Operator Agreements

This page sets out the third-party operators (processors) who process personal information on behalf of Tapnet Solutions (Pty) Ltd, trading as TradeJournal, in accordance with Sections 20 and 21 of the Protection of Personal Information Act 4 of 2013 (POPIA).

This policy applies to tradejournal.co.za and all other websites, applications, and digital services operated by Tapnet Solutions (Pty) Ltd.

POPIA requires that where a responsible party engages an operator to process personal information on its behalf, the responsible party must ensure that the operator establishes and maintains adequate security measures and processes the information only with the knowledge or authorisation of the responsible party.

An "operator" is a person or entity who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of the responsible party. In international frameworks, this role is commonly referred to as a "processor."

Tapnet Solutions (Pty) Ltd is the responsible party. The operators listed below process personal information on our behalf, under contract, and in accordance with our instructions.

The following table lists all third-party operators currently engaged by Tapnet Solutions (Pty) Ltd:

All operators engaged by Tapnet Solutions (Pty) Ltd are contractually required to:

• Process only on instruction: Process personal information only in accordance with our documented instructions and not for any other purpose
• Implement adequate security: Establish and maintain appropriate technical and organisational security measures to protect personal information
• Notify of breaches: Notify us without undue delay upon becoming aware of any security compromise involving personal information processed on our behalf
• Assist with data subject requests: Assist us in responding to requests from data subjects exercising their rights under POPIA (access, correction, deletion)
• Delete or return data on termination: Upon termination of the agreement, delete or return all personal information processed on our behalf, unless retention is required by law
• Allow audits: Allow us to audit or inspect their compliance with the contractual terms and applicable data protection requirements

Where personal information is transferred to operators located outside South Africa, the following safeguards are in place:

• EU locations: Our primary database (Neon) and hosting (Vercel) are located in Frankfurt, Germany (EU). The European Union provides an adequate level of data protection as recognised under international standards, with the GDPR offering protections that are comparable to or exceed those provided by POPIA
• Binding contractual terms: All operators are bound by contractual terms that require them to protect personal information in accordance with POPIA and applicable data protection laws
• User consent: Users consent to the cross-border transfer of their personal information at the time of registration, as disclosed in our Privacy Policy

Operator compliance is monitored and reviewed as follows:

• Annual review: Operator compliance with contractual terms and security standards is reviewed annually by the Information Officer
• Agreement updates: Operator agreements are updated as needed to reflect changes in data processing activities, legal requirements, or security standards
• Incident review: Any security incidents involving an operator trigger an immediate review of the operator relationship and the adequacy of their security measures

Before engaging a new operator, the following steps are required:

• Privacy impact assessment: An assessment of the potential privacy impact of the new operator relationship, including the type and volume of personal information to be processed, the location of processing, and the operator's security posture
• Adequate agreement: A Data Processing Agreement (DPA) or equivalent contractual terms must be in place before any personal information is shared with the operator
• User notification: Users are notified of material changes to the operator list through updates to this page and, where appropriate, through direct communication

For questions about our operator agreements or the processing of personal information by third parties, please contact: