Client–Consultancy Operator Agreement
This agreement is concluded under sections 20 and 21 of the Protection of Personal Information Act, 2013 (POPIA). It governs how an HR or industrial-relations practice ("the Practice") processes personal information for a company on Sous-Chef that chooses it ("the Client").
1. Parties and roles
The Client is the responsible party for its employees' personal information. The Practice acts as the Client's operator. The agreement is formed when the Client's owner links the Practice in Sous-Chef and accepts it, and the Practice's principal confirms the link. Sous-Chef is not a party: it remains the Client's own operator under the Sous-Chef Operator Agreement.
2. The work, its scope and its duration
The Practice processes only the records within the scopes the Client grants on the link, shown to the Client in plain words when it accepts, and for audits only within an engagement the Client accepted. The agreement lasts until the Client revokes the link or the Practice withdraws from it.
3. Instructions and purpose
The Practice processes personal information only on the Client's documented instructions: the scopes and engagements the Client accepts in Sous-Chef, and the requests it makes there. It never uses the information for any other purpose, including its own.
4. Confidentiality
The Practice treats the information as confidential and allows access only to its people assigned to the Client, each bound by a written confidentiality undertaking.
5. Security measures
The Practice works on the Client's records only inside Sous-Chef, with a second sign-in step on every account and no bulk export of client records. What it can download for the Client's work (a hearing's case bundle, evidence and notice, an audit report or its evidence, and a stored file its access covers) is logged, and section 10 applies to every copy. Every record opened is logged and shown to the Client. The Practice's own device and staff obligations are those in the Consultancy Terms of Service.
6. Sub-operators
The Practice engages no sub-operator for the Client's records without the Client's prior written authorisation.
7. Security compromises
The Practice tells the Client immediately, and in any event within 24 hours, if it has reasonable grounds to believe the Client's personal information has been accessed or acquired without authority (POPIA s21(2)).
8. Requests from employees
The Practice never answers an employee's request about their personal information itself. It forwards the request to the Client within two working days, and helps the Client answer it.
9. Information and audit
The Client can see in Sous-Chef every record the Practice opened and every action it took. The Practice gives the Client any further information reasonably needed to show it has kept this agreement.
10. When access ends
When the link ends, the Practice's access ends at once. The Practice returns or destroys anything of the Client's it holds outside Sous-Chef and confirms that it has. Signed reports and results stay with the Client.
11. Liability
Each party is liable for its own breaches of this agreement. Nothing in it limits liability that can't lawfully be limited under POPIA.
12. Customers under the GDPR
Where the GDPR applies to the Client, this agreement is also the contract Article 28(3) requires, and its terms are read to meet that Article. Transfers outside the EU need the annex Sous-Chef provides on request.
Schedule: audit engagements
- Each audit is agreed in Sous-Chef before it starts: the checklists and branches it covers, the fieldwork window and how long the Practice may reach the records after it. The Client's owner accepts every engagement, and the Practice accepts it too.
- The Practice tells the Client, before the Client accepts, of anything that could affect its independence, such as having run hearings for the Client or a consultant having worked for it.
- The report is the signing consultant's professional opinion, not Sous-Chef's. Sous-Chef provides the tools and gives no assurance about the result.
- The runs, results, findings and report belong to the Client. The Practice keeps only a summary of the engagement that names no employee.
- The report is for the Client. No one else may rely on it without the Practice's written consent.
Your instruction to Sous-Chef
Accepted separately when you link a practice. You instruct Sous-Chef, as your operator, to make the records within the scopes you grant available to the practice you choose, for as long as the link lasts. The practice is your operator, not Sous-Chef's sub-processor. Sous-Chef tells you within 24 hours of becoming aware of a security compromise affecting that access.
Using your own agreement instead
You may rely on an operator agreement of your own with the practice instead of this one. If you do, you state that it is in place and meets POPIA sections 20 and 21, and Sous-Chef records that statement on the link.