Operator Agreement

1. Parties and roles

This Agreement is between SOUS CHEF (PTY) LTD, a private company (registration number 2026/803346/07) trading as Sous-Chef, whose registered address is 46 Kings Road, Bedfordview, Johannesburg, 2007 (the "Operator"), and the customer organisation that accepts these terms during account onboarding (the "Responsible Party").

The Responsible Party determines the purpose and means of processing the personal information of its employees-members. The Operator processes that personal information only on the Responsible Party's documented instructions, on the terms of this Agreement.

2. Subject matter and duration

The Operator processes personal information for the duration of the Responsible Party's subscription to the Sous-Chef service, plus any wind-down period set out in section 11. The categories of personal information, data subjects and processing operations are described in Annex A.

3. Documented instructions

The Operator processes personal information only on the Responsible Party's documented instructions, including transfers to third countries (see section 7). The configuration of the Sous-Chef service by the Responsible Party and the actions taken by its authorised users in the application constitute documented instructions for the purposes of this Agreement. The Operator informs the Responsible Party if, in its opinion, an instruction violates POPIA or other applicable law.

4. Confidentiality

The Operator ensures that persons authorised to process the personal information are bound by appropriate confidentiality obligations. The Operator does not disclose personal information to law-enforcement agencies except where required by law and, where lawfully possible, notifies the Responsible Party first.

5. Security measures

The Operator implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the nature of the personal information and the harm that could result from a security compromise. The current measures are described in Annex B and are kept under review.

6. Sub-processors

The Responsible Party gives the Operator general written authorisation to engage the sub-processors listed at /legal/sub-processors and any future sub-processor of the same kind. The Operator emails the Responsible Party at least 30 days before a new or replacement sub-processor starts receiving personal information. The Responsible Party may object on reasonable grounds; if the objection cannot be resolved, the Responsible Party may terminate this Agreement and the underlying subscription with a pro-rata refund of pre-paid fees for the unused term.

The Operator imposes data-protection obligations on each sub-processor that are no less protective than the obligations in this Agreement, and remains fully liable to the Responsible Party for the performance of each sub-processor.

7. Cross-border processing

Personal information may be processed in the European Union, the United States and on global edge networks via the sub-processors listed at /legal/sub-processors. For transfers outside South Africa, the Operator relies on POPIA s72(1)(a): the recipient is either subject to a law providing comparable protection (EU/UK) or is bound by binding corporate rules or contractual safeguards that uphold POPIA-equivalent principles.

8. Assistance with data-subject rights

Taking into account the nature of the processing, the Operator assists the Responsible Party by appropriate technical and organisational measures, insofar as possible, to fulfil its obligation to respond to requests from data subjects: access (POPIA s23), correction and deletion (s24), objection (s11(3)), and withdrawal of consent (s11(2)(b)).

9. Security compromises

The Operator notifies the Responsible Party of any security compromise involving personal information immediately, and in any event within 72 hours of becoming aware of it. Nothing in this Agreement limits POPIA s21(2). The notification includes, to the extent known: the nature of the compromise, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

The Responsible Party remains responsible for any reporting to the Information Regulator (POPIA s22) and to affected data subjects.

10. Audits and information rights

The Operator makes available to the Responsible Party all information reasonably necessary to demonstrate compliance with this Agreement, including (on reasonable notice and during business hours, no more than once per twelve-month period and subject to confidentiality) the right to conduct or commission an audit of the Operator's controls. Audit findings are addressed by mutually agreed remediation plans.

11. Return or deletion on termination

On termination of the underlying subscription the Operator makes the Responsible Party's data available for export for 60 days. After that period the Operator deletes the personal information in accordance with the retention schedule published in the privacy policy, unless retention is required by law (BCEA s31, Income Tax Act, etc.). The Responsible Party remains responsible for exporting and retaining the employment records it must keep under those laws.

12. Liability

Liability under this Agreement is governed by the limitations and exclusions in the Terms of Service, except that nothing limits liability that cannot lawfully be limited under POPIA.

Annex A — Processing details

Categories of data subjects

• The Responsible Party's employees, contractors and other workforce members added to the platform, including children aged 15 to 17
• The parents or guardians of those children (a name and relationship is recorded as consent)
• Third parties named in an employee's record: emergency contacts, and witnesses and representatives in disciplinary matters
• The Responsible Party's administrators and other authorised users, including its Information Officer

Categories of personal information

• Identity data (name, email, ID/passport number, passport country and expiry, date of birth, SARS tax reference, profile photo)
• Contact data (phone, address, an emergency contact's name, relationship and phone)
• Employment data (role, employment type, salary, schedule, leave, performance records)
• Uploaded personal documents (for example an ID copy, CV, proof of banking, proof of address)
• Health data (sick notes, leave reasons and injury-on-duty records — special personal information, POPIA s27(1)(b))
• Disciplinary records (where an allegation is also an offence, for example theft or assault, that part is special personal information under POPIA s26(b); all disciplinary records get the same safeguards)
• Children's data: for members aged 15 to 17, the date of birth and a parent or guardian's name and relationship
• The Information Officer's ID or passport number (stored encrypted)
• Audit-trail metadata (IP, user-agent, timestamps)

Processing operations

• Storage, retrieval, structuring and indexing
• Display in the user interface within the Responsible Party's organisation
• Sending of transactional email through the email sub-processor
• Generation, signing and storage of HR documents
• Anonymisation, aggregation, and deletion in accordance with the retention schedule

Annex B — Technical and organisational measures

• TLS 1.2 or higher in transit; AES-256 at rest at the database layer
• Field-level envelope encryption, on top of at-rest encryption, for high-sensitivity fields: identity and passport numbers, dates of birth, phone numbers and addresses, salary and salary history, severance amounts, SARS tax references, emergency-contact phone numbers, a minor's parent or guardian name, leave reasons and sick-note references, disciplinary case text (charges, outcomes, minutes, appeals and suspension reviews), injury-on-duty descriptions, the Information Officer's ID number, and the free-text notes in hearing and consultancy records
• Per-object file encryption: hearing notices, signed scans, case evidence, and audit reports and evidence are each encrypted under their own key before they reach storage
• Multi-tenant isolation at the application layer; per-organisation scoping enforced in every query path
• Role-based access control (owner / admin / member) with least-privilege defaults and per-branch scoping for admins and managers
• Mandatory two-factor authentication, by authenticator app or passkey, for owners and admins of customer organisations and for every user in a consultancy practice; step-up authentication for sensitive operations
• Tamper-evident, hash-chained audit log of administrative and HR actions, checked daily by an automated job
• Server-side validation of email domains at registration
• Bot protection on registration, login and password-reset flows

← Back to home