on your Order. Module means a feature area of Trident. Unit means one metered use of a per-use module (for example one DPIA, one DSAR case, one AI Policy Blueprint). Consultant means a data-protection consultancy that uses Trident to serve its clients. Statutory Functions means the functions listed in clause 9.3.

2. The service

2.1 Trident provides tools to help you meet your obligations under the Act and related guidance: registers and records, assessments, policy and document generation, statutory-form preparation, task and compliance tracking, and reporting. The Modules, quotas and prices available to you are those of your Plan and any add-ons on your Order, as shown on our pricing page when you buy.

2.2 Trident supports your compliance; it does not do it for you. You remain the data controller and are responsible for your organisation's compliance with the Act, for the accuracy of the information you enter, and for the decisions you take. Content Trident generates, including statutory forms, policies and reports, is a draft for you to review and approve. Unless we have agreed in writing to act as your DPO or to provide legal advice, nothing in Trident is legal advice.

2.3 Statutory filings. Trident prepares forms such as DP1 (licence application), DP2 (DPO appointment) and DP3 (breach notification). Where you have bought the Licence Application Service, or Assegai is your Data Protection Officer under Schedule A, Assegai files the forms that service or Schedule A covers, on your approval of their content, under clause A.8(i). For any other filing you must review, sign and submit it to the Authority yourself, and you remain responsible for meeting its deadline.

2.4 Changes. We improve Trident continuously. We may change features, but will not materially reduce the core functionality of a Module you have paid for during the paid period. We will give you at least 30 days' notice of any change that materially and adversely affects you.

3. Accounts and users

3.1 You must give accurate account information and keep it up to date. You are responsible for your users, for keeping credentials confidential, and for everything done under your account. Tell us immediately at dposervices@assegai.africa if you suspect unauthorised access.

3.2 You may invite users from your organisation and give them roles. Accounts are personal; do not share them.

3.3 Consultants. If a Consultant manages your organisation on Trident, it may create and administer your account, act in the platform on your behalf, buy and apply access codes, and see your organisation's records and billing information. You are responsible for the Consultants you allow to act for you. The Consultant's own agreement with Assegai governs what it may do.

4. AI features

4.1 Some Modules offer AI-assisted drafting and grading. AI output can be incomplete or wrong. It is a draft: you must review it before relying on it, and items marked "to be confirmed" must be completed by you. Scores and statutory calculations in Trident are made by fixed rules in our software, not by the AI model.

4.2 We do not use Customer Data to train AI models, and our AI providers are contractually prohibited from doing so. See the DPA.

4.3 AI features have per-record limits and fair-use safeguards to prevent abuse. We may apply them without notice to protect the service.

4.4 AI credits. AI features that draw on credits show their cost in credits next to the feature. Your Plan may include a yearly allowance of general AI credits for suggestions and assistance, released in step with how you pay and as shown in the platform: at the start of the plan year on an annual Plan or a complimentary Plan; with each instalment on a payment plan (for example quarterly or bi-annually), when that instalment falls due and is not overdue beyond its grace period; and in equal monthly instalments on a monthly Plan. Each assessment, policy or plan draft in your Plan also includes the AI credits needed to write it, kept for that work and shown as reserved in the platform, so that AI use elsewhere does not prevent you from completing work your Plan includes. Where we offer them, you may also buy more AI credits, in any whole-dollar amount within the limits shown in the platform, at the flat price per credit shown at checkout. AI credits belong to your organisation. They have no cash value, cannot be transferred to another organisation and cannot be exchanged for money.

4.5 When credits are used and when they run out. A credit is used only when an AI result is delivered to you. We do not charge for a failed or unusable result and, where the platform says so, running the same case again shortly afterwards is free. AI credits are prepaid: we never bill you in arrears for AI use. When your AI credits run out, the AI features pause and everything else in Trident keeps working, including the platform's own calculations, checklists and drafts. AI credits are never needed for the Statutory Functions listed in clause 9.3.

4.6 Expiry and refunds. AI credits included in your Plan expire at the end of the plan year and do not carry over. AI credits you buy expire 12 months after the date of purchase, and the platform shows the expiry date. Credits that expire first are used first. Unused or expired AI credits are not refundable, except that if we terminate for convenience or for our own breach we refund the unused part of the AI credits you bought (clause 5.9), and except where the law requires otherwise.

4.7 Changes. We may change the number of credits a feature uses, or the price per credit, for uses and purchases made after the change. A change does not cancel credits you already hold.

5. Fees, payment and taxes

5.1 Prices. Plan, Module and per-Unit prices are those on your Order. Recurring fees are billed in advance for the billing period on your Order. Per-Unit fees are charged when the Unit is used or bought, as shown in the platform.

5.2 Quotas and Units. Some Modules include a yearly quota of Units in your Plan; additional Units are charged at the per-Unit price or in packs. Unused quota does not carry over to the next period, and bought Units expire as stated at purchase.

5.3 Invoices and payment. We issue an invoice for each purchase. You may pay by any method offered for that invoice (for example card through our payment provider, or bank transfer with proof of payment). Changing how you pay does not create a new invoice. Invoices are payable when issued unless the invoice states a due date. Access to purchased items starts when payment is confirmed, unless we agree otherwise.

5.4 Statutory fees. Fees payable to the Authority (for example the data controller licence and application fees) are charged as separate lines at cost, passed through to the Authority, and are not Assegai revenue. They are set by law, include any VAT the law applies to them, and are non-refundable once paid to the Authority.

5.5 Taxes. Prices are in US dollars and exclude taxes. Assegai is not registered for VAT, so no VAT is charged on Assegai's own services. If we become registered, we will tell you and add VAT to invoices issued from the date of registration, as the law requires. You are responsible for any withholding or other taxes you must deduct, and must increase your payment so that we receive the full invoiced amount, unless the law prevents this.

5.6 Renewals and price changes. Subscriptions renew for the same period unless either party gives notice before the renewal date. Where we have agreed a price lock, the locked price applies until the lock ends. Otherwise we may change prices for a future renewal by giving at least 30 days' notice; the new price applies from the next renewal.

5.7 Late payment. If an invoice is overdue, we may, after giving you at least 14 days' written notice, suspend access to paid Modules until it is paid. We never suspend the Statutory Functions listed in clause 9.3.

5.8 Consultant-collected payment plans. If your Consultant collects payment from you directly on a payment plan, the payment terms between you and your Consultant apply. On your Consultant's instruction, and only after the notice steps in the platform (reminders before and on the due date, and a grace period), Trident may restrict access to Modules funded by that plan until the Consultant confirms payment or lifts the restriction. If you use the "I have paid" option in the platform, the restriction stays paused until your Consultant rejects your notice with reasons; if the Consultant does not respond within the pause period, we lift the restriction. The Statutory Functions are never restricted.

5.9 Refunds. Fees are non-refundable except where these terms or the law say otherwise, or where we terminate for convenience or for our own breach, in which case we refund prepaid fees for the unused period.

6. Acceptable use and fair use

6.1 You must not, and must not allow anyone to:

• use Trident unlawfully, or to process personal information without a lawful basis under the Act;
• try to access another customer's data or bypass the platform's security or permission controls;
• probe, scan or test Trident's vulnerabilities except under a written agreement with us;
• reverse engineer Trident except as the law permits;
• resell, sublicense or give third parties access to Trident, other than through our Consultant programme;
• use Trident to build a competing product, or scrape it at scale;
• upload malware or content that infringes others' rights; or
• use AI features to generate content in bulk or for organisations other than your own.

6.2 What "unlimited" means (fair use). Where a Plan describes an allowance as "unlimited" (for example assessments or advisory calls on the Enterprise plan), it means there is no fixed per-Unit charge for use consistent with the ordinary compliance needs of a single organisation. It does not permit use on behalf of other organisations, automated or bulk generation, or use that causes AI processing cost out of proportion to the Plan. If your use materially exceeds a single organisation's ordinary needs, we will contact you first, and may then apply per-Unit charges above a fair-use threshold or ask you to move to a plan that fits. We will never stop a statutory workflow (such as a data subject request or a breach notification) because of fair use.

7. Customer Data and privacy

7.1 You own Customer Data. You grant us a limited right to host, process and display it only to provide and secure Trident, to support you, and as the DPA allows.

7.2 We process personal information in Customer Data as your processor under the DPA, and we are the controller of the account and billing information described in our Privacy Notice.

7.3 Export and deletion. You may export Customer Data at any time during the subscription and for 30 days after it ends. After that, we delete it from our active systems within a further 60 days, and from backups as they are overwritten in the normal backup cycle, as the DPA describes. We keep your organisation's account profile and billing records for the periods stated in our Privacy Notice (the account profile for up to 12 months after the subscription ends so that you can reactivate; billing records as the law requires).

7.4 We may create aggregated, anonymised statistics from use of Trident that do not identify you or any individual, and use them to operate and improve our services.

8. Confidentiality

Each party will keep the other's confidential information confidential, use it only for the purposes of these terms, and protect it with at least reasonable care. This does not apply to information that is public, already known to the recipient, independently developed, or lawfully received from someone else. A party may disclose confidential information where the law, a court or a regulator requires, giving the other party notice where it lawfully can.

9. Suspension, termination and Statutory Functions

9.1 We may suspend access if your use presents a security risk to Trident or other customers, breaks the law, or breaches clause 6, or if the Authority or a court requires it. We will limit any suspension to what the risk or requirement needs, and restore access as soon as the reason is resolved.

9.2 Either party may terminate these terms if the other materially breaches them and does not fix the breach within 30 days of written notice. You may stop renewing at any time. Termination does not relieve you of fees already due.

9.3 Statutory Functions. Whatever the reason for any restriction or suspension, you will be able to: read and export your existing records; report and manage a breach and prepare a DP3 notification; receive and respond to data subject requests; contact the Authority through the platform; and view and settle what you owe.

9.4 Security and legal suspensions. Where a suspension under clause 9.1 is for a security risk or a legal requirement, we will still keep the Statutory Functions available, or restore them as fast as the risk allows, narrowing the suspension to the parts of your account that create the risk. Where the risk means a Statutory Function cannot safely run inside the platform for a time, we will provide it by other means without delay: for example an export of your records on request, and direct help preparing and sending a DP3 to the Authority. Only an order of a court or of the Authority can prevent us from doing this.

9.5 On termination, clauses 7.3, 8, 10, 11, 12 and any accrued payment obligations survive, and, from Schedule A, clauses A.5, A.8(c) and A.9.

10. Intellectual property

10.1 Assegai and its licensors own Trident, its software, content, templates, clause libraries, rubrics and scoring methods, and all improvements to them. These terms give you a limited, non-exclusive, non-transferable right to use Trident for your internal compliance purposes during your subscription.

10.2 You own the documents you create in Trident, including those generated from our templates, and may use them for your organisation without restriction.

10.3 If you give us feedback or suggestions, we may use them without obligation to you.

11. Warranties and disclaimers

11.1 We will provide Trident with reasonable skill and care, and substantially as described for your Plan on our pricing page. If it does not, tell us and we will use reasonable efforts to fix it; if we cannot within a reasonable time, you may terminate the affected service and receive a pro-rata refund of prepaid fees.

11.2 We aim for Trident to be available at all times but do not guarantee uninterrupted or error-free service. We may carry out planned maintenance, and will try to schedule it outside Zimbabwean business hours.

11.3 Except as stated in these terms, Trident is provided "as is". We do not warrant that using Trident will make you compliant with the Act, that any filing will be accepted by the Authority, or that AI output is accurate. To the extent the law allows, all other warranties and conditions are excluded.

12. Liability

12.1 Nothing in these terms limits liability that cannot be limited by law, or either party's liability for fraud or wilful misconduct, or your obligation to pay fees.

12.2 Neither party is liable for indirect or consequential loss, or for loss of profit, revenue, goodwill or anticipated savings.

12.3 The cap. Each party's total liability arising out of or in connection with these terms is limited to the fees paid or payable under these terms for the affected service in the 12 months before the event giving rise to the claim, excluding statutory fees passed through to the Authority. The same formula applies to the Plan Plus Engagement Terms and to the Consultant Agreement, each measured on the fees under that document.

12.4 We are not liable for fines or penalties imposed on you under the Act for your own acts or omissions as controller, including a failure to review, sign or file a document on time, or for failures caused by information you or your users entered.

12.5 Indemnity. You will indemnify us against third-party claims arising from Customer Data you had no right to process, or from your breach of clause 6. We will indemnify you against third-party claims that Trident, used as permitted, infringes their intellectual property rights.

13. General

13.1 Force majeure. Neither party is liable for a failure caused by events beyond its reasonable control, such as power or network failures, natural disasters or government action, provided it takes reasonable steps to limit the effect. This does not excuse payment obligations.

13.2 Changes to these terms. We may update these terms. We will give at least 30 days' notice of a material change by email to account owners and in the platform; the change applies from your next renewal unless the law requires it sooner. Where the platform asks you to accept updated terms, continuing to use Trident requires acceptance.

13.3 Notices. We send notices to the email of your account owner and in the platform. You send notices to trident@assegai.africa (and, for data-protection matters, dposervices@assegai.africa).

13.4 Assignment. You may not assign these terms without our consent. We may assign them to a successor of our business with notice to you.

13.5 Entire agreement. These terms and the documents in clause 1.3 are the entire agreement on their subject. If any provision is unenforceable, the rest remain in force. A failure to enforce a right is not a waiver.

13.6 Governing law and disputes. These terms are governed by the laws of Zimbabwe. The parties will first try to resolve any dispute by good-faith discussion between senior representatives for 30 days. If it is not resolved, the courts of Harare have exclusive jurisdiction.

---

Schedule A — DPO Appointment Service

A.1 What it is. Where you buy the DPO Appointment Service, you appoint Assegai as your organisation's Data Protection Officer under a service contract, as the Authority's Guideline CDPG 1 of 2024 (paragraph 6.4) permits. The role is performed by a named, trained and certified individual in Assegai's DPO team (the "Named DPO"). Plan Plus is an alternative that adds a retainer with pooled hours; if you have Plan Plus, the Plan Plus Engagement Terms apply instead of this Schedule. If the Act does not require you to appoint a Data Protection Officer (CDPG 1 of 2024, paragraph 4), the appointment is voluntary and this Schedule applies in the same way.

A.2 What is included. The yearly service fee for your tier, which is charged with your Plan and renews with it, covers: preparing and filing your Form DP2 naming the Named DPO, and publishing-ready DPO contact details; acting as your point of contact for the Authority and for data subjects through dposervices@assegai.africa; being informed of, and helping you respond to, breaches and data subject requests; the statutory-duty work and included hours in clause A.8; and advice through the advisory calls included in your Plan. Advisory work beyond your Plan's included calls is charged at the per-call price on our pricing page, or can be covered by moving to Plan Plus. Preparing your first Form DP2 is part of the first year's fee.

A.3 Your duties. You must approve the content of your Form DP2 in the platform when we ask, because we file it only once you have approved it; we then file it with the Authority within 14 days of the appointment (SI 155 section 12) under clause A.8(i). You must also publish the DPO's contact details, give the DPO the information, access and independence the role requires (CDPG 1 of 2024 paragraph 9), involve the DPO promptly in data-protection matters, and tell the DPO of any actual or suspected breach immediately, and no later than 4 hours after you become aware of it, so the 24-hour notification to the Authority can be met. Use the breach channel described in clause A.8(d), which applies at all hours. Until we have filed the DP2, the Authority's record does not show Assegai as your DPO; if the filing waits on your approval, clause 12.4 applies to the delay.

A.4 Independence and conflicts. The DPO performs the role independently and will not be instructed on how to carry out DPO tasks. The DPO will raise concerns about non-compliance with you; you remain the controller and responsible for your compliance. You must not instruct the DPO to act unlawfully or to misstate facts to the Authority or to data subjects, and the DPO may decline any instruction that would breach the law. Assegai also sells Trident. The DPO's advice is independent of sales, you are never obliged to buy an Assegai product because of DPO advice, and where a recommendation involves an Assegai product the DPO says so and names the alternatives. Offering the service as a default selection, and Assegai's interest in selling it, do not affect the DPO's independence: the DPO is not rewarded for appointments. A conflict of interest is disclosed to you and escalated to your senior management.

A.5 Term and ending. The appointment lasts while you hold an active Trident Plan, unless either party ends it on 30 days' written notice. If your Plan is suspended, the appointment continues and the Statutory Functions in clause 9.3 remain available. We may also end the appointment on written notice if your Plan ends, or if an amount due under this Schedule is unpaid 30 days after its due date; clause A.8(c) still applies to any statutory duty that is open on that date. When it ends, we file the notice of the DPO's departure with the Authority within 14 days (SI 155 section 12), and you must appoint a new DPO within 90 days. Assegai will hand over the DPO records it holds for you and complete or hand over any statutory duty that is open on the end date.

A.6 Moving to and from Plan Plus. If you upgrade to Plan Plus, the appointment continues without a gap and the Plan Plus Engagement Terms replace this Schedule from the date Plan Plus starts. If Plan Plus ends while your Plan continues, the appointment continues under this Schedule unless either party ends it under clause A.5; any DP2 filing that is pending and any statutory duty that is open at that point carry over and are completed under this Schedule, and the handover rules in clause A.5 apply if the appointment then ends.

A.7 How the appointment is made.

(a) The appointment is made only when all three of these have happened: the DPO Appointment Service is on your paid Order; you have accepted this Schedule; and we have confirmed to you in the platform who the Named DPO is. We confirm within 2 business days of payment. We may decline an appointment, for example for a conflict of interest or where we cannot give the role the capacity clause A.8(e) describes. If we decline, we refund the service fee and clause A.7(c) applies.

(b) Where Trident offers the service already selected, for example when you add licensing to a plan, that selection is a default and nothing more. Nothing is appointed until the steps in clause A.7(a) are complete. You can choose to appoint your own DPO instead before you pay, and the order page shows the service, its price, this Schedule and the Named DPO's role before you pay.

(c) If you do not select the service, you untick it, or we decline, Assegai is not your DPO. You remain responsible for appointing your own and for notifying the Authority (SI 155 section 12). You can order the service later from your workspace.

(d) If a Consultant places the Order for you, the Consultant accepts this Schedule on your behalf and confirms that it is authorised to appoint a DPO for your organisation and that no other DPO is on the Authority's record for you, or that it will have the change filed. The appointment is still yours: it is shown in your workspace, you may end it under clause A.5, and ending the Consultant's access does not end it.

A.8 Statutory duties and capacity.

(a) Statutory-duty work means: helping you notify the Authority of a breach within 24 hours, decide whether affected people must be told within 72 hours, and answer the Authority's information requests and final report (section 19 of the Act; SI 155 section 17); responding as DPO to requests, assessments and directions from the Authority; and handling data subject requests and complaints where the DPO is the point of contact. The 24-hour clock runs from when you became aware of the breach. If you tell us late, we do what the remaining time allows, and clause 12.4 applies to a deadline missed because of a late report.

(b) Statutory-duty work in each year of the appointment includes 2 hours for a Tier 1 organisation, 4 hours for Tier 2, 6 hours for Tier 3 and 8 hours for Tier 4 (your tier is the one on your Order). Further hours are charged at the hourly rate shown on our pricing page when the work is done. During a running statutory clock we tell you in the platform that chargeable hours are running and we do not wait for your approval; the charge is raised afterwards. Outside a running clock we tell you before any charge is made.

(c) Statutory clocks come first. We will never delay or refuse a statutory duty that is running against a deadline because of an hours limit, a payment query or a dispute about fees. Any charge is raised and resolved afterwards.

(d) For work other than a breach, the DPO is available 08:00 to 17:00 Central Africa Time, Monday to Friday, excluding public holidays in Zimbabwe, and we acknowledge requests within 1 business day. A breach report made through the incident channel in your workspace, or by email to dposervices@assegai.africa with BREACH at the start of the subject line, is monitored at all times and acknowledged within 2 hours, at any hour. Acknowledgement is not completion.

(e) Assegai keeps each Named DPO's assignments at a level that lets the DPO meet clause A.8(d) in the ordinary course. If the Named DPO cannot continue (for example illness, resignation or a lapse in certification), we replace them with another certified individual and tell you promptly. A change of Named DPO must be notified to the Authority within 14 days (SI 155 section 12(3) and (4)); we file that notification for you.

(f) Unless we agree otherwise in writing, the service does not include forensic or technical investigation, mass notification of affected people or running a call centre, legal advice or legal representation (including in any court or tribunal), negotiating with attackers, system remediation, public relations, or defending a prosecution or regulatory enforcement action. Assegai is not a law firm.

(g) For an event of abnormal scale (for example a very large breach, several incidents at once, or several of Assegai's clients affected at once) the parties will agree in good faith a plan and, if needed, an additional fee. We will not leave a statutory deadline unmet while that plan is agreed.

(h) Where you approve it in the platform, the DPO may submit your Form DP3 to the Authority for you. The content stays yours and you remain responsible for it; the DPO submits only what you approved.

(i) Filings we make for you. Where this Schedule has us file a form with the Authority (your Form DP2, a notice of a change of Named DPO or of the DPO's departure, and the DP3 under clause A.8(h)), and where you have bought the Licence Application Service, your Form DP1, we file as your agent and on your authority, and only with content you have approved in the platform. The content stays yours and you remain responsible for its accuracy and completeness; we do not file anything you have not approved, and clause 12.4 applies to a deadline missed because an approval was late. Fees payable to the Authority for a filing are charged at cost under clause 5.4.

A.9 Liability in the DPO role.

(a) You are the controller. Compliance with the Act is your responsibility. The DPO advises, and the DPO is not personally responsible for your non-compliance (CDPG 1 of 2024, paragraph 10).

(b) Assegai does not guarantee any outcome before the Authority, that no penalty will be imposed, or that a breach will not occur.

(c) [Reserved.] Clause 12.3 applies to the DPO role as it is written. Clause 12.4 applies in full: fines and penalties imposed on you are yours to bear.

(d) You will indemnify us against third-party claims arising from your processing or your decisions as controller, including claims made against the Named DPO as your contact point.

(e) Nothing in this Schedule limits liability that cannot lawfully be limited.