DRAFT — FOR PROFESSIONAL LEGAL REVIEW
Prepared for ORION269 (PTY) LTD / WhatsMyBiz.App
This document is a draft for review only. Subject to professional legal review and approval.
Operated by ORION269 (PTY) LTD | CIPC 2026/535275/07
Draft v2.0 for review — effective date to be confirmed on approval. Draft prepared for ORION269 (PTY) LTD. Subject to professional legal review and approval.
These Business Data Processing Terms apply where a WhatsMyBiz Customer instructs ORION269 to process personal information on the Customer's behalf. They supplement the main Terms of Service and are intended to support the parties' obligations under POPIA.
The parties will determine their roles based on the actual processing. Where the Customer determines the purpose and means of processing Customer-controlled personal information, the Customer is the Responsible Party and ORION269 is an Operator for that processing. ORION269 may separately be a Responsible Party for its own account, billing, website, security and administrative processing.
ORION269 will treat personal information processed on behalf of the Customer as confidential and will limit access to authorised persons and service providers who need access to perform the service.
ORION269 will maintain reasonable technical and organisational safeguards appropriate to the risks presented by the processing, including access controls, authentication, secure transmission where supported, monitoring and incident-response procedures. These safeguards are not a guarantee against all possible breaches.
The Customer authorises ORION269 to use appropriate third-party providers necessary to deliver the service, including infrastructure, messaging, AI model and inference, and payment providers. Not every third-party system is a sub-operator or "data processor" in every case; the role of each provider depends on what it actually does with personal information. ORION269 will require appropriate contractual or equivalent protections where a provider processes personal information on ORION269's behalf, and may update its provider list as the service evolves. The underlying artificial-intelligence models and related infrastructure used by Intelligent Agents may be supplied by independent third-party providers, which may change over time.
Where ORION269 has reasonable grounds to believe that personal information processed for a Customer has been compromised, ORION269 will notify the Customer without undue delay, subject to legitimate security, law-enforcement and confidentiality considerations. The Customer remains responsible for regulatory notifications to data subjects or the Information Regulator where POPIA places that responsibility on the Responsible Party, with ORION269 providing reasonable assistance. Where a compromise occurs at an operator or sub-operator engaged by ORION269, the applicable notification obligations will be managed in accordance with POPIA, with the responsible party handling notifications to the Regulator and affected data subjects.
Where a request concerns personal information for which the Customer is the Responsible Party, ORION269 will reasonably assist the Customer in locating, correcting, deleting or otherwise handling the information where technically possible and legally appropriate. ORION269 may require the Customer to verify the authority of the requester.
Where personal information is transferred to or processed by a provider outside South Africa, ORION269 will consider and apply the safeguards required by POPIA for the relevant transfer, including appropriate contractual, technical or other lawful safeguards where required. The actual provider and location may vary and may change over time. The Customer must not instruct processing that is unlawful or outside the agreed service purpose.
During the service, ORION269 will retain Customer data as necessary to provide the service. After termination, Customer business data will be deleted or anonymised in accordance with the applicable retention schedule for the relevant system (generally within 60 days where the system supports it, and otherwise within the system's scheduled purge cycle) unless the Customer requests an earlier deletion where feasible, or retention is required for law, disputes, security, backups, fraud prevention, accounting/tax obligations, technical deletion cycles or other lawful purposes. This does not guarantee deletion from every third-party backup within that period. Retention schedules may differ between systems; ORION269 will apply the applicable schedule for each system.
Taking into account the nature of the processing, ORION269 will provide reasonable information necessary for the Customer to assess compliance with applicable data-protection obligations, including reasonable assistance with records of processing activities required under section 17 of POPIA. Any audit must be reasonable, proportionate, scheduled in advance and must not compromise the security or confidentiality of other customers or ORION269's systems.
The Customer must notify ORION269 before intentionally using the service for special personal information or children's information where additional legal requirements may apply. ORION269 may refuse or restrict a use case where it cannot reasonably support lawful and safe processing.
At the end of the applicable service, ORION269 will cease processing Customer personal information except as necessary for lawful retention, security, disputes, backup deletion cycles or other permitted purposes.
ORION269 (PTY) LTD Information Officer: Graham Schubach (registered with the Information Regulator: 2026-061428) hello@whatsmybiz.app +27 72 497 1810 26 Vasco da Gama Drive, Amanzimtoti, Durban, Kwa-Zulu Natal, 4001
ORION269 (PTY) LTD · CIPC 2026/535275/07 · docs.oriondevcore.com Draft prepared for ORION269 (PTY) LTD. Subject to professional legal review and approval.
Each party remains liable for loss caused by its own breach of these Business Data Processing Terms, subject to the Terms of Service and applicable law. Nothing in these terms excludes or limits liability that cannot lawfully be excluded or limited.
These Business Data Processing Terms are governed by the laws of the Republic of South Africa.