Operator Addendum

1. What this addendum is, and how it applies

This Operator Addendum (“Addendum”) governs the processing by Xinnace (Pty) Ltd, registration number 2025/316516/07, of 22 Umhlanga Boulevard, Umhlanga, KwaZulu-Natal, 4321, South Africa (“Xinnace”, “we”, “us”) of personal information on behalf of a client organisation (“Client”, “you”) in the course of providing the Xinnace HRMS Platform.

It forms part of, and is incorporated into, our Terms and Conditions as contemplated in clause 10 of those Terms. Where this Addendum and the Terms conflict on the processing of personal information, this Addendum prevails. Words defined in the Terms carry the same meaning here.

This Addendum is accepted electronically by the Client’s account holder inside the platform. In terms of section 12 of the Electronic Communications and Transactions Act 25 of 2002, an agreement recorded in a data message that is accessible for later reference satisfies a requirement that it be in writing, and section 21(2) of POPIA requires this contract to be in writing. We record the date, the name and email address of the person who accepted, and the version accepted, and we will provide that record to you on request.

Where you and Xinnace have signed a separate negotiated data processing agreement, that agreement governs and this Addendum does not apply to you.

2. Definitions

• “POPIA” means the Protection of Personal Information Act 4 of 2013.
• “Client Data” means personal information that you, your users or your data subjects submit to, or that is generated in, your workspace on the HRMS Platform.
• “data subject”, “operator”, “personal information”, “processing”, “responsible party” and “special personal information” carry the meanings given to them in POPIA.
• “security compromise” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Data.
• “sub-operator” means a third party engaged by Xinnace to process Client Data on our behalf.

3. Roles of the parties

For Client Data, you are the responsible party and Xinnace is your operator. You determine the purpose and means of processing. We process Client Data only for you.

You remain responsible for: having a lawful basis for the processing, meeting POPIA’s conditions for lawful processing in your own organisation, issuing any notices your employees or applicants are entitled to, and for the accuracy and lawfulness of the instructions you give us. We are not in a position to assess whether you may lawfully hold a given record about your own staff, and we do not attempt to.

Xinnace is a responsible party in its own right for a separate and limited set of information: the contact details of your administrators and billing contacts, our own account, billing and support records, and information collected through our public website. That processing is described in our Privacy Policy and is not governed by this Addendum.

4. Subject matter of the processing

Section 21 requires the arrangement between us to be defined rather than open-ended, so the scope is set out here.

Nature and purpose: hosting and operating a human resource management platform, so that you can administer employment records, attendance and rostering, leave, payroll inputs, performance and KPIs, disciplinary and grievance matters, recruitment, engagement surveys and related HR functions.

Duration: for as long as your subscription is active, plus the deletion period in clause 12.

Categories of data subject: your employees and former employees, their dependants and emergency contacts where you record them, job applicants and referred candidates, and your own users of the platform.

Categories of personal information: identifying and contact details, employment and remuneration details, attendance and leave records, performance and disciplinary records, recruitment records including uploaded documents such as CVs and identity documents, and such other fields as you choose to configure.

Special personal information: the platform supports fields that are special personal information under section 26, including race and disability status where you capture them for Employment Equity reporting, and health or criminal-behaviour information where your own processes record it. Race, disability and gender can each be switched off for your workspace, after which the platform does not ask for, show, export or send them through the API; values already stored are kept, hidden, until you ask us to delete them. Identity numbers are held in full only on the employee record and appear everywhere else, including the audit trail, masked to their last four characters. You are responsible for establishing that section 27 or section 28 authorises your processing of those fields. We treat them as special personal information for security purposes wherever they appear.

Medical certificates, and the option not to hold them: where your return-to-work process deals with a medical certificate, the platform lets you record that the certificate was produced and checked — the practitioner, their registration number and the days it books off — without storing a copy of it. Certificate uploads can also be switched off for your whole workspace, after which the platform refuses them. Whether to hold certificates, and for how long, is your decision as responsible party; switching uploads off is the simplest way to keep health information out of the platform altogether while still evidencing that proof was seen.

Children’s information: the platform is not designed for the processing of personal information of children as defined in POPIA, other than dependant details you may record. You should not use it for that purpose without first satisfying yourself that section 35 permits it.

Workplace monitoring, and the Time Tracker extension: the platform includes an optional browser extension, the Xinnace Time Tracker, which your employees may install to clock in and out and change status without returning to the Xinnace tab. Where you deploy it, we process on your instruction: clock-in, clock-out, break and status events; a presence signal approximately every thirty seconds, recorded with the originating IP address; screen-lock and idle transitions reported by the browser; and counts of clicks and keystrokes, batched approximately once a minute. Keystroke data is numeric only — how many, never which — and neither we nor the extension record the characters typed or the content of any page the employee views.

Page addresses are your setting, not ours: whether the extension records the addresses and titles of pages an employee visits is configurable by you at workspace level and has three positions — off, in which no address or title is stored; workspace only, in which addresses are retained solely for pages on your own Xinnace workspace and all others are discarded; and all sites, in which addresses and titles of other websites are retained also. The setting is enforced on our servers rather than in the extension, so it cannot be defeated by modifying the software on an employee’s device. The default is workspace only. The setting may also be overridden for an individual employee, against a recorded reason. Selecting a level, and overriding it for a particular person, are your decisions as responsible party.

Monitoring is your processing, and your justification: the extension is a tool we operate on your instruction. Selecting all sites, or requiring the extension at all, is workplace monitoring carried out by you as responsible party. You are responsible for establishing that it is lawful and justifiable in your circumstances, for limiting it to what is adequate, relevant and not excessive under section 10, for the notice your employees are entitled to under section 18, and for any obligation arising under the Regulation of Interception of Communications and Provision of Communication-related Information Act or your own employment agreements and policies. We will not enable monitoring beyond the position you have set, and we do not use any of this data for our own purposes.

5. Our obligations as operator

In terms of sections 20 and 21 of POPIA, Xinnace will:

• Process only on your instructions. We process Client Data only with your knowledge and authorisation, for the purpose of providing the platform and the support you ask for, and not for any purpose of our own. Your use of the platform, your configuration of it, and the support requests you send us are your documented instructions. We do not sell Client Data, and we do not use it to train machine learning models.
• Treat it as confidential. We treat Client Data as confidential and do not disclose it except as this Addendum permits.
• Keep it secure. We establish and maintain the security safeguards described in clause 6, as section 21(1) read with section 19 requires.
• Tell you if it is compromised. We notify you of a security compromise as set out in clause 8, as section 21(3) requires.
• Follow the law. Where we are required by law to process Client Data otherwise than on your instructions, we will tell you before doing so unless that law forbids us from telling you.
• Watch for attacks. Keeping the platform secure includes monitoring it, which section 19 requires of us as part of our security safeguards. Every hour our systems check the security records of each workspace (failed sign-ins, wrong two-step codes, locked accounts, requests refused by your IP allowlist and sign-ins from a new country) for patterns that may indicate an attack. The country of an IP address is looked up on our own servers from a downloaded list; no address is sent to a third party. A pattern raises an incident for our personnel to review, recorded in our incident log with the accounts and IP addresses involved. This is done to protect the platform and Client Data, not for any other purpose; nothing is decided automatically, and where an incident turns out to be a compromise of Client Data, clause 8 applies.
• Limit who can see it. Access by Xinnace personnel is limited to those who need it to operate the platform or to answer a support request. Staff access to a workspace is through a single-use, short-lived token, is recorded on both our audit trail and yours, and displays a banner for the duration of the session. Our personnel are bound by confidentiality obligations that survive the end of their engagement.

6. Security safeguards

We maintain appropriate, reasonable technical and organisational measures as required by section 19. The measures currently in place include:

• Tenant isolation. Every client workspace has its own separate database, and the lookup that maps a workspace to its database fails closed: an unknown or suspended workspace is refused rather than falling back to another client’s data.
• Encryption in transit. Connections use HTTPS with TLS. Plain HTTP is refused rather than redirected, and HTTP Strict Transport Security is sent with a one-year lifetime covering workspace subdomains.
• Credential protection. Passwords are stored as salted bcrypt hashes and are never stored in a readable form. Our staff cannot retrieve a password, only trigger a reset. Integration keys are stored hashed, carry only the scopes you grant, and are individually rate limited and revocable.
• Access control. Permissions are granular, set per action rather than per module, and enforced on the server for every request rather than only in the interface. Sign-in can optionally be restricted to your own IP ranges.
• Brute-force and session protection. Sign-in attempts are rate limited per IP address, repeated failures are locked out, session cookies are HTTP-only, secure and SameSite-restricted, and the session identifier is regenerated on sign-in.
• Two-step sign-in. Every account can add a code from an authenticator app to its password, and you can require it for your administrators or for everyone. Wrong codes count as failed sign-ins. Each user has one-time recovery codes, stored as one-way hashes.
• IP addresses in logs. You choose how long the platform’s logs keep IP addresses and browser details (3, 6, 12, 24 or 36 months, or for as long as your subscription is active); older ones are cleared nightly, and the record of what was done is kept.
• Audit logging. Record changes are logged with previous and new values, together with who made the change, from where and when. Failed sign-ins, permission denials and settings changes are logged separately from data changes.
• Backups. Databases and uploaded documents are backed up nightly to storage in the AWS Africa (Cape Town) region, where the backups are encrypted at rest and each night is written as a separate dated object and held for 90 days. The credentials the servers carry can add backups to that storage, and read them back to verify a restore, but cannot delete them, and an overwritten backup remains recoverable for 30 days, so reaching a server does not reach the backup history behind it. The database service also keeps its own automated backups for 7 days, with point-in-time recovery inside that window. Each night one workspace’s backup is restored into a scratch database to prove the backups work, and on 4 October 2026 a full restore test measured about 5 minutes of data at risk and about 10 minutes to a working database.

Our security overview describes these controls in full, is kept current, and is the authoritative description of them. It also names what is not yet in place, currently including independent penetration testing, scheduled vulnerability scanning, a published patch cadence, and restore testing on a regular schedule. We would rather you assessed us on what we can demonstrate than on a list that reads well. Nothing in this Addendum should be read as claiming a certification: we hold none.

We may change these measures from time to time, provided the level of protection is not materially reduced.

7. Sub-operators

You authorise us to engage sub-operators to process Client Data, on condition that each is bound by obligations no less protective than those in this Addendum, and that we remain responsible to you for their processing.

The sub-operators in use are:

• Amazon Web Services (AWS). Hosts the platform in the AWS Africa (Cape Town) region, af-south-1: the application servers, the databases (one for each Client), the session cache and file storage, all encrypted at rest. Also stores the backups of the databases and uploaded documents in the same region, encrypted at rest. Hosting and backups do not leave South Africa.
• Google Workspace (email). Carries the platform’s system email, such as invitations, password links, notifications and reminders. Message content and recipient addresses are processed outside South Africa.
• Platform service providers. YouTube in its privacy-enhanced mode (tutorials page only), Giphy (the GIF picker: search terms are sent to Giphy’s API from our server, and GIFs load from Giphy) and, where a user chooses it, Google Sign-In. These receive users’ IP addresses and browser details, and Giphy receives GIF search terms; they may process that information outside South Africa.

We will give you reasonable notice before adding or replacing a sub-operator that processes Client Data. If you reasonably object to a new sub-operator on data protection grounds, tell us at privacy@xinnace.com and we will work with you to find an alternative. If we cannot, you may terminate the affected part of the service without penalty, and clause 12 applies.

8. Security compromises

Section 21(3) requires an operator to notify the responsible party immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

Accordingly, on becoming aware of a security compromise affecting Client Data we will notify you without undue delay, using the account holder and administrator contact details on your account, and will include what we know at the time: what happened, when, which categories of Client Data and roughly how many records are affected, what we are doing about it, and what we recommend you do. Where the full picture is not yet available, we will notify you first and follow up as we establish more, rather than delaying the first notification until the investigation is complete.

We will assist you with the notifications you must make. Reporting a compromise to the Information Regulator and to affected data subjects under section 22 is your obligation as responsible party, not ours, because it is your relationship with those data subjects. We will not make that notification on your behalf unless you ask us to in writing.

To report a suspected security issue to us, email security@xinnace.com and mark the subject line Security. We aim to acknowledge within one business day.

9. Data subject requests

Requests from your employees or applicants to access, correct or delete their information are yours to answer, since it is your record and your relationship. Most such requests can be answered by you directly in the platform, which is the fastest route for everyone.

Where you need our help, we will provide reasonable assistance. If a data subject approaches us directly about Client Data, we will not respond to the substance of the request. We will tell them to approach you and, where we can identify your organisation, let you know that they made contact.

The platform gives you the tools to answer these requests yourself:

• a register of requests that records when each arrived and the date it must be answered by (one month, extendable once by up to two months with a reason), and the reason for any refusal;
• a subject access file for an employee, produced in one step;
• erasure of a job applicant or referred candidate under section 24, with uploaded documents such as CVs and identity copies removed from storage before the record itself;
• erasure of an employee, which keeps only what the Basic Conditions of Employment Act (three years) and the Tax Administration Act (five years) still require, reduced to what those statutes ask for, and deletes that remainder when the period ends. Those statutory periods are not the data subject’s to waive;
• an optional setting that deletes former employees’ records automatically once their statutory period ends, listing each person for 30 days first so that you can keep any record you still need;
• a generated record of processing for your workspace.

10. Your obligations

• Give lawful instructions, and only process Client Data through the platform where POPIA permits you to.
• Give your employees, applicants and other data subjects any notice they are entitled to under section 18, and obtain any consent your processing relies on.
• Manage your own users: grant the least access each person needs, remove access promptly when someone leaves, and keep your account holder and administrator contact details current, since those are the addresses a breach notice goes to.
• Do not send us Client Data through insecure channels, and do not include employee or candidate personal information in support requests or security reports where a workspace reference would do.
• Where you deploy the Time Tracker extension or change its page-address setting, satisfy yourself that the resulting monitoring is lawful and justifiable, tell your employees what is being collected about them and why, and keep that notice current if you change the setting.
• Tell us if you become aware of a compromise affecting your workspace, including one originating on your side.

11. Cross-border transfers

Primary Client Data, meaning the application, databases and uploaded documents, is hosted in South Africa. Section 72 permits a transfer of personal information outside the Republic in defined circumstances, including where the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection.

The transfers that occur are limited to the email delivery described in clause 7, where message content and recipient addresses are processed outside South Africa; to the platform service providers described in clause 7 (YouTube, Giphy and, where a user chooses it, Google Sign-In), which may process users’ IP addresses, browser details and GIF search terms outside South Africa. Our own hosting and backups are held in the AWS Africa (Cape Town) region and do not leave South Africa. Where a transfer does take place we require an adequate level of protection by agreement with the recipient, as section 72 contemplates. If your assessment needs the full picture for your file, ask us at security@xinnace.com and we will set it out.

12. Retention, return and deletion

We retain Client Data for as long as your subscription is active. On termination or expiry, and at your election, we will return your Client Data to you or delete it.

You can export your main registers, including employees, attendance, payroll and recruitment, to CSV at any time during your subscription, and our REST API lets you pull your data on your own schedule. Taking an export before your subscription ends is the most reliable way to keep your records, and we recommend it rather than relying on a request afterwards.

Unless you ask us in writing to do so sooner, or a longer period is agreed, we will offer you an export and then delete your workspace database and uploaded documents within 90 days of termination. This gives you a window to ask for an export or to reactivate, and it is not an invitation to leave your data with us: ask us to delete earlier and we will. Copies held in backups persist until each backup expires on its own schedule: our off-site backups are retained for 90 days from the night each was written. Those periods run on from the deletion rather than alongside it, so where deletion falls at the end of the 90-day window the last backup containing your data expires up to 90 days after that. Backups are not used to reconstitute a deleted workspace. We may retain information we are required by law to keep, such as invoicing and tax records, which are not Client Data.

13. Audit and information

On reasonable written notice, and no more than once in any 12-month period unless a security compromise or a Regulator’s requirement makes a further request necessary, we will make available the information reasonably needed to demonstrate our compliance with this Addendum, and will respond to a reasonable security assessment questionnaire.

Because the platform is shared infrastructure, an on-site inspection of the hosting environment by a client is not something we can offer, and testing against the live platform is not permitted. Send technical and vendor-assessment questions to security@xinnace.com, and where a control matters to your assessment we will arrange a demonstration of it.

14. Liability

The limitations and exclusions of liability in the Terms and Conditions apply to this Addendum, and liability under this Addendum counts towards the same aggregate cap. Nothing in this Addendum limits liability that cannot be limited in law, including liability for a party’s own wilful misconduct, or either party’s own liability to a data subject or to the Information Regulator under POPIA.

15. Duration and changes

This Addendum takes effect when you accept it, or when you first use the HRMS Platform after its effective date, and continues for as long as we process Client Data for you. Clauses 8, 12 and 14 survive its termination.

We may update this Addendum from time to time, for example when a sub-operator changes or the law does. We will notify a material change by email to your account holder or through the platform before it takes effect. Where a change materially reduces the protection given to Client Data and you do not accept it, you may terminate the affected service without penalty by telling us within 30 days of the notice.

16. Contact

Xinnace (Pty) Ltd
Information Officer: Poobalan Soobramoney, Chief Executive Officer
Data protection and Information Officer requests: privacy@xinnace.com
Security incidents and vendor assessments: security@xinnace.com
Contractual and legal notices: legal@xinnace.com
22 Umhlanga Boulevard
Umhlanga, KwaZulu-Natal, 4321
South Africa

You have the right to complain to the Information Regulator. Their contact details, and how to lodge a complaint, are set out in our Privacy Policy.