INDAWOAI

App Sign up

← Indawo AI home · Envy Fincorp (Pty) Ltd t/a Indawo AI, reg. 2021/756475/07

Indawo AI Operator Agreement (POPIA sections 20 and 21)

Version 1.0.3, effective 24 October 2026. It forms part of the Indawo AI Subscription Agreement (document 01).

Change note (version 1.0.3, 24 October 2026): clause 1.1 now defines the Client so that it also covers hosts (individuals or businesses) on the Indawo Host plan, clause 5.2 now requires two-factor authentication for admin users only where the Services offer it, and two items were added to the planned improvements in Annex 2 (a written incident response plan; signed confidentiality undertakings). No other clause was changed. Version 1.0.2 (24 October 2026) rewrote Annex 2; version 1.0.1 applied from 20 October 2026.

1. Parties and roles

1.1 Responsible party: the Client. “Client” means the lodge, guesthouse, hotel or other accommodation business, or a host (an individual or business) on the Indawo Host plan, that accepts this agreement. 1.2 Operator: Envy Fincorp (Pty) Ltd, trading as Indawo AI, registration number 2021/756475/07. Address (and address for legal notices): 102 Churchill Street, Wendywood, 2090 (“Indawo”). 1.3 For the personal information the Client puts into the Services, or that Third-Party Services send to the Services for the Client (guests, booker contacts, staff users, suppliers, agents) (“Client Personal Information”), the Client is the responsible party and Indawo is its operator as defined in the Protection of Personal Information Act 4 of 2013 (POPIA). 1.4 Indawo is a responsible party in its own right only for its own account, billing, support, marketing and security data about the Client and its users (covered by the Privacy Notice, document 03). 1.5 Words defined in POPIA have the same meaning here.

2. Details of processing (Annex 1)

The subject matter, categories of data subjects and information, purposes and duration are in Annex 1.

3. Instructions (POPIA s21(1))

3.1 Indawo will process Client Personal Information only (a) with the Client’s knowledge or authorisation, (b) on the Client’s documented instructions, which are this Agreement, the Subscription Agreement, the Client’s configuration of the Services (including which channels, messaging and payment services it connects) and written instructions from an Owner/Admin user; and (c) to the extent a law requires (in which case Indawo will tell the Client first unless the law prohibits it). 3.2 Indawo will tell the Client promptly if it believes an instruction breaches POPIA or another law, and may suspend that instruction until it is confirmed or changed. 3.3 Indawo will not sell Client Personal Information, use it for its own marketing, or contact the Client’s guests except to deliver the Services the Client has switched on. 3.4 Indawo will not use Client Personal Information (including anonymised, aggregated or derived forms of data received from WhatsApp or Xero) to train or improve AI models, other than a model used exclusively for the Client where the third-party terms allow it.

4. Confidentiality (POPIA s20)

Indawo will treat Client Personal Information as confidential and will not disclose it unless required by law or in the course of the proper performance of its duties. Every person Indawo authorises to process it (staff, contractors, sub-operators) is bound by written confidentiality obligations and gets access only on a need-to-know basis.

5. Security measures (POPIA s19 and s21(2))

5.1 Indawo will establish and maintain the appropriate, reasonable technical and organisational measures in Annex 2, and update them for new risks. It may change them provided the overall level of protection does not fall. 5.2 The Client is responsible for the security of its own devices, user accounts and passwords, for assigning user roles correctly, and for keeping two-factor authentication switched on for admin users where the Services offer it.

6. Security compromises (POPIA s21(2) and s22)

6.1 Indawo will notify the Client immediately where reasonably possible, and in any event within 72 hours, after it has reasonable grounds to believe that Client Personal Information has been accessed or acquired by an unauthorised person. 6.2 The notice will include, as far as known: what happened and when; categories and approximate number of data subjects and records; likely consequences; measures taken or proposed; a contact person; and recommendations to data subjects. Information can be given in phases. 6.3 Indawo will help the Client notify the Information Regulator and data subjects under s22, but will not notify them itself on the Client’s behalf without the Client’s instruction unless the law requires it. 6.4 Indawo will keep a record of all security compromises and the steps taken.

7. Sub-operators

7.1 The Client authorises Indawo to use the sub-operators in Annex 3. Some services in Annex 3 are only used if the Client switches the related feature on. 7.2 Indawo will (a) bind each sub-operator in writing to obligations no less protective than this Agreement (as far as the sub-operator’s standard terms allow; where they do not, Indawo will tell the Client which terms differ); (b) remain responsible to the Client for its sub-operators’ processing; and (c) give at least 30 days’ notice (email and in-app) before adding or replacing a sub-operator that processes Client Personal Information. The Client may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Client may terminate the affected Service without penalty or clawback and receive a refund of prepaid fees for the unused period. 7.3 Services the Client contracts directly. OTAs (such as Booking.com and Agoda), the Client’s own payment-gateway merchant account, the Client’s own Meta/WhatsApp Business Account, and the Client’s Xero organisation are contracted by the Client directly and process information under their own terms as separate responsible parties or as the Client’s operators. Indawo transmits information to them on the Client’s instruction; they are not Indawo’s sub-operators. Indawo is not responsible for their processing.

8. Cross-border transfers (POPIA s72)

8.1 Indawo’s primary hosting is in South Africa (Annex 3). Some sub-operators process information outside South Africa (for example the channel-manager connectivity provider in the European Union and United Kingdom, and Meta when WhatsApp is switched on). 8.2 Indawo will transfer Client Personal Information outside South Africa only where POPIA s72 allows, namely where (a) the recipient is subject to a law, binding corporate rules or a binding agreement that gives an adequate level of protection substantially similar to POPIA, including onward-transfer rules (s72(1)(a)) — for example recipients bound by the EU or UK GDPR and a written data-processing agreement; or (b) the transfer is necessary to perform the contract with, or in the interest of, the data subject (s72(1)(c)–(d)), for example sending a booking to the OTA or channel the guest booked through; or (c) the data subject consents (s72(1)(b)). 8.3 Annex 3 states the country and the s72 basis for each sub-operator. Indawo will update it before any change of hosting location.

9. Data-subject requests and other assistance

9.1 If a data subject contacts Indawo directly about Client Personal Information (access, correction, deletion, objection), Indawo will not respond substantively, will refer the person to the Client, and will forward the request to the Client within 3 Business Days. 9.2 Indawo will provide tools (search, export, correction and deletion in the Services) and reasonable assistance so the Client can answer requests under POPIA ss23–25 and PAIA within the legal time limits. 9.3 Indawo will reasonably help the Client with POPIA impact assessments, Information Regulator enquiries and prior-authorisation questions concerning the Services. Help that takes more than 2 hours a quarter may be charged at the ad-hoc rate on the price list, except where it results from Indawo’s breach.

10. Return and deletion

On termination of the Subscription Agreement, clause 13 of that Agreement applies: export in CSV/JSON within 30 days on request, then deletion from live systems within 30 days and from backups within a further 30 days, with written confirmation on request, except where a law requires Indawo to keep information (and then only for that purpose). Indawo will instruct its sub-operators to delete.

11. Audit and records

11.1 Indawo will make available the information reasonably needed to show compliance with this Agreement (for example a completed security questionnaire, policies, sub-operator list and incident records). 11.2 If that is not enough, the Client (or an independent auditor bound by confidentiality, not a competitor of Indawo) may audit once in any 12 months on at least 30 days’ notice, during business hours, at the Client’s cost, without disrupting the Services or accessing other clients’ data. More frequent audits are allowed after a security compromise or when the Information Regulator requires it. 11.3 Sub-operators are audited under their own terms (for example by their published certifications and reports).

12. Client’s obligations

The Client warrants that (a) it has a lawful basis under POPIA for all Client Personal Information it gives Indawo, (b) it has given data subjects the notices required by POPIA s18 (including that information is processed by operators and may be transferred outside South Africa), (c) it obtained any consent needed, in particular for direct marketing (s69) and WhatsApp messages (Meta opt-in rules), (d) it will not load special personal information (health, religion, criminal behaviour, biometrics etc.) or children’s information into the Services unless Indawo agrees in writing and a POPIA ground applies, and (e) it has its own Information Officer registered with the Information Regulator.

13. Liability

13.1 Each party is liable for its own breach of POPIA and this Agreement. 13.2 The limits in the Subscription Agreement (clause 16) apply, except that Indawo’s liability for a security compromise caused by its breach of this Agreement is capped separately at 3 times the fees paid in the previous 12 months. Nothing limits liability for fraud, wilful misconduct, gross negligence, or what may not be limited by law (including a data subject’s civil claim under POPIA s99). 13.3 The Client indemnifies Indawo against claims and fines arising from the Client’s own breach of POPIA (including lacking a lawful basis, notice or consent for information it supplied or instructions it gave).

14. Term

This Agreement lasts as long as Indawo processes Client Personal Information and survives termination of the Subscription Agreement until deletion is complete.

Annex 1 – Details of processing

Annex 2 – Security measures (current as at 24 October 2026)

1. Hosting and network: The Services run on a cloud server in South Africa (Annex 3). A host firewall blocks all incoming connections except SSH, HTTP and HTTPS. Automatic security updates are switched on.
2. Encryption in transit: All web traffic uses HTTPS (TLS 1.2 or 1.3). Plain HTTP requests are redirected to HTTPS.
3. Server access: Administrative access to the server is by SSH with key-based login only; password logins are disabled. Indawo's application services run under dedicated low-privilege service accounts, not under the administrator (root) account.
4. Guest identity data: Guest ID and passport numbers are encrypted at field level, and ID document images (where the Host check-in feature is used) are encrypted at file level. The encryption keys are held separately from the database and are not included in backups. Every read of these keys is recorded in the server's audit log.
5. Access control and logging: Access to the Services is role-based (Owner, Admin, Editor, Accountant and Viewer). Full guest ID numbers can be shown only to Owner and Admin users, and every such view is recorded in an audit log (without the number).
6. Backups: Databases are backed up daily, encrypted to a key that is not kept on the server, and kept for 30 days. A restore from backup was tested successfully on 24 October 2026.
7. Payment cards: Indawo does not store payment card numbers.

Planned improvements (not yet in place):

• Full-volume (disk) encryption of the server.
• Two-factor authentication (2FA) for Owner and Admin users.
• Scheduled full restore tests (an automated monthly backup check is in place; full restore tests are currently run by hand).
• A second, off-server copy of the backups.
• A written incident response plan.
• Signed confidentiality undertakings from Indawo staff and contractors.

Clients will be notified when these are in place.

Annex 3 – Sub-operators (as at 20 October 2026)

Indawo does not currently use an outside AI model provider. Before adding one, or any other sub-operator, Indawo will give the 30 days’ notice in clause 7.2 and update this Annex. Services the Client contracts directly (clause 7.3), such as OTAs, the Client’s own payment-gateway merchant account, the Client’s own WhatsApp Business Account and the Client’s Xero organisation, are not Indawo’s sub-operators.

Signed for the Client Name ______ Title ______ Signature ______ Date ______ Signed for Envy Fincorp (Pty) Ltd t/a Indawo AI Name ______ Title ______ Signature ______ Date ______

Get the app