1. The owners may need to provide, collect, use, store or process Personal Information of the user. The user accordingly authorises such collection, use, storage and processing where the need arises.
2. The owners shall only provide, collect, use, store or process Personal Information:
2.1. in compliance with the South Africa Protection of Personal Information Act 4 of 2013 ( POPI);
2.2. as is necessary for the purposes of this agreement; and
2.3. in accordance with the lawful and reasonable instructions of the user providing the Personal Information.
3. Both parties shall comply with the security and information protection obligations equivalent to those imposed on them in terms of POPI and other applicable data protection legislation, and failing such legislation, they shall take, implement and maintain all such technical and organisational security procedures and measures necessary or appropriate to preserve the security and confidentiality of the Personal Information in its possession and to protect such Personal Information against unauthorised or unlawful disclosure, access or processing, accidental loss, destruction or damage.
4. The Owners shall follow its archiving procedures and such document may be amended by the owners in its sole discretion from time to time. In the event of any loss or damage to user data, the user's sole and exclusive remedy shall be for the owner to use reasonable commercial endeavours to restore the lost or damaged user from the latest back-up of such user data maintained by the owner in accordance with the archiving procedure. The owner shall not be responsible for any loss, destruction, alteration or disclosure of user data caused by any third party.
5. If the user processes any personal data on the user's behalf when performing its obligations under this agreement, the parties record their intention that the user shall be the data controller and the owner shall be a data processor and in any such case:
5.1. The user shall ensure that the user is entitled to transfer the relevant personal data to the owner so that the owner may lawfully use, process and transfer the personal data in accordance with this agreement on the user's behalf;
5.2. the user shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by all applicable data protection legislation;
5.3. the owner shall process the personal data only in accordance with the terms of this agreement and any lawful instructions reasonably given by the user from time to time; and
5.4. each party shall take appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data or its accidental loss, destruction or damage.