Create your Trident account

A.1 What it is. Where you buy the DPO Appointment Service, you appoint Assegai as your organisation's Data Protection Officer under a service contract, as the Authority's Guideline CDPG 1 of 2024 (paragraph 6.4) permits. The role is performed by a named, trained and certified individual in Assegai's DPO team (the "Named DPO"). Plan Plus is an alternative that adds a retainer with pooled hours; if you have Plan Plus, the Plan Plus Engagement Terms apply instead of this Schedule. If the Act does not require you to appoint a Data Protection Officer (CDPG 1 of 2024, paragraph 4), the appointment is voluntary and this Schedule applies in the same way.

A.2 What is included. The yearly service fee for your tier, which is charged with your Plan and renews with it, covers: preparing and filing your Form DP2 naming the Named DPO, and publishing-ready DPO contact details; acting as your point of contact for the Authority and for data subjects through dposervices@assegai.africa; being informed of, and helping you respond to, breaches and data subject requests; the statutory-duty work and included hours in clause A.8; and advice through the advisory calls included in your Plan. Advisory work beyond your Plan's included calls is charged at the per-call price on our pricing page, or can be covered by moving to Plan Plus. Preparing your first Form DP2 is part of the first year's fee.

A.3 Your duties. You must approve the content of your Form DP2 in the platform when we ask, because we file it only once you have approved it; we then file it with the Authority within 14 days of the appointment (SI 155 section 12) under clause A.8(i). You must also publish the DPO's contact details, give the DPO the information, access and independence the role requires (CDPG 1 of 2024 paragraph 9), involve the DPO promptly in data-protection matters, and tell the DPO of any actual or suspected breach immediately, and no later than 4 hours after you become aware of it, so the 24-hour notification to the Authority can be met. Use the breach channel described in clause A.8(d), which applies at all hours. Until we have filed the DP2, the Authority's record does not show Assegai as your DPO; if the filing waits on your approval, clause 12.4 applies to the delay.

A.4 Independence and conflicts. The DPO performs the role independently and will not be instructed on how to carry out DPO tasks. The DPO will raise concerns about non-compliance with you; you remain the controller and responsible for your compliance. You must not instruct the DPO to act unlawfully or to misstate facts to the Authority or to data subjects, and the DPO may decline any instruction that would breach the law. Assegai also sells Trident. The DPO's advice is independent of sales, you are never obliged to buy an Assegai product because of DPO advice, and where a recommendation involves an Assegai product the DPO says so and names the alternatives. Offering the service as a default selection, and Assegai's interest in selling it, do not affect the DPO's independence: the DPO is not rewarded for appointments. A conflict of interest is disclosed to you and escalated to your senior management.

A.5 Term and ending. The appointment lasts while you hold an active Trident Plan, unless either party ends it on 30 days' written notice. If your Plan is suspended, the appointment continues and the Statutory Functions in clause 9.3 remain available. We may also end the appointment on written notice if your Plan ends, or if an amount due under this Schedule is unpaid 30 days after its due date; clause A.8(c) still applies to any statutory duty that is open on that date. When it ends, we file the notice of the DPO's departure with the Authority within 14 days (SI 155 section 12), and you must appoint a new DPO within 90 days. Assegai will hand over the DPO records it holds for you and complete or hand over any statutory duty that is open on the end date.

A.6 Moving to and from Plan Plus. If you upgrade to Plan Plus, the appointment continues without a gap and the Plan Plus Engagement Terms replace this Schedule from the date Plan Plus starts. If Plan Plus ends while your Plan continues, the appointment continues under this Schedule unless either party ends it under clause A.5; any DP2 filing that is pending and any statutory duty that is open at that point carry over and are completed under this Schedule, and the handover rules in clause A.5 apply if the appointment then ends.

A.7 How the appointment is made.

(a) The appointment is made only when all three of these have happened: the DPO Appointment Service is on your paid Order; you have accepted this Schedule; and we have confirmed to you in the platform who the Named DPO is. We confirm within 2 business days of payment. We may decline an appointment, for example for a conflict of interest or where we cannot give the role the capacity clause A.8(e) describes. If we decline, we refund the service fee and clause A.7(c) applies.

(b) Where Trident offers the service already selected, for example when you add licensing to a plan, that selection is a default and nothing more. Nothing is appointed until the steps in clause A.7(a) are complete. You can choose to appoint your own DPO instead before you pay, and the order page shows the service, its price, this Schedule and the Named DPO's role before you pay.

(c) If you do not select the service, you untick it, or we decline, Assegai is not your DPO. You remain responsible for appointing your own and for notifying the Authority (SI 155 section 12). You can order the service later from your workspace.

(d) If a Consultant places the Order for you, the Consultant accepts this Schedule on your behalf and confirms that it is authorised to appoint a DPO for your organisation and that no other DPO is on the Authority's record for you, or that it will have the change filed. The appointment is still yours: it is shown in your workspace, you may end it under clause A.5, and ending the Consultant's access does not end it.

A.8 Statutory duties and capacity.

(a) Statutory-duty work means: helping you notify the Authority of a breach within 24 hours, decide whether affected people must be told within 72 hours, and answer the Authority's information requests and final report (section 19 of the Act; SI 155 section 17); responding as DPO to requests, assessments and directions from the Authority; and handling data subject requests and complaints where the DPO is the point of contact. The 24-hour clock runs from when you became aware of the breach. If you tell us late, we do what the remaining time allows, and clause 12.4 applies to a deadline missed because of a late report.

(b) Statutory-duty work in each year of the appointment includes 2 hours for a Tier 1 organisation, 4 hours for Tier 2, 6 hours for Tier 3 and 8 hours for Tier 4 (your tier is the one on your Order). Further hours are charged at the hourly rate shown on our pricing page when the work is done. During a running statutory clock we tell you in the platform that chargeable hours are running and we do not wait for your approval; the charge is raised afterwards. Outside a running clock we tell you before any charge is made.

(c) Statutory clocks come first. We will never delay or refuse a statutory duty that is running against a deadline because of an hours limit, a payment query or a dispute about fees. Any charge is raised and resolved afterwards.

(d) For work other than a breach, the DPO is available 08:00 to 17:00 Central Africa Time, Monday to Friday, excluding public holidays in Zimbabwe, and we acknowledge requests within 1 business day. A breach report made through the incident channel in your workspace, or by email to dposervices@assegai.africa with BREACH at the start of the subject line, is monitored at all times and acknowledged within 2 hours, at any hour. Acknowledgement is not completion.

(e) Assegai keeps each Named DPO's assignments at a level that lets the DPO meet clause A.8(d) in the ordinary course. If the Named DPO cannot continue (for example illness, resignation or a lapse in certification), we replace them with another certified individual and tell you promptly. A change of Named DPO must be notified to the Authority within 14 days (SI 155 section 12(3) and (4)); we file that notification for you.

(f) Unless we agree otherwise in writing, the service does not include forensic or technical investigation, mass notification of affected people or running a call centre, legal advice or legal representation (including in any court or tribunal), negotiating with attackers, system remediation, public relations, or defending a prosecution or regulatory enforcement action. Assegai is not a law firm.

(g) For an event of abnormal scale (for example a very large breach, several incidents at once, or several of Assegai's clients affected at once) the parties will agree in good faith a plan and, if needed, an additional fee. We will not leave a statutory deadline unmet while that plan is agreed.

(h) Where you approve it in the platform, the DPO may submit your Form DP3 to the Authority for you. The content stays yours and you remain responsible for it; the DPO submits only what you approved.

(i) Filings we make for you. Where this Schedule has us file a form with the Authority (your Form DP2, a notice of a change of Named DPO or of the DPO's departure, and the DP3 under clause A.8(h)), and where you have bought the Licence Application Service, your Form DP1, we file as your agent and on your authority, and only with content you have approved in the platform. The content stays yours and you remain responsible for its accuracy and completeness; we do not file anything you have not approved, and clause 12.4 applies to a deadline missed because an approval was late. Fees payable to the Authority for a filing are charged at cost under clause 5.4.

A.9 Liability in the DPO role.

(a) You are the controller. Compliance with the Act is your responsibility. The DPO advises, and the DPO is not personally responsible for your non-compliance (CDPG 1 of 2024, paragraph 10).

(b) Assegai does not guarantee any outcome before the Authority, that no penalty will be imposed, or that a breach will not occur.

(c) [Reserved.] Clause 12.3 applies to the DPO role as it is written. Clause 12.4 applies in full: fines and penalties imposed on you are yours to bear.

(d) You will indemnify us against third-party claims arising from your processing or your decisions as controller, including claims made against the Named DPO as your contact point.

(e) Nothing in this Schedule limits liability that cannot lawfully be limited.