Data Processing Agreement

VukaHustle Data Processing Agreement

vukahustle.com | UlulaLabs (Pty) Ltd, Registration number 2026/107064/07 | Effective date: 09 October 2026

---

This Data Processing Agreement ("DPA") is entered into between UlulaLabs (Pty) Ltd, trading as VukaHustle ("VukaHustle", "we", "us" or "our"), and each Merchant that uses the VukaHustle platform ("you" or "the Merchant"). It forms part of our Terms and Conditions and sets out how we process personal information on your behalf, as required by sections 20 and 21 of the Protection of Personal Information Act 4 of 2013 ("POPIA").

Our Terms and Conditions expressly incorporate this DPA, and you accept this DPA when you accept our Terms and Conditions. Where this DPA and the Terms and Conditions conflict on the processing of Store Personal Information, this DPA applies.

1. Definitions

In this DPA, words defined in POPIA or in our Terms and Conditions have the same meaning, and:

• "Store Personal Information" means personal information of your customers and other people that you, or your customers through your store, submit to the Platform, and that we process on your behalf to provide the Platform. It includes customer names, contact details, delivery addresses, order records, messages and customer-account records.
• "Sub-processor" means a third party that we engage to process Store Personal Information on our behalf, such as a hosting, cloud, email or messaging provider.
• "Security Compromise" means a situation where there are reasonable grounds to believe that Store Personal Information has been accessed or acquired by an unauthorised person.

2. Roles of the parties

2.1 You are the responsible party. You decide why and how your customers' personal information is collected and used. You are the responsible party for Store Personal Information under POPIA.

2.2 We are your operator. We process Store Personal Information on your behalf, only to provide the Platform. We are your operator under POPIA for that processing.

2.3 Our own processing. We are a responsible party in our own right, and not your operator, when we process personal information for our own purposes. This includes your own account and billing information, Platform security, fraud prevention, and compliance with laws that apply to us. That processing is governed by our Privacy Policy, not this DPA.

3. Details of the processing

4. Our obligations as your operator

4.1 Processing only on your instructions. We process Store Personal Information only to provide the Platform in accordance with our Terms and Conditions, this DPA, your use and configuration of the Platform, and any other documented instructions you give us that are consistent with them. The Terms and Conditions, this DPA and your use of the Platform are your complete instructions. If we believe an instruction is unlawful, we will tell you, and we may decline to follow it.

4.2 No other use. We do not sell Store Personal Information, use it for our own marketing, or use it to train, fine-tune or improve artificial-intelligence models.

4.3 Confidentiality. We treat Store Personal Information as confidential, as required by section 20 of POPIA. Anyone who processes it on our behalf is bound by a duty of confidentiality.

4.4 Security. We establish and maintain the security measures required by section 19 of POPIA, as described in our Security Policy. These include access controls, hashed passwords, encryption in transit and, where appropriate, at rest, logging and monitoring, regular backups and incident-management procedures.

4.5 Your ownership. Store Personal Information remains under your control. We do not acquire any rights in it beyond what is needed to provide the Platform.

5. Your obligations as responsible party

You warrant and undertake that:

• you have a lawful basis under POPIA for all Store Personal Information you submit or collect through the Platform;
• your store's Privacy Policy is accurate and tells your customers how their information is used, including that it is hosted by VukaHustle and shared with your payment and courier providers;
• you have obtained any consent POPIA requires, including for direct marketing;
• you will keep your account credentials secure and give access to your store only to authorised people; and
• your instructions to us will comply with POPIA and other applicable law.

You indemnify us against claims, fines and losses arising from your breach of this section, to the extent permitted by law.

6. Sub-processors

6.1 General authorisation. You authorise us to engage Sub-processors to help us provide the Platform, including hosting, cloud infrastructure, email and messaging providers.

6.2 Our responsibility. We will only use Sub-processors that are bound by written terms requiring them to keep Store Personal Information confidential and secure, at a standard no less protective than this DPA. We remain responsible to you for the performance of our Sub-processors.

6.3 List and changes. A list of our current Sub-processors, showing what each does and where it processes data, is published on our Sub-processors and Service Providers page at https://vukahustle.com/sub-processors. We will update the list and notify you by email or through your account before adding or replacing a Sub-processor. If you have a reasonable data-protection objection, you may tell us within 14 days. If we cannot address the objection, you may cancel your subscription in accordance with our Cancellation Policy.

6.4 Providers you choose. Payment providers (such as PayFast and Yoco) and couriers (such as PUDO and The Courier Guy) that you connect to your store are your own service providers under your own agreements with them. They are not our Sub-processors.

7. Transfers outside South Africa

Store Personal Information is hosted in South Africa by the Sub-processors listed on our Sub-processors and Service Providers page. If a Sub-processor stores or processes Store Personal Information outside South Africa, that page will say so. We will transfer Store Personal Information outside South Africa only in accordance with section 72 of POPIA, for example where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection.

8. Security Compromises

8.1 Notifying you. We will notify you immediately where there are reasonable grounds to believe that a Security Compromise affecting Store Personal Information has occurred, as required by section 21(2) of POPIA. We will not wait until the Security Compromise has been confirmed or fully investigated before notifying you.

8.2 What we will tell you. Our notice will include, as far as is known at the time, a description of the Security Compromise, the categories and approximate number of people affected, the likely consequences, and the steps we have taken or propose to take. We will provide further information as it becomes available.

8.3 Your notification duties. As responsible party, you are responsible for notifying the Information Regulator and your affected customers under section 22 of POPIA. We will give you the information and reasonable help you need to do so. We will not notify your customers directly without your agreement, unless the law requires us to.

8.4 Containment. We will take reasonable steps to contain the Security Compromise, reduce its effects and prevent it happening again.

9. Assistance and co-operation

9.1 Your customers' requests. If a data subject asks you to access, correct, delete or object to the processing of Store Personal Information, you are responsible for responding. While your store management portal is available to you, you can view, edit and download customer and order records there. Where the portal does not let you do what is needed, including while your store is paused or after it has been closed, we will help on request.

9.2 Requests we receive. If we receive a request from one of your customers about Store Personal Information, we will not respond to it ourselves, except to direct the person to you, unless the law requires us to. We will tell you about the request promptly.

9.3 Regulators and authorities. If the Information Regulator or another authority contacts us about Store Personal Information, we will tell you promptly, unless the law prohibits us from doing so. We will co-operate with you and the authority as reasonably required. Requests from authorities for disclosure are handled under our Disclosure Requests Policy.

9.4 Information on compliance. On reasonable written request, and no more than once a year unless a Security Compromise or a regulator requires otherwise, we will provide written information reasonably needed to show our compliance with this DPA. We may decline to share information that would compromise the security of the Platform or the confidentiality of other merchants.

10. Return and deletion

10.1 Export. While your account is active and your store is open, you can export your customer and order records yourself using the download functions in your store management portal. You should export the records you need before you close a store or your account. While your store is paused, for example after a free trial ends or during a suspension, or after it has been closed, those download functions may not be available to you. In that case, email hello@vukahustle.com and we will provide an export of the Store Personal Information we still hold for that store, after verifying your identity and your authority over the store. Support-assisted exports are available only for records we still hold under section 10.2 and 10.3.

10.2 Deletion. When your account is closed, we will delete or de-identify Store Personal Information within 12 months, or within 30 days after you ask us in writing to delete it sooner.

10.3 Exceptions. We may keep Store Personal Information for longer where the law requires us to, or where it is reasonably needed to resolve a dispute, investigate fraud or a Security Compromise, or comply with a lawful disclosure request, but only for as long as that need continues. Copies in backups are deleted as the backups are overwritten in the normal backup cycle, and are protected in the meantime.

10.4 Confirmation. On request, we will confirm in writing that deletion has taken place.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in our Terms and Conditions, except where those limitations cannot lawfully apply.

12. Duration, changes and governing law

12.1 This DPA applies for as long as we process Store Personal Information on your behalf.

12.2 We may update this DPA where our processing or the law changes, in the same way we update our Terms and Conditions. We will give you reasonable notice of any material change.

12.3 This DPA is governed by the law of the Republic of South Africa, and the South African courts have jurisdiction.

13. Contact details

Legal entity: UlulaLabs (Pty) Ltd, trading as VukaHustle
Registration number: 2026/107064/07
Physical address: Dynamic Technologies House, 2 Venus Rd, Melrose Estate, Johannesburg, South Africa
Support email: hello@vukahustle.com
Support tel: +27 010 040 1090
Support hours: Monday to Friday, 08:00 to 17:00 (South African time), excluding public holidays
Information Officer: Mr G. Schoeman (Director)
Website: vukahustle.com
Effective date: 09 October 2026

---

UlulaLabs (Pty) Ltd t/a VukaHustle | Reg. 2026/107064/07 | Dynamic Technologies House, 2 Venus Rd, Melrose Estate, Johannesburg, South Africa | hello@vukahustle.com | +27 010 040 1090 | vukahustle.com