Business Data Processing Agreement

1. When this agreement applies

This agreement applies when a business customer uses Alevo to process personal information on its behalf. The business customer is the responsible party under POPIA for the information it decides to collect and enter. Ubuntu Solu Labs (Pty) Ltd, trading as Alevo, operates Alevo and acts as the operator for that information.

This agreement supplements the customer's Alevo Terms of Service. If there is a conflict about personal-information processing, this agreement controls for that subject.

2. Processing instructions and purpose

Ubuntu Solu Labs will process customer data only to provide, secure, maintain and support Alevo, including to:

• authenticate users and manage workspace access;
• store, organise and display invoices, quotes, clients, expenses and related records;
• generate PDFs, send transactional emails and support payment requests;
• prevent abuse, investigate security events and maintain reliable infrastructure; and
• follow the customer's lawful written instructions.

Ubuntu Solu Labs will not sell customer data or use it for targeted advertising.

3. Data categories and people affected

Depending on the features used, customer data may include names, email addresses, phone numbers, business details, client addresses, invoice and quote information, payment status, bank-account details, attachments, notes and user activity.

People affected may include the customer's users, clients, suppliers, employees, contractors and other contacts. Customers must not upload special personal information or identity documents unless they have a lawful reason and have agreed the handling with Ubuntu Solu Labs first.

4. Specialized data and operator terms

Specialized workflows may contain health information such as ICD-10 codes, medical-scheme or membership details; dependant or minor information; and legal-matter information such as case numbers and matter references. The customer must give lawful, documented instructions and establish the applicable POPIA authorisation before entering this information.

POPIA section 26 restricts special personal information unless an exception applies, including section 32 for health information. Processing personal information of children is addressed in sections 34 and 35. Ubuntu Solu Labs will keep operator personnel bound by confidentiality and will maintain reasonable technical and organisational measures appropriate to the service and risk, consistent with POPIA sections 20 and 21.

The customer remains responsible for professional accuracy, patient or client notices, consent, dependant or competent-person permissions, ICD-10 and tariff accuracy, legal-matter confidentiality, and compliance with applicable medical, legal, tax and industry rules.

5. Customer responsibilities

• collect and use information lawfully, fairly and for a defined purpose;
• give people the notices required by POPIA and other applicable law;
• keep information accurate, relevant and limited to what is needed;
• control user permissions and promptly remove access that is no longer needed; and
• respond to requests from the people whose information the customer controls.

6. Security

Ubuntu Solu Labs will maintain reasonable technical and organisational safeguards appropriate to Alevo's size and the risks involved. These include encrypted connections, authentication controls, workspace isolation, restricted database permissions, audit logging, backups, monitoring and controlled deletion processes.

Customers are responsible for secure passwords, account access, device security and choosing appropriate workspace permissions.

7. Subprocessors

Ubuntu Solu Labs may use specialist providers to operate Alevo, including Clerk for authentication, Neon for the database, Cloudflare R2 for files, Vercel for hosting, Resend for transactional email, Paystack for payment processing, Sentry for error monitoring and PostHog for optional analytics.

We will require relevant providers to protect customer information and will update the Data & Privacy Policy when the provider list materially changes.

8. Requests, incidents and cooperation

Ubuntu Solu Labs will reasonably assist the customer with access, correction, export, deletion and security requests relating to customer data, taking into account the nature of the service and the information available to us.

If we discover a security compromise involving customer data, we will notify the customer without unreasonable delay, provide the information reasonably available about the incident, and cooperate on containment and legally required notifications. The customer remains responsible for notifying the Information Regulator and affected data subjects where POPIA requires it.

9. International processing

Some providers may process information outside South Africa. We will use reasonable contractual, technical and organisational safeguards for those transfers and will provide information about relevant providers on request.

10. Retention and return

When the customer closes its Alevo account, ordinary deleted data is removed from normal access and is normally recoverable for 60 days before permanent purge. Business financial records may have a documented five-year baseline or a longer legal, audit, fraud or dispute hold. Backups expire through their normal rotation.

Before closure, customers should export the records they need. To request an export or discuss an exit plan, contact support@ubuntusolu.com.

11. Audits and contact

On reasonable written request, Ubuntu Solu Labs will provide available information about its security and processing practices. Requests must not expose another customer's confidential information or create unreasonable disruption.

For DPA, security or privacy questions, email legal@ubuntusolu.com. This template should be reviewed and signed with a customer where a formal contract is required.