Shelter Data Processing Agreement

Shelter Data Processing Agreement (DPA)

Operator: Samuel Fourie (individual / sole proprietor) trading as HomeForPaws, Pretoria, Gauteng, South Africa (“Operator”, “we”, “us”).

Contact (including POPIA requests): sam@homeforpaws.co.za

Responsible Party: The shelter or animal welfare organisation creating an account and accepting this Agreement (“Shelter”, “Responsible Party”, “you”). The Shelter’s legal name is the name entered by the Shelter during Shelter profile setup in the Platform.

Binding acceptance & authority: This Agreement becomes binding when the Shelter clicks “I accept” (or similar) during onboarding or account creation. The person accepting this Agreement represents and warrants that they are authorised to bind the Shelter.

1) Definitions

• “POPIA” means the Protection of Personal Information Act 4 of 2013 (South Africa), as amended.
• “Personal Information”, “Processing”, “Responsible Party”, “Operator”, and “Data Subject” have the meanings given in POPIA.
• “Shelter Records” means all Personal Information and content processed through the Platform on behalf of the Shelter, including (without limitation): adopter/applicant applications and application data; adoption decisions and adoption records; adoption agreements / contract PDFs and related metadata; cruelty/inspectorate/welfare cases, reports, statements, notes, outcomes, and timelines; evidence and attachments (photos, videos, documents); any other records, files, notes, templates, or fields created, captured, configured, or uploaded by the Shelter or its users within the Platform.
• “Platform Data” means data processed by the Operator as part of running the Platform and operating the Operator’s business, excluding Shelter Records, including (without limitation) billing references and subscription status, operational logs, security logs, and platform performance analytics.
• “Sub-processor” means a third party engaged by the Operator to process Personal Information on behalf of the Shelter.
• “Security Compromise” means any unauthorised access to, acquisition of, alteration of, disclosure of, or loss of Shelter Records, or any reasonably suspected compromise affecting the confidentiality, integrity, or availability of Shelter Records.
• “Agreement” means this Shelter Data Processing Agreement (including Appendix A).

2) Scope and roles

• Shelter is the Responsible Party for Shelter Records. The Shelter determines the purpose and means of Processing Shelter Records and is responsible for ensuring it has a lawful basis to collect and process such Personal Information and for meeting Responsible Party obligations under POPIA and any other applicable law.
• Operator is the Operator for Shelter Records. The Operator processes Shelter Records on behalf of the Shelter and on the Shelter’s instructions as set out in this Agreement and as further instructed through the Shelter’s configuration and use of the Platform.
• Operator is the Responsible Party for Platform Data. The Operator processes Platform Data as a Responsible Party for purposes such as operating the Platform, security, billing administration, and service improvement, in accordance with the Operator’s Privacy Policy.

3) Processing instructions and permitted purposes

• The Operator will process Shelter Records only to the extent necessary to: provide, operate, and maintain the Platform features used by the Shelter (including forms, case management, adoption workflows, document generation, storage and retrieval, and user management); generate, store, and retrieve adoption agreements and related legal recordkeeping documents; provide email-based support to the Shelter; secure the Platform, prevent abuse and fraud, maintain auditability, and diagnose operational issues; and comply with the retention and recordkeeping terms in this Agreement where required for lawful recordkeeping and as instructed by the Shelter.
• The Shelter instructs the Operator by: configuring and using Platform settings, templates, forms, fields, workflows, and permissions; creating, editing, or deleting records (where permitted); uploading files/evidence and attaching them to records; and taking administrative actions within the Platform.
• The Operator will not: sell Shelter Records; use Shelter Records for advertising; or use Shelter Records to train public, general-purpose machine learning or AI models.

4) Categories of Data Subjects and Personal Information

• Data Subjects may include: adopters / applicants; Shelter staff and authorised Platform users; complainants, accused persons, witnesses, and other individuals referenced in cruelty/inspectorate/welfare cases.
• Personal Information in Shelter Records may include (depending on what the Shelter collects and configures): names, contact details (phone/email), addresses; South African ID numbers or passport numbers; employment and other application-related information; home inspection notes, references, screening notes, and adoption outcomes; case-related details including statements, investigation notes, outcomes, timelines, and related correspondence; evidence files and attachments (photos, videos, documents); access and audit information associated with Shelter use of the Platform (e.g., which Shelter user created/updated records), to the extent captured by Platform features.
• Technical and usage information may be processed and/or stored for security and operations and may include: IP addresses (the Operator stores IP addresses); device and browser details; security and access logs; and Platform usage events and internal analytics (including views, contact reveals, likes, saves, and page views).

5) Sub-processors, hosting locations, and cross-border processing

• The Shelter authorises the Operator to use the Sub-processors listed in Appendix A for the stated purposes.
• The Shelter acknowledges and authorises the following processing locations: Authentication: Firebase Authentication processes authentication data in the United States. Files: Cloudflare R2 stores files (including adoption agreements/contract PDFs, images, videos, and evidence) in Western Europe. Database: MongoDB Atlas hosted on AWS Cape Town, South Africa stores database records (including Shelter Records and Platform Data as applicable). Application hosting & execution: Vercel hosts the Platform and executes serverless functions configured for Cape Town, South Africa. Payments: Paystack processes payments. The Operator stores payment references, subscription status, and related metadata; the Operator does not store card details.
• Cross-border processing. Where Shelter Records (or components of Shelter Records such as authentication and file storage) are processed outside South Africa, the Shelter confirms it has a lawful basis to permit such cross-border processing for the relevant Data Subjects; instructs the Operator to process such Personal Information as necessary to provide the Platform; and authorises the Operator’s use of contractual safeguards with Sub-processors and the security measures set out in this Agreement.
• Sub-processor updates. The Operator may add or replace Sub-processors. The Operator will update Appendix A and provide notice to the Shelter (by email to the Shelter admin account and/or in-app notice) before material changes, unless an urgent change is required for security or service continuity.

6) Security measures

• The Operator will implement reasonable technical and organisational security measures appropriate to the nature of Shelter Records and the risk of Processing, including: encryption in transit (TLS/HTTPS); access controls and least-privilege principles for Operator systems; secure handling of credentials and secrets; monitoring and internal logging to support security and operational reliability; and reasonable steps to prevent unauthorised access, alteration, disclosure, or loss of Shelter Records.
• The Shelter is responsible for: maintaining appropriate access controls within the Shelter’s own organisation; assigning and reviewing Shelter user roles and permissions; safeguarding Shelter admin accounts and credentials; and ensuring Shelter users access Shelter Records only as authorised.

7) Security Compromise / breach notification

• If the Operator becomes aware of a Security Compromise affecting Shelter Records, the Operator will notify the Shelter without undue delay after becoming aware.
• The Operator’s notice will include, to the extent reasonably available: a description of the incident; categories of Shelter Records and/or Data Subjects affected (or potentially affected); steps taken to contain, mitigate, and remediate; and recommended steps the Shelter should take.
• The Operator will cooperate with the Shelter’s reasonable incident response efforts, including providing information reasonably necessary for the Shelter to assess notification obligations.

8) Retention, legal recordkeeping, and deletion

• Legal retention rules (default): Adoption agreements and adoption records are retained for five (5) years from the date the adoption agreement is signed. Cruelty/inspectorate/welfare cases and related evidence/documents are retained for five (5) years from the case closure date.
• Shelter instructions for longer retention. If the Shelter has a lawful requirement to retain specific records longer than the default in clause 8.1, the Shelter may instruct the Operator in writing (email is sufficient) to retain those specific records for the required period.
• Account deletion by an adopter/applicant user. When an adopter/applicant deletes their Platform account: the Operator will remove the user’s ability to access the Platform; the Operator will flag the user profile as deleted; and the Operator will retain the adoption application, adoption agreement, and related adoption records as required under clause 8.1 to preserve the Shelter’s recordkeeping and legal audit trail, and to maintain integrity of the Shelter’s records.
• Removal of a Shelter staff user. When a Shelter removes or disables a Shelter staff user: access is revoked; and records created or managed by that user remain associated with the Shelter and remain part of Shelter Records.
• Shelter termination/cancellation. Upon termination or cancellation by the Shelter, the Operator will delete Shelter Records promptly (typically immediately) after termination, except for records subject to retention obligations in clause 8.1 (and clause 8.2 where applicable) and except for limited retention in backups/logs as described below. The Shelter remains able to request export of Shelter Records prior to termination, and the Operator will provide reasonable export capability as available within the Platform.
• Backups and logs. Backups may persist for up to 30 days. Technical and security logs (which may include IP addresses) may persist for limited periods required for security and operations.

9) Data Subject requests (access, correction, deletion)

• The Shelter is responsible for responding to Data Subject requests relating to Shelter Records (including access, correction, objection, and deletion).
• The Operator will provide reasonable assistance to the Shelter to fulfil requests where the Shelter cannot reasonably do so without the Operator’s support, including: exporting records or subsets of records (as available within the Platform); deleting records after retention periods expire (where required and instructed); and correcting Shelter Records where instructed by the Shelter.
• If a Data Subject contacts the Operator directly about Shelter Records, the Operator may route the request to the Shelter or instruct the Data Subject to contact the Shelter.

10) Confidentiality

• The Operator will treat Shelter Records as confidential and will restrict access to: authorised Operator personnel who require access to provide or support the Platform; and authorised Shelter users as configured by the Shelter.
• The Operator may disclose Shelter Records where required by law, court order, or lawful request by competent authorities.

11) Compliance information and records

• The Operator will maintain: an internal record of the Shelter’s acceptance of this Agreement (timestamp and version); and reasonable internal documentation of security measures and Sub-processors.
• Upon reasonable written request, the Operator may provide the Shelter with a high-level summary of security practices and Sub-processors. This does not require a formal audit unless separately agreed in writing.

12) Payments

• Payments are processed through Paystack. The Operator stores payment references, subscription status, and plan metadata. The Operator does not store card details.
• This Agreement applies to Processing of Shelter Records and remains binding whether the Shelter is in a trial period or a paid subscription.

13) Limitation of liability (cap = 3 months subscription fees)

• To the maximum extent permitted by law, the Operator’s total aggregate liability arising out of or relating to this Agreement (whether in contract, delict/tort, negligence, strict liability, or otherwise) is limited to the subscription fees paid by the Shelter to the Operator in the three (3) months immediately preceding the event giving rise to the claim.
• The Operator is not liable for indirect, consequential, special, incidental, or punitive damages, or for loss of profits, revenue, business, goodwill, or anticipated savings, arising out of or relating to this Agreement.
• Nothing in this Agreement limits liability that cannot legally be limited.

14) Indemnity (Shelter)

The Shelter indemnifies and holds the Operator harmless from and against claims, losses, damages, liabilities, and reasonable costs arising from: the Shelter’s unlawful or improper collection of Personal Information; unlawful instructions given by the Shelter to the Operator; content uploaded by the Shelter or its users that the Shelter is not authorised to process or disclose (including evidence/documents); the Shelter’s failure to provide required notices or obtain required permissions/consents; and misuse of the Platform by the Shelter’s users.

15) Term and termination

This Agreement begins upon acceptance and continues for as long as the Shelter uses the Platform or until terminated. Termination triggers the deletion/export process in clause 8.

16) Governing law and jurisdiction

This Agreement is governed by the laws of South Africa. The parties consent to the jurisdiction of the courts located in Gauteng, South Africa.

Appendix A — Sub-processors (authorised)

The Shelter authorises the Operator to use the following Sub-processors for Processing in connection with the Platform:

The Operator may update this list under clause 5.4.

1. Firebase Authentication — authentication and login identity processing — United States
2. MongoDB Atlas on AWS (Cape Town) — database hosting/processing — South Africa
3. Vercel — hosting and serverless execution — Cape Town, South Africa (as configured)
4. Cloudflare R2 — file storage for adoption agreements/contract PDFs, images, videos, and evidence — Western Europe
5. Paystack — payment processing — (Operator stores references/status only; no card details stored by Operator)

Acceptance record (stored by the Platform)

When the Shelter accepts this Agreement, the Platform records and stores:

• the Shelter’s legal name (as entered in the Shelter profile),
• the accepting user’s name and email,
• the date/time of acceptance (UTC),
• the Agreement version (“1.0”),
• the URL of the versioned Agreement page accepted, and
• a content hash of the Agreement text at the time of acceptance.