Data Processing Policy

This policy describes how Noko Mohoto Technologies (Pty) Ltd processes data in two roles: as a responsible party for its own business data, and as an operator/processor when working on systems that hold client data.

As a business (our own data)

• Website enquiries are processed to respond to and scope project requests
• Client and project records are processed to deliver contracted work, invoice, and provide support
• Data is processed on a need-to-know basis within the business

As an operator/processor (client systems)

• We access client data only to the extent needed to build, maintain, or support the agreed system
• We follow the client's documented instructions for how their data may be used
• We do not use client data for our own purposes, and we do not sell it
• Access credentials to client environments are stored securely and not shared
• On termination of an engagement, client data and credentials in our possession are returned or deleted as agreed

Processing agreements

Where a client's compliance obligations require it, we can enter into a written data processing agreement that records the scope, purpose, security measures, subprocessors, and deletion terms for the engagement.