Data Processing <em>Agreement</em>

Scope & Parties

This Data Processing Agreement (DPA) governs the processing of personal information and Operational Data by Sinai Berakah (Pty) Ltd as Operator, on behalf of the Client as Responsible Party, in connection with the Volentegy™ Platform.

This DPA forms part of and is incorporated into the Master Subscription Agreement between Sinai Berakah and the Client. In the event of conflict, this DPA prevails with respect to data processing matters.

Sinai Berakah's Obligations as Operator

Process Operational Data only on documented instructions from the Client.
Ensure all personnel with access to Operational Data are bound by confidentiality obligations.
Implement technical and organisational measures to ensure appropriate security of Operational Data.
Not engage sub-processors without prior written consent from the Client, except as listed in Schedule A.
Assist the Client in fulfilling its obligations under POPIA, including responding to data subject requests.
Notify the Client within 72 hours of becoming aware of a personal information breach.
At the Client's election, delete or return all Operational Data on termination of the Subscription.

Prohibited Uses of Operational Data

Binding Commitment: Sinai Berakah shall not use Operational Data to train, fine-tune, or improve any artificial intelligence or machine learning model, including Volty™ and any upstream models provided by Anthropic PBC or any other third party.

Operational Data shall not be:

Disclosed to third parties except as required to deliver the Platform services.
Used for Sinai Berakah's own commercial purposes beyond service delivery.
Transferred outside the Republic of South Africa without prior written Client consent, except to Microsoft Azure infrastructure in the European Economic Area under Microsoft's standard contractual clauses.

Technical & Organisational Measures

Sinai Berakah implements and maintains the following measures:

Control	Implementation
Encryption in transit	TLS 1.3 for all data transmissions
Encryption at rest	Microsoft OneDrive AES-256 encryption
Access control	Role-based access, per-tenant data isolation
Authentication	Bcrypt password hashing, session management, rate limiting
Audit logging	All access and data events logged with timestamps and user IDs
Incident response	72-hour breach notification, documented response procedure

Schedule A: Approved Sub-Processors

Sub-Processor	Location	Purpose
Microsoft Corporation	EEA (Ireland)	OneDrive data storage; Microsoft 365 infrastructure
Anthropic PBC	USA	AI inference API (no training on Client data — contractually guaranteed)
Domains.co.za	South Africa	Web hosting and database infrastructure

Sinai Berakah will provide 30 days written notice before adding any new sub-processor, during which the Client may object in writing.