Operator agreement

VoltAdmin · Last updated 14 October 2026

This is the written agreement section 21 of POPIA requires between you and us about your customers' and your staff's information. It forms part of the terms of service and applies for as long as you have an account. It covers everything you put in: clients and the details new clients send you, quotes, jobs, invoices, expenses, staff records, pay, leave and working days.

What we hold about you is a different question with a different answer, and it is in the privacy policy.

1. Which of us is which

You are the responsible party. You decide whose details go into VoltAdmin and why. They are your customers and staff, your records, and your obligations.

We are the operator. We hold and secure that information on your behalf, and we process it only to run the software for you.

This is not a formality. It decides who answers when one of your customers asks a question (or one of your staff does):

"Why does VoltAdmin have my address?" — You answer. We hold it because you put it there.
"Delete my details." — You action it, in the product. We will not delete one of your customers' records on their say-so, because we cannot verify their relationship with you and it is not ours to remove.
"Send me everything you hold about me." — You answer, from your own records.

We will help you answer any of these. We will not answer them instead of you.

2. What we undertake (section 21(1) and 21(2))

We process only on your instruction. Storing, displaying, rendering, emailing and exporting your records is what running the software means. When you connect an accounting package, it also means sending that package the records it needs to keep your books, and bringing its changes back, for as long as you keep it connected. That is the whole of the instruction. We will not use your customers' or your staff's details for anything else.
We do not use it for our own purposes. We do not market to your customers or staff, sell or share their details, build profiles, or train machine-learning models on your data.
We keep it confidential, and everyone who works on VoltAdmin is bound to the same.
We secure it — the measures in clause 4 below, which are section 19's "appropriate, reasonable technical and organisational measures", stated specifically rather than as a general assurance.
We tell you immediately if there are reasonable grounds to believe it has been accessed by anyone unauthorised, so that you can meet your own section 22 obligations. Immediately means as soon as we know, not after we have finished investigating.
We use no sub-operator without telling you. The current ones are listed in the privacy policy, clause 4, and each is bound to these same terms. An accounting package you connect is not our sub-operator: you choose it, your own agreement with it governs what it does, and we send it only what clause 2.1 describes.

3. What you undertake

You have a lawful basis for the information you put in — usually that it is necessary to quote for or do work someone asked for, or to employ your staff.
You tell your customers and staff what you do with their details, as POPIA requires of a responsible party. Naming the software you use is not required; being able to answer questions about their information is.
You keep your access under control — you do not share logins, you remove staff who leave (Resources → Staff, where removing someone's access revokes their sessions immediately), and you switch on two-step sign-in where the business has staff.
You do not put in what you do not need. VoltAdmin has no field for an ID number, a medical detail or anything else POPIA calls special personal information. Keep it out of the notes fields too — a leave note above all.
You tell your customers about a package you connect, where POPIA requires it: that their details are kept in your accounting package as well, and where that package keeps them (section 18). Whether that package may hold them outside South Africa is your decision as responsible party (section 72).

4. How your customers' and staff's information is protected

The measures section 19 asks for, as they actually exist:


In transit	TLS, with HSTS. No plain HTTP path into the product
At rest	On a managed server with encrypted, off-site backups
Separation	Every business's data is scoped to it in the query, not in the interface. That scoping is tested automatically on every change, with two businesses in the database, because a test with one cannot tell the difference
Access	Role-based — Owner, Admin, Staff — enforced in the permission layer rather than by hiding buttons. A staff member cannot reach your pricing, your financial totals or anyone's pay
Credentials	scrypt-hashed passwords, session tokens stored only as hashes, optional two-step sign-in
Connections	The access an accounting package gives us is encrypted with AES-256-GCM under a key held outside the database and its backups, used only to talk to that package, never shown again, and deleted when the package confirms a disconnection, or when your account ends
Public links	The quote-accept link, the intake form, the link that asks a client to check their own details (it lives fourteen days), and the invitation, password-reset and data-recovery links carry 256-bit tokens, stored only as hashes, rate limited, single use where it matters
Uploads	Your logo and your receipt photos, checked by sniffed content rather than filename, re-encoded, stored outside the web root and served through an authenticated route
Our staff	No general access to production data and no root database access; support access only for a specific request you have raised
Audit	An activity log you can read yourself, and structured server logs with secrets redacted

5. When it ends

When your account ends — because you closed it, or because the subscription lapsed and the retention period ran out — we delete all of that information on the schedule in the privacy policy, clause 5. You can take a copy at any time from Settings → Export everything, and we recommend doing so before you close an account, because after deletion we cannot produce it again.

Disconnecting an accounting package, or closing your account, stops the sync and deletes the access we held (on a disconnect, as soon as the package confirms it). It never deletes anything in the package: those are your books, which you may need to keep for five years.

We keep no copy afterwards, beyond the record that a deletion happened: the business's name, the date, who asked, and how many rows went.

Backups are the one honest exception. A deleted business disappears from the live system immediately and ages out of the encrypted backup rotation within [retention window — see deployment.md]; a backup is never used to resurrect a deleted account, only to recover the system as a whole after a failure.

6. If one of your customers or staff complains to us

We will tell you, promptly, and point them back to you as the responsible party. Where the Information Regulator requires something of us directly, we will do it and keep you informed.

[registered entity name] · Information Officer [name], [email]