SASA Digital · POPIA Document Suite · Version 3 · 15 July 2026
Operator Terms
These Operator Terms govern SASA Digital's processing of learner personal information on behalf of Schools, Event Conveners, and SASA (the association), as required by section 21 of POPIA. The Terms are posted on the Portal and accepted electronically by each Counterparty's authorised representative on first login and whenever the Terms are materially updated.
Legal basis for electronic acceptance
POPIA section 21 requires only a written contract between responsible party and operator. The Electronic Communications and Transactions Act 25 of 2002 (“ECTA”) recognises a data message, including a click-to-accept record, as satisfying a requirement that a document or agreement be in writing, and recognises an electronic act such as clicking “I Accept” as capable of expressing the assent needed to conclude an agreement. No advanced electronic signature is required for this type of contract.
Parties
These Terms apply between (1) each School, Event Convener or SASA (each a “Counterparty”), as responsible party for the personal information described in the applicable Schedule, and (2) Sub10 (Pty) Ltd t/a SASA Digital (“SASA Digital”), as operator processing that information on the Counterparty's behalf.
School warranty of guardian consent
By accepting these Terms, the School warrants that for every learner record it uploads it has obtained prior consent from a Competent Person (parent or legal guardian) in accordance with sections 34 and 35 of POPIA, covering every category of Learner Personal Information uploaded (including ID number, race, and health/medical information), SASA Digital's use of that information as operator, publication of name, school and results, and provision of sex, age band, race and school to SASA. The School will retain evidence of such consent and produce it on reasonable request.
Mandate to process
The Counterparty grants SASA Digital a mandate to process Learner Personal Information strictly for the purposes set out in the applicable Schedule (Schedule 1A for a School, 1B for an Event Convener, 1C for SASA, and Schedule 1D for the full field-level inventory).
Operator obligations
- Comply with POPIA and the processing conditions in Chapter 3.
- Process only in accordance with the Counterparty's written mandate.
- Keep information confidential and put appropriate technical and organisational safeguards in place.
- Notify the Counterparty immediately of any suspected security compromise.
Sub-operators
The Counterparty provides general authorisation for SASA Digital to engage sub-operators to carry out processing activities on Learner Personal Information on the Counterparty's behalf. The sub-operators currently engaged by SASA Digital are listed at https://sasadigital.co.za/sub-operators. At least 30 days before engaging a new sub-operator, SASA Digital will update that page and provide the Counterparty with a mechanism to obtain notice of that update.
Each sub-operator is appointed under a written back-to-back agreement imposing obligations no less protective than these Terms, and SASA Digital remains liable to the Counterparty for the performance of its sub-operators.
To object to a sub-operator, the Counterparty may: (i) terminate these Terms in accordance with their terms; or (ii) cease using the part of the Portal for which SASA Digital has engaged that sub-operator.
Record of acceptance
SASA Digital keeps a durable electronic record of each acceptance, including the identity of the individual, the capacity and Counterparty on whose behalf acceptance was given, the date and time, and the version number of the Terms accepted. A copy is provided to the Counterparty on request.
Applicable law
The laws of the Republic of South Africa apply to these Terms, regardless of where the Learner Personal Information is, will be, or was processed.