POPIA operator agreement

This agreement is between the residence named when it is accepted (the responsible party) and the operator of ResiCore named on the Contact page (ResiCore, the operator), as required by sections 20 and 21 of the Protection of Personal Information Act, 2013 (POPIA). It forms part of the Subscription agreement.

1. What is processed

Personal information of the residence's applicants, students, guardians, payers, visitors and staff that the residence or its users put into ResiCore: identity and contact details, ID or passport numbers, academic and funding information, documents, room, lease and payment records, maintenance and incident reports, and records of activity. Some of it may be special personal information (for example health information in an application) or information about children (applicants under 18, with a guardian's consent).

2. Purpose and instructions

ResiCore processes this information only to provide the service the residence uses, on the residence's documented instructions (the settings and actions of its users are instructions), and as the law requires. ResiCore does not use it for its own purposes, does not sell it, and does not use it for advertising.

3. Confidentiality

Everyone at ResiCore who can reach the information is bound to keep it confidential and has access only as far as their work needs. ResiCore's own staff do not open a residence's student records in routine work; support access needs the residence's permission, is limited in time and is logged.

4. Security measures (section 19)

ResiCore keeps appropriate, reasonable technical and organisational measures, including:

• each residence's data kept apart by row-level security in the database, as well as in the application;
• encryption in transit and at rest, and field-level encryption of ID numbers and sensitive reports;
• two-step verification for all staff, password checks before sensitive changes, and lockout after failed sign-ins;
• private storage of uploaded files, virus scanning, and short-lived download links;
• an audit log of important actions that cannot be edited;
• backups, monitoring, and prompt security updates.

5. Security compromises (section 22)

ResiCore notifies the residence immediately, and in any case within 48 hours, after becoming aware that the residence's personal information may have been accessed or acquired by an unauthorised person, with what is known, the likely consequences and the steps taken. ResiCore helps the residence notify the Information Regulator and the people affected.

6. Sub-operators and transfers

ResiCore uses service providers for hosting, file storage, email delivery and payments. Each is bound by a written agreement to at least the same protection. Information is stored in the European Union (Frankfurt, Germany). POPIA section 72 allows this because the law there (the EU's General Data Protection Regulation) protects personal information at least as well as POPIA, and our hosting providers are bound by written agreements to keep it confidential and secure. Any other processing outside South Africa takes place only as POPIA section 72 allows. ResiCore gives the residence its current list on request and notifies administrators before adding a provider that processes student records.

7. Helping the residence

ResiCore provides tools for the residence to answer requests from data subjects (access, correction, deletion and objection), to export its data, and to apply its document retention period, and helps with requests it cannot answer with those tools. ResiCore passes on to the residence any request it receives directly from a student or applicant.

8. End of the service

When the subscription ends, the residence can download its data for 90 days. ResiCore then deletes the residence's personal information, including files and backups as they expire, except records the law requires ResiCore to keep, and confirms the deletion on request.

9. Audits

ResiCore answers the residence's reasonable written questions about its protection of the information, and makes a summary of its security measures available on request.

10. Contact

Questions about this agreement go to ResiCore's Information Officer at the email address on the Contact page.