*Operated by ORION269 (PTY) LTD | CIPC 2026/535275/07*
Effective date: 7 August 2026
These Business Data Processing Terms apply where a WhatsMyBiz Customer instructs ORION269 to process personal information on the Customer's behalf. They supplement the main Terms of Service and are intended to support the parties' obligations under POPIA.
The parties will determine their roles based on the actual processing. Where the Customer determines the purpose and means of processing Customer-controlled personal information, the Customer is the Responsible Party and ORION269 is an Operator for that processing. ORION269 may separately be a Responsible Party for its own account, billing, website, security and administrative processing.
ORION269 will treat personal information processed on behalf of the Customer as confidential and will limit access to authorised persons and service providers who need access to perform the service.
ORION269 will maintain reasonable technical and organisational safeguards appropriate to the risks presented by the processing, including access controls, authentication, secure transmission where supported, monitoring and incident-response procedures.
The Customer authorises ORION269 to use appropriate third-party providers necessary to deliver the service, including infrastructure, messaging, AI and payment providers. ORION269 will require appropriate contractual or equivalent protections where applicable. ORION269 may update its provider list as the service evolves.
Where ORION269 has reasonable grounds to believe that personal information processed for a Customer has been compromised, ORION269 will notify the Customer without undue delay, subject to legitimate security, law-enforcement and confidentiality considerations. The Customer remains responsible for regulatory notifications to data subjects or the Information Regulator where POPIA places that responsibility on the Responsible Party, with ORION269 providing reasonable assistance.
Where a request concerns personal information for which the Customer is the Responsible Party, ORION269 will reasonably assist the Customer in locating, correcting, deleting or otherwise handling the information where technically possible and legally appropriate. ORION269 may require the Customer to verify the authority of the requester.
Where personal information is transferred to or processed by a provider outside South Africa, ORION269 will apply the safeguards required by POPIA for the relevant transfer. The Customer must not instruct processing that is unlawful or outside the agreed service purpose.
During the service, ORION269 will retain Customer data as necessary to provide the service. After termination, Customer business data will generally be scheduled for deletion within 60 days unless the Customer requests an earlier deletion where feasible, or retention is required for law, disputes, security, backups or other lawful purposes.
Taking into account the nature of the processing, ORION269 will provide reasonable information necessary for the Customer to assess compliance with applicable data-protection obligations. Any audit must be reasonable, proportionate, scheduled in advance and must not compromise the security or confidentiality of other customers or ORION269's systems.
The Customer must notify ORION269 before intentionally using the service for special personal information or children's information where additional legal requirements may apply. ORION269 may refuse or restrict a use case where it cannot reasonably support lawful and safe processing.
At the end of the applicable service, ORION269 will cease processing Customer personal information except as necessary for lawful retention, security, disputes, backup deletion cycles or other permitted purposes.
ORION269 (PTY) LTD
Information Officer: Graham Schubach
hello@whatsmybiz.app
\+27 72 497 1810
26 Vasco da Gama Drive, Amanzimtoti, Durban, Kwa-Zulu Natal, 4001