Data Processing Addendum

Last updated 1 September 2026

This Addendum forms part of the Terms of Service between Vynta (Pty) Ltd and each customer. It governs Vynta's processing of personal information on the customer's behalf, and takes effect automatically when you create a workspace — no signature is required, though an executed copy is available to Enterprise customers on request.

1. Roles of the parties

For personal information contained in workspace data — employees, technicians, customers of the customer, site contacts — the customer is the responsible party under POPIA and the controller under the GDPR. Vynta acts as operator / processor and processes that information only on the customer's documented instructions, which include use of the Service's features and any lawful support request.

For account administration, billing and website analytics, Vynta acts as responsible party in its own right; that processing is described in our Privacy Policy.

2. Subject matter and duration

Subject matter: provision of field service management software.
Duration: the term of the subscription, plus the deletion period in section 8.
Nature and purpose: storage, organisation, retrieval, transmission and deletion of workspace records so the customer can dispatch, complete and report on work.
Categories of data subject: the customer's staff, contractors, and its own customers and site contacts.
Categories of personal information: identity and contact details, job role, work assignments, timesheet and location records, photographs, signatures, and free-text notes entered by users.

3. Vynta's obligations

Process personal information only on documented instructions from the customer.
Ensure personnel with access are bound by confidentiality and are granted least-privilege access on a need-to-know basis.
Implement the security measures in section 4 and keep them current.
Assist the customer, taking into account the nature of processing, with data subject requests, impact assessments and regulator engagement.
Make available the information reasonably necessary to demonstrate compliance with this Addendum.

4. Security measures

TLS 1.2+ encryption in transit and encryption at rest for all workspace data.
Row-level security in the database so a workspace's records are unreachable from another workspace, enforced at the data layer rather than only in application code.
Role-based access control, branch scoping, and multi-factor or biometric authentication options for user accounts.
Strict transport security, content security policy and audited security headers.
Structured audit logging of privileged and administrative actions.
Regular dependency and vulnerability scanning, with prompt remediation.
Encrypted, access-controlled backups with tested restoration.

5. Sub-processing

The customer grants general authorisation for Vynta to engage the subprocessors listed in the Subprocessors section below. Vynta imposes data protection obligations on each subprocessor no less protective than this Addendum and remains fully liable for their performance. We will update that list before appointing a new subprocessor; a customer may object on reasonable data-protection grounds within 14 days, and if the objection cannot be resolved may terminate the affected Service without penalty for the remainder of the paid term.

6. Cross-border transfers

Personal information may be processed outside South Africa. Transfers are made in accordance with section 72 of POPIA and, where EU personal data is involved, under the European Commission's standard contractual clauses together with supplementary technical measures.

7. Personal information breaches

Vynta will notify the customer without undue delay, and in any event within 72 hours of becoming aware of a personal information breach affecting the customer's data. The notification will describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed. Vynta will co-operate with the customer's own notification obligations to the Information Regulator, supervisory authorities and data subjects.

8. Return and deletion

The customer may export its workspace data at any time during the subscription. On termination, workspace data is retained for 30 days to allow recovery and export, then permanently deleted from live systems; encrypted backups age out within a further 60 days. Vynta will confirm deletion in writing on request, except where retention is required by law.

9. Audit

On reasonable written notice, and no more than once per year unless required by a regulator, Vynta will respond to a security questionnaire and provide available assurance documentation. On-site audits may be arranged for Enterprise customers subject to confidentiality and reasonable cost recovery.

10. Liability and precedence

Liability under this Addendum is subject to the limitations in the Terms of Service. Where this Addendum conflicts with those Terms on the processing of personal information, this Addendum prevails.

11. Contact

Information Officer, Vynta (Pty) Ltd — info@vyntaintegrate.com.

Subprocessors

Last updated 1 September 2026

Vynta uses a small number of carefully selected providers to run the Service. Each is bound by a written data-processing agreement, is permitted to process personal information only on our documented instructions, and is subject to confidentiality and security obligations at least as strict as our own.

1. Current subprocessors

Supabase (application hosting, infrastructure provider): Application hosting, database, authentication and file storage.; All workspace data: accounts, work orders, assets, media, timesheets.; European Union
Cloudflare: Content delivery, TLS termination, bot and abuse protection.; Request metadata: IP address, user agent, requested URL.; Global edge network
Resend: Transactional email delivery (sign-off links, alerts, receipts).; Recipient email address, sender identity, message content.; European Union / United States
PayFast: Subscription payment processing and instant transaction notifications.; Billing contact, subscription amount, payment status. No card data reaches Vynta.; South Africa
Google Analytics 4: Aggregate website traffic measurement. Optional; consent required.; Anonymised IP, page path, device category. No identifiers, no job data.; United States (standard contractual clauses)
PostHog: Product usage measurement. Optional; consent required.; Page path and named product events. No autocapture, no recording, no profiles.; European Union
AI model providers (OpenRouter or equivalent gateway): Voice transcription, summaries and assistant responses where AI is enabled.; Only the text or audio a user submits to an AI feature. Never used for model training.; European Union / United States (standard contractual clauses)

Vynta Integrate subprocessors
Provider	Purpose	Data processed	Location
Supabase (application hosting, infrastructure provider)	Application hosting, database, authentication and file storage.	All workspace data: accounts, work orders, assets, media, timesheets.	European Union
Cloudflare	Content delivery, TLS termination, bot and abuse protection.	Request metadata: IP address, user agent, requested URL.	Global edge network
Resend	Transactional email delivery (sign-off links, alerts, receipts).	Recipient email address, sender identity, message content.	European Union / United States
PayFast	Subscription payment processing and instant transaction notifications.	Billing contact, subscription amount, payment status. No card data reaches Vynta.	South Africa
Google Analytics 4	Aggregate website traffic measurement. Optional; consent required.	Anonymised IP, page path, device category. No identifiers, no job data.	United States (standard contractual clauses)
PostHog	Product usage measurement. Optional; consent required.	Page path and named product events. No autocapture, no recording, no profiles.	European Union
AI model providers (OpenRouter or equivalent gateway)	Voice transcription, summaries and assistant responses where AI is enabled.	Only the text or audio a user submits to an AI feature. Never used for model training.	European Union / United States (standard contractual clauses)

2. Changes to this list

We will update this list before a new subprocessor begins processing customer personal information. Enterprise customers may subscribe to change notifications by emailing info@vyntaintegrate.com, and may object to a new subprocessor on reasonable data-protection grounds as set out in the Data Processing Addendum.

3. Cross-border transfers

Where a subprocessor processes personal information outside South Africa, the transfer is made under section 72 of POPIA and, for EU personal data, under standard contractual clauses with supplementary technical measures including encryption in transit and at rest.

4. Related documents

Acceptable Use Policy

Last updated 1 September 2026

This Policy sets out how the Vynta Integrate Service may and may not be used. It is incorporated into the Terms of Service, and applies to every user of a workspace — the account holder is responsible for ensuring their team follows it.

1. General principle

Use Vynta for legitimate field service operations. Do not use it in any way that is unlawful, that harms another person, that degrades the Service for other customers, or that puts anyone's personal information at risk.

2. Prohibited content and conduct

Uploading unlawful, defamatory, harassing, discriminatory or obscene material.
Infringing anyone's intellectual property, trade secrets, privacy or publicity rights.
Capturing personal information — including photographs, voice notes and location data — without the lawful basis and notice POPIA and the GDPR require.
Storing special personal information (health, biometric, criminal records) or children's information beyond what the work genuinely requires.
Impersonating another person, business or Vynta itself.
Distributing malware, phishing content or fraudulent invoices or documents.

3. Security and integrity

Do not probe, scan or test the vulnerability of the Service, or breach any authentication or access control, without our prior written authorisation.
Do not attempt to access another workspace's data, accounts or infrastructure.
Do not share credentials, and do not create accounts to circumvent seat licensing.
Report vulnerabilities responsibly to info@vyntaintegrate.com. We will not pursue good-faith researchers who follow this Policy and give us reasonable time to fix.

4. Automated access and fair use

Scraping, crawling or bulk-exporting the Service outside the provided export features is not permitted.
API and AI features are subject to published rate limits and credit allowances. Do not engineer around a limit, share an allowance between workspaces, or resell AI capacity.
Do not use the Service to build or train a competing product, or to benchmark it for publication, without our written consent.

5. AI features

AI assistance produces suggestions, not professional advice. Users must review AI output before relying on it for safety, compliance or billing decisions, and must not submit material they have no right to process. We may suspend AI features for a workspace that submits abusive, unlawful or deliberately harmful prompts.

6. Enforcement

Where we reasonably believe this Policy has been breached, we may remove offending content, throttle or suspend a feature, suspend a user or the workspace, and in serious cases terminate the subscription. Wherever practicable we will contact the account holder first and give an opportunity to remedy. Immediate action may be taken where there is a risk to other customers, to personal information, or of legal liability.

7. Reporting

Report abuse to info@vyntaintegrate.com. See also our Terms of Service and the Service Level Commitment.

Service Level Commitment

Last updated 1 September 2026

What Vynta commits to on availability and support, how we measure it, and what happens if we fall short. Business hours are 08:00–17:00 South African Standard Time, Monday to Friday, excluding South African public holidays.

1. Availability target

Vynta targets 99.9% monthly uptime for the web application, mobile synchronisation and public API. Uptime is measured per calendar month as the percentage of one-minute intervals in which the Service responded successfully to health checks, excluding the exclusions in section 4.

Live status is published on our status pulse and driven by real health checks against the production backend, not a manual switch.

2. Support response times

S1 — Service down: The Service is unavailable or unusable for all users in a workspace.; First response: 1 business hour; Resolution target: Continuous work until resolved or a workaround is in place
S2 — Major degradation: A core workflow — dispatch, work order completion, sign-off — fails with no workaround.; First response: 4 business hours; Resolution target: 1 business day
S3 — Minor issue: A non-core feature is impaired, or a workaround exists.; First response: 1 business day; Resolution target: Included in a scheduled release
S4 — Question or request: How-to questions, configuration help and feature requests.; First response: 2 business days; Resolution target: Assessed and prioritised by the product team

Support severity levels and response times
Severity	Definition	First response	Resolution target
S1 — Service down	The Service is unavailable or unusable for all users in a workspace.	1 business hour	Continuous work until resolved or a workaround is in place
S2 — Major degradation	A core workflow — dispatch, work order completion, sign-off — fails with no workaround.	4 business hours	1 business day
S3 — Minor issue	A non-core feature is impaired, or a workaround exists.	1 business day	Included in a scheduled release
S4 — Question or request	How-to questions, configuration help and feature requests.	2 business days	Assessed and prioritised by the product team

Enterprise agreements may include shorter response times, a named contact and out-of-hours cover. Contact us to arrange one.

3. Maintenance

Routine maintenance is performed without downtime wherever possible. Where downtime is unavoidable it is scheduled outside business hours and announced at least 48 hours in advance. Emergency security patching may be applied without notice; we will report on it afterwards.

4. Exclusions

Announced maintenance windows and emergency security patching.
Faults in the customer's own network, devices, browsers or third-party integrations.
Outages at an upstream provider that are beyond our reasonable control, where we have taken reasonable steps to mitigate.
Suspension arising from non-payment or an Acceptable Use Policy breach.
Force majeure events.

5. Service credits

If monthly uptime falls below the target, the customer may claim a credit against the next invoice: 5% of the monthly fee below 99.9%, 10% below 99.0%, and 25% below 95.0%. Claims must be submitted within 30 days of the affected month. Service credits are the sole and exclusive remedy for availability shortfalls.

6. Data durability

Workspace data is backed up continuously with point-in-time recovery. Our recovery point objective is 5 minutes and our recovery time objective is 4 hours for a full regional failure. Retention and deletion commitments are set out in the Data Processing Addendum.

7. Contact

Support and SLA claims: info@vyntaintegrate.com. See also our Terms of Service and the Acceptable Use Policy.