Data Processing Addendum

1. Application and interpretation

This Data Processing Addendum ("Addendum") forms part of the Terms of Service between Olympus Pay Proprietary Limited ("Processor", "Olympus Pay", "we") and the customer that subscribes to Arubis ("Controller", "Customer", "you"). It applies whenever we process Customer Personal Data in providing the Service, and it applies automatically: no separate signature is required, although we will countersign a copy on request.

In this Addendum, "Act" means the Data Protection Act, 2024 of Botswana and any regulations or binding guidance issued under it; "Commission" means the Information and Data Protection Commission or any successor regulator; "Customer Personal Data" means personal data contained in Customer Data that we process on your behalf; "Sub-processor" means a third party we engage to process Customer Personal Data; and "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data. Other capitalised terms have the meanings given in the Terms of Service or the Act.

The Act requires that processing by a processor on behalf of a controller be governed by a written contract that binds the processor to act only on the controller's instructions and to implement appropriate security measures. This Addendum is that contract. Where the European Union General Data Protection Regulation or similar law also applies to your processing, this Addendum is intended to satisfy its processor requirements as well, and we will agree such additional terms as are reasonably needed for that purpose.

2. Roles of the parties

You are the controller of Customer Personal Data: you decide why it is processed (to keep your books, invoice customers, pay suppliers and employees, and meet your tax and reporting obligations) and the essential means of processing it. We are your processor: we process it only to provide the Service to you.

Separately, we are a controller of the personal data of users of the Service, such as their names, email addresses and usage logs, for the purposes described in our Privacy Policy. This Addendum does not apply to that processing.

Each party will comply with the obligations that the Act places on it in its respective role.

3. Details of the processing

Subject matter: the provision of Arubis, an online accounting and financial management service, including the Athena assistant.

Duration: the term of the Terms of Service, plus the period after termination during which we retain or return Customer Data as described in this Addendum and the Terms.

Nature and purpose: storage, organisation, retrieval, calculation, presentation, transmission (including sending invoices and quotes that you ask us to send) and deletion of Customer Personal Data, so that you can record, reconcile, report on and file your accounts; reading documents you upload so that their contents can be recorded; answering questions you ask about your books; securing, backing up and supporting the Service.

Categories of data subjects: your customers, suppliers, employees, contractors, directors, shareholders, and contact persons at any of them; and any other individuals whose details you choose to record.

Categories of personal data: names, job titles, contact details (email, phone, physical and postal address), tax and VAT identification numbers, bank account details used for payments, invoice, payment and transaction details, payroll information where you record it, and any personal data contained in documents you upload, such as receipts and contracts.

Special personal data: the Service is not designed for special personal data. You should not record it unless you have a lawful basis and a genuine need. If you do, it is processed under this Addendum with the same protections.

4. Processing only on your instructions

We will process Customer Personal Data only on your documented instructions, including with regard to transfers outside Botswana, unless the law requires otherwise, in which case we will tell you of that legal requirement before processing unless the law prohibits us from doing so on important grounds of public interest.

Your instructions are: the Terms of Service and this Addendum; your use and configuration of the Service, including the settings, rules and automations you enable and the actions your users take in it; and any further written instructions you give us that are consistent with the Terms and that we can reasonably follow. Automated features of the Service, such as rules learned from your categorisations and receipt reading by Athena, act on your instructions because you choose to use and configure them.

We will tell you promptly if, in our opinion, an instruction infringes the Act. We are not required to follow such an instruction.

We will not sell Customer Personal Data, process it for our own purposes, or use it to train general-purpose artificial intelligence models.

5. Confidentiality of personnel

We will ensure that every person we authorise to process Customer Personal Data, whether employee or contractor, is bound by an appropriate obligation of confidentiality, has received training in data protection appropriate to their role, and has access only to the Customer Personal Data needed for their duties. Access by our personnel to customers' books is not routine; where it is necessary, for example to investigate a fault you have reported, it is limited to that purpose, logged and removed afterwards.

6. Security of processing

Taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing, as well as the risk to individuals, we implement and maintain appropriate technical and organisational measures to protect Customer Personal Data. Those measures are designed and reviewed against recognised frameworks, including the Trust Services Criteria used for SOC 2 reporting, and include:

We may update these measures from time to time, provided that the update does not materially reduce the overall level of protection. A more detailed description is available on request, subject to confidentiality.

7. Sub-processors

You give us general authorisation to engage Sub-processors. Our current Sub-processors are:

Where we engage a Sub-processor, we will impose on it, by written contract, data protection obligations that offer at least the same protection for Customer Personal Data as this Addendum, and we remain responsible to you for its performance.

We will give you at least thirty days' notice before engaging a new Sub-processor that will process Customer Personal Data, by email to the owner of your Organisation or within the Service. If you have a reasonable objection on data protection grounds, you may notify us within that period, and we will discuss it with you in good faith. If we cannot resolve the objection, you may terminate the affected part of the Service and we will refund any prepaid fees for the period after termination.

8. International transfers

Some Sub-processors process data outside Botswana. We will transfer Customer Personal Data to a country outside Botswana only in accordance with the Act: where the Commission or the Act recognises the country as ensuring an adequate level of protection; or where appropriate safeguards are in place, such as contractual clauses that bind the recipient to protect the data to a standard equivalent to the Act, supported by technical measures including encryption; or where another condition in the Act permits the transfer.

On request, we will provide information about the safeguards in place for a particular transfer, to help you meet your own transparency and accountability obligations.

9. Assistance with data subject rights

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as possible, to respond to requests from individuals to exercise their rights under the Act.

The Service already provides most of what you need: you can search for and view the records about an individual, correct contact records, export data in machine-readable form, and restrict processing by deactivating a contact. Where you cannot fulfil a request using the Service, we will provide reasonable further assistance.

If we receive a request directly from an individual concerning Customer Personal Data, we will not respond to its substance without your authorisation, except to confirm that the request relates to you and to refer the individual to you, unless the law requires otherwise.

10. Personal data breaches

We will notify you without undue delay after becoming aware of a Personal Data Breach, and in any event in sufficient time to allow you to meet your obligation to notify the Commission and affected individuals within the period required by the Act.

Our notification will, to the extent then known, describe: the nature of the breach, including the categories and approximate number of individuals and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point for further information. Where information is not available at once, we will provide it in phases as it becomes available.

We will take reasonable steps to contain and remedy the breach and will cooperate with you and, where you ask, with the Commission. Our notification of a breach is not an acknowledgement of fault or liability.

11. Impact assessments and consultation

Where you are required by the Act to carry out a data protection impact assessment, or to consult the Commission before processing, concerning processing that involves the Service, we will provide reasonable assistance, including information about the Service's processing and security measures, taking into account the nature of the processing and the information available to us.

12. Return and deletion

On termination of the Service, you may export Customer Data, including Customer Personal Data, at any time up to ninety days after termination. After that period we will delete Customer Personal Data, unless the law requires us to keep it.

Accounting records within their statutory retention period are an exception that you have instructed us to apply by using the Service: as described in the Terms of Service, posted records are retained for seven years from the end of the financial year to which they relate, in a restricted state, unless you instruct us in writing to transfer them to you and confirm that you have assumed responsibility for retaining them. You may give that instruction at any time.

Backups containing deleted data are overwritten in the ordinary course within a further ninety days. Until then, they remain protected by this Addendum and are not used except to restore the Service after a failure.

13. Audits and information

We will make available to you all information reasonably necessary to demonstrate compliance with this Addendum and the Act, and will allow for and contribute to audits, including inspections, conducted by you or an independent auditor you appoint, in accordance with this section.

To avoid repeated audits disrupting the Service and other customers, we will first respond to your audit request by providing our current security documentation, the results of our most recent independent assessments where available, and answers to reasonable written questions. If that information does not reasonably satisfy you, or the Commission requires it, you may conduct an on-site or remote audit on at least thirty days' written notice, during business hours, no more than once in any twelve months (save after a Personal Data Breach), subject to reasonable confidentiality and security requirements, and at your cost. Audits may not extend to other customers' data or to information whose disclosure would compromise the security of the Service.

14. Your obligations

You warrant that you have, and will maintain throughout the term, a lawful basis under the Act for the processing of Customer Personal Data by us in accordance with your instructions, and that you have given individuals any notices the Act requires.

You are responsible for the accuracy of Customer Personal Data, for using the access controls in the Service appropriately, for the security of your own devices and credentials, and for responding to requests from individuals.

You will not instruct us to process Customer Personal Data in a way that would breach the Act.

15. Records of processing and accountability

We maintain a record of the categories of processing we carry out on behalf of customers, including the purposes, the categories of data and data subjects, the Sub-processors involved, the transfers made outside Botswana and a general description of our security measures. We will make that record available to the Commission on request and will provide you with the information from it that you need for your own records.

Accountability under the Act requires each party to be able to demonstrate compliance, not merely to comply. For our part, we keep documented policies covering information security, access control, change management, incident response, vendor management and data retention; we train our personnel; we review our controls at least annually and after significant changes; and we keep evidence of those activities.

16. Requests from public authorities

If we receive a request or order from a court, regulator, law enforcement agency or other public authority for access to Customer Personal Data, we will: verify that it is lawful and properly made; where permitted, notify you promptly so that you can seek a protective order or other remedy; disclose only the minimum data necessary to comply; and, where the request appears to us to be unlawful or overbroad, challenge it using the remedies reasonably available.

We will not voluntarily give any public authority direct or indirect access to Customer Personal Data. Requests made by authorities in Botswana under tax or financial intelligence legislation in respect of your business will normally be directed to you, as the person required to produce your records, and we will refer them to you unless the authority has lawfully required us to respond.

17. Annex: technical and organisational measures in detail

Access control. Each user signs in with an individual account. Access to an Organisation requires membership granted by its owner or an administrator. Roles define permissions for each action, and the database enforces them independently of the user interface, so that a fault in the interface cannot grant access the role does not allow. Approval thresholds and segregation of duties can be configured by the customer.

Data isolation. Every table holding Customer Data carries the identifier of the Organisation it belongs to and is protected by row-level security policies that permit reading only by members of that Organisation. Changes are made through controlled functions that check the actor's permission and record the action in an append-only audit log.

Integrity. Posted journals are immutable and can only be reversed. Periods can be locked, and locks are enforced by the database. Idempotency controls prevent the same transaction being recorded twice when a request is retried.

Encryption. Data is encrypted in transit with TLS and at rest by our infrastructure providers. Files are stored in private storage buckets and served through short-lived signed links.

Availability and resilience. The database is backed up automatically, backups are held separately from the primary database, and restoration is tested. The application is hosted on infrastructure designed to tolerate the failure of individual components.

Development. Changes are reviewed and tested, including automated tests of permission and isolation controls, before they reach production. Secrets are held in managed secret stores and are not committed to source code.

Monitoring and response. Errors and unusual activity are logged and monitored. Rate limits restrict abusive traffic. Security incidents are handled under a documented procedure that includes containment, investigation, notification and review.

Personnel. Access to production systems is limited to personnel who need it, granted on the principle of least privilege, and removed promptly when no longer needed. Personnel are bound by confidentiality obligations and receive security and data protection training.

Vendors. Sub-processors are assessed before engagement and reviewed periodically, including their security certifications and audit reports where available.

18. Changes to this Addendum

We may update this Addendum to reflect changes in the Act, in guidance from the Commission, in our Sub-processors or in the way the Service processes data. We will give you notice of any change that materially reduces the protection given to Customer Personal Data at least thirty days before it takes effect, and you may terminate the affected Service before it takes effect if you reasonably object.

Changes that increase protection, or that are required by law, may take effect immediately. The version of this Addendum in force at any time is published on our legal pages with its effective date, and earlier versions are available on request.

19. Contact for data protection matters

Questions about this Addendum, requests for assistance and notices under it should be sent to privacy@olympuspay.co. Notices of Personal Data Breaches will be sent to the email address of the owner of your Organisation and to any security contact you have registered with us, and will also be shown within the Service. Please keep those contact details current, because the time available under the Act for notifying the Commission runs from when you become aware of a breach.

20. Data protection officer and representative

Where the Act requires us to designate a data protection officer, we have done so, and that officer can be reached at privacy@olympuspay.co. The officer is responsible for monitoring our compliance with the Act and this Addendum, advising on data protection impact assessments, and acting as the contact point for the Commission and for customers on data protection matters.

If you are subject to a law outside Botswana that requires a processor to appoint a local representative, please tell us, and we will discuss with you the arrangements that law requires.

21. Liability and precedence

Each party's liability under or in connection with this Addendum is subject to the limitations and exclusions of liability in the Terms of Service, save to the extent the Act prohibits limitation. Nothing in this Addendum limits the rights of individuals or the powers of the Commission under the Act.

If there is any conflict between this Addendum and the Terms of Service in relation to the processing of Customer Personal Data, this Addendum prevails.

This Addendum is governed by the laws of Botswana. Questions about it may be sent to privacy@olympuspay.co.