AutoFix Hub

Data Processing Agreement

Last updated: 28 June 2026

⚠️ Legal Review Required: This document is a template prepared for initial launch. It must be reviewed and approved by a qualified South African legal practitioner before being relied upon. AutoFix Hub accepts no liability for any loss arising from the use of this template.

1. Introduction

This Data Processing Agreement (“DPA”) forms part of the Subscriber Agreement between AutoFix Hub (Pty) Ltd (“Processor”) and the Subscriber (“Controller”). It sets out the terms governing the processing of personal information by the Processor on behalf of the Controller, in compliance with the Protection of Personal Information Act, 2013 (POPIA).

2. Definitions

  • “Personal Information” has the meaning given in POPIA.
  • “Processing” has the meaning given in POPIA.
  • “Data Subject” means the individual to whom the personal information relates.
  • “Sub-processor” means a third-party engaged by the Processor to assist in processing personal information.

3. Processing Scope

The Processor shall process personal information solely for the purpose of providing the Platform and related services as described in the Subscriber Agreement. The categories of data subjects include the Controller’s customers, employees, and service providers. The types of personal information processed include contact details, vehicle data, service history, and billing information.

4. Processor Obligations

The Processor shall:

  • Process personal information only on documented instructions from the Controller.
  • Ensure that personnel authorised to process the personal information are bound by confidentiality obligations.
  • Implement appropriate technical and organisational security measures.
  • Notify the Controller without undue delay of any data breach involving personal information.
  • Assist the Controller in fulfilling its obligations under POPIA, including data subject access requests.

5. Sub-processors

The Controller agrees that the Processor may engage Sub-processors to assist in providing the Platform. Current Sub-processors include:

  • MongoDB Atlas (cloud database hosting)
  • Microsoft Azure (blob storage, cloud infrastructure)
  • PayFast (payment processing)
  • ClickSend (SMS notifications)
  • Mailgun (email delivery)

The Processor shall notify the Controller of any changes to Sub-processors and provide an opportunity to object.

6. Data Subject Rights

The Processor shall assist the Controller in responding to data subject requests under POPIA, including requests for access, correction, deletion, and objection. If a data subject contacts the Processor directly, the Processor shall forward the request to the Controller.

7. Security Measures

The Processor maintains the following security measures:

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
  • Role-based access controls and multi-factor authentication.
  • Regular vulnerability assessments and penetration testing.
  • 24/7 system monitoring and incident response procedures.
  • Annual staff training on data protection and POPIA compliance.

8. Data Breach Notification

In the event of a data breach involving personal information processed under this DPA, the Processor shall notify the Controller within 48 hours of becoming aware of the breach. The notification shall include the nature of the breach, categories of personal information affected, and remedial actions taken.

9. Data Retention and Deletion

Upon termination of the Subscriber Agreement, the Controller may request a data export within 30 days. After 30 days, the Processor shall securely delete or anonymise all personal information, unless a longer retention period is required by law.

10. Audit Rights

The Controller may, upon reasonable notice and no more than once per year, request evidence of the Processor’s compliance with this DPA. Such audits shall be conducted in a manner that does not disrupt the Processor’s operations.

11. Limitation of Liability

Any liability arising from this DPA shall be subject to the limitations set out in the Subscriber Agreement.

12. Governing Law

This DPA is governed by the laws of the Republic of South Africa.