Operator / processing (draft)

VST- POS / Ariestotle. Last working copy: 4 September 2026.

DRAFT — not legal advice. These pages are working copy for VST Services and the licensed shop. An attorney must review and finalise them before they are treated as a contract, a POPIA notice, or a data processing agreement.

Overview Licence Privacy Operator Disclaimers

Roles

For customer, staff and sales records stored in the shop’s database: the shop is the responsible party and VST is the operator only when VST actually processes that data (for example restore, import, or remote fix). Installing the software on the shop’s PC does not by itself make VST the operator of every sale.

Instructions

VST may process shop data only on documented instructions: a ticket, a go-live pack, or a written instruction from the Super Admin. VST must not use shop customer lists for its own marketing.

Security

The shop must control who can log in, who has Super Admin, and where backups are copied. VST must use access only for the booked job and not retain copies after the job unless the shop asks for an archive.

Sub-operators

If VST uses a hosting, email or licence-signing environment, that list must be disclosed in the signed DPA. This draft does not name vendors yet.

Breach

If VST becomes aware of a personal-information compromise in data it holds for a job, it must notify the shop without undue delay so the shop can meet its POPIA duties. The shop remains responsible for notifying the Regulator and data subjects where the law requires it.