Operator Agreement

Effective from: 1 July 2026

Version: 1.0

1. About this Operator Agreement

This Operator Agreement sets out the terms on which Taxspace (Pty) Ltd processes personal information belonging to your clients when you use Taxspace.

It is entered into between:

• You, the financial adviser, financial planner, or paraplanner using Taxspace, acting as the Responsible Party for your client’s personal information; and
• Taxspace (Pty) Ltd, Registration Number 2021/560888/07, of 57 Main Road, Paarl, Western Cape, 7646, acting as the Operator.

This Operator Agreement forms part of your Terms of Use with Taxspace. If there is a conflict between this Operator Agreement and the Terms of Use, the terms of this Operator Agreement apply for matters relating to the processing of Client Personal Information.

You accept this Operator Agreement when you create your Taxspace account and use the platform to process information about your clients.

2. Definitions

In this Operator Agreement:

• “Client” means an individual whose personal information is uploaded to or processed through Taxspace by you.
• “Client Personal Information” means any personal information about a Client that is processed through Taxspace, including ITA34 data, income figures, lump sum amounts, property values, investment values, and any other planning inputs.
• “Operator” has the meaning given in POPIA.
• “POPIA” means the Protection of Personal Information Act 4 of 2013.
• “Regulator” means the Information Regulator established under POPIA.
• “Responsible Party” has the meaning given in POPIA.
• “Security Compromise” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Personal Information.
• “Sub-Operator” means any third party engaged by Taxspace to process Client Personal Information on Taxspace’s behalf.

Words and expressions not defined here have the same meaning as in the Terms of Use or, where relevant, POPIA.

3. Roles of the parties

For the purposes of POPIA:

• You are the Responsible Party for Client Personal Information.
• Taxspace is the Operator, processing Client Personal Information on your behalf and on your documented instructions.

You confirm that:

• You have a lawful basis under POPIA to process the Client Personal Information that you upload to Taxspace.
• You have given any notices and obtained any consents required under POPIA before processing Client Personal Information through Taxspace.
• You will respond to your Client about how their personal information is processed, including in response to any access, correction, or deletion request from your Client.

Taxspace is the Responsible Party for your own information as an adviser, planner, or paraplanner (account data, billing data, support data, and marketing data). The Privacy Policy explains how Taxspace handles that information.

4. Scope and purpose of processing

Taxspace will process Client Personal Information only:

• To provide the Taxspace platform and its features to you.
• To carry out the calculations, comparisons, and report generation that you request through the platform.
• To support, secure, back up, and maintain the platform.
• To comply with any legal obligation to which Taxspace is subject.
• On your documented instructions, including the instructions given by your use of the platform.

Taxspace will not process Client Personal Information for any other purpose, and will not use Client Personal Information in identifiable form for its own commercial purposes, including marketing to your Clients.

4A. Use of anonymised and aggregated data

Taxspace may create anonymised and aggregated data from Client Personal Information and use it for the following purposes:

• To analyse trends and patterns in the South African financial advice and tax planning profession.
• To produce industry reports, benchmarks, and insights, which may be published or shared with users of Taxspace.
• To improve the Taxspace platform, including its calculations, tools, reports, and user experience.
• To research, develop, and improve current and future features, including features that use artificial intelligence or machine learning.
• To support the safe and responsible development of new tools that benefit the financial advice profession.

For these purposes:

• “Anonymised” means that the data has been processed in a way that means it cannot, on its own or in combination with other reasonably available information, be used to identify a Client. This includes removing names, identity numbers, contact details, and any other direct or indirect identifiers, and applying further techniques where needed to prevent re-identification.
• “Aggregated” means that the data has been combined with data from other Clients in a way that does not single out any individual Client.

Once data has been properly anonymised, it is no longer Client Personal Information and falls outside POPIA. Taxspace remains responsible for making sure that anonymised and aggregated data cannot be re-identified, and applies appropriate techniques and safeguards to achieve this.

Taxspace will not:

• Sell or rent Client Personal Information in identifiable form to any third party.
• Use Client Personal Information in identifiable form to train any artificial intelligence or machine learning model.
• Publish or share any insight, report, or benchmark in a form that identifies, or reasonably allows the identification of, you or any of your Clients.

5. Categories of personal information and data subjects

The categories of personal information that Taxspace processes as Operator depend on the tools you use. They typically include the following:

• Identifying information about your Client: name, identity number (where present on uploaded documents).
• Financial information about your Client: income, tax assessment data, lump sum amounts, property values, loan amounts, investment values, retirement values.
• Family or planning information about your Client: details of dependants where relevant to a planning scenario.

The data subjects are your Clients and, where applicable, the dependants or other persons whose information you include in a planning scenario.

6. Your instructions to Taxspace

Your use of the Taxspace platform constitutes your documented instructions to Taxspace for the processing of Client Personal Information.

You may give additional written instructions by email to information-officer@taxspace.app. Taxspace will follow lawful instructions that fall within the scope and purpose of this Operator Agreement. Where an instruction would, in Taxspace’s reasonable view, contravene POPIA or any other applicable law, Taxspace will tell you and will not act on the instruction until the issue is resolved.

7. Confidentiality

Taxspace will treat all Client Personal Information as confidential. Taxspace will make sure that:

• Only those of its staff who need access to Client Personal Information to perform their duties are given access.
• All staff and contractors who have access to Client Personal Information are bound by written confidentiality obligations.
• Confidentiality obligations survive the termination of any employment or contractor relationship.

8. Security safeguards

Taxspace will put in place appropriate, reasonable technical and organisational measures to protect Client Personal Information against loss, damage, unauthorised destruction, and unlawful access or processing, as required by Section 19 of POPIA.

The measures we have in place include the following:

• Encryption of Client Personal Information in transit and at rest.
• Secure password storage using industry-standard hashing and salting through Firebase Authentication.
• Role-based access controls so that staff and Sub-Operators only have the access they need.
• Hosting on Google Cloud, which holds ISO 27001, SOC 2, and SOC 3 certifications, and provides built-in storage redundancy.
• Logging of access and key user actions on the platform, including login events, data changes, and team invitations, with logs retained for 30 days.
• Automated daily scanning of application dependencies for known security vulnerabilities.
• Monitoring of our hosting infrastructure for failures and security events.
• Ongoing attention to security notifications from our service providers, and action where needed.

Taxspace will review and update these measures from time to time so that they remain appropriate to the risks involved.

9. Sub-Operators

You agree that Taxspace may engage Sub-Operators to help provide the platform. The categories of Sub-Operators we use include:

• Cloud hosting, database, and file storage providers.
• Payment processing providers.
• Email and notification delivery providers.
• Workflow and automation providers.
• Error tracking and performance monitoring providers.
• Customer support tooling providers.
• Accounting and invoicing providers.

Taxspace will:

• Impose contractual obligations on each Sub-Operator that are no less protective than those set out in this Operator Agreement.
• Remain responsible to you for the acts and omissions of its Sub-Operators in relation to Client Personal Information.

A current list of the specific Sub-Operators we use, including what they do and the countries in which they process Client Personal Information, is available on request by emailing the Information Officer at information-officer@taxspace.app.

Notification of new Sub-Operators. Taxspace will give you reasonable notice of any new category of Sub-Operator that will process Client Personal Information, where the change is material, by notifying you through the platform or by email. If you have a reasonable objection to a new Sub-Operator on data protection grounds, you may raise it with Taxspace within 30 days of notification. If the matter cannot be resolved, you may cancel your subscription in line with the Terms of Use as your sole remedy.

10. Cross-border transfers

Some of our Sub-Operators are located outside South Africa, including in the European Union. In particular, certain hosting and email delivery services that Taxspace uses process Client Personal Information in the European Union. Other elements, including our primary database storage, are processed in South Africa.

Where Client Personal Information is transferred outside South Africa, Taxspace relies on one or more of the grounds in Section 72 of POPIA, including:

• That the recipient is subject to laws (including the General Data Protection Regulation in the European Union) or binding agreements that provide an adequate level of protection for the personal information.
• That the transfer is necessary for the performance of a contract between you (as Responsible Party) and Taxspace, or for the implementation of pre-contractual measures taken in response to your request.
• That the transfer is necessary for the conclusion or performance of a contract concluded in your interest with a third party.
• That the data subject has consented to the transfer.

A current list of the Sub-Operators we use and the countries in which they process Client Personal Information is available on request by emailing the Information Officer at information-officer@taxspace.app.

11. Help with data subject requests

If Taxspace receives a request directly from one of your Clients to access, correct, delete, or restrict the processing of their personal information, Taxspace will:

• Not respond to the request directly, unless required by law.
• Forward the request to you without undue delay.
• Reasonably assist you, at your cost where the assistance is material, to respond to the request.

You are responsible for responding to your Client and for meeting the timelines set out in POPIA.

The Taxspace platform allows you to view, correct, and delete Client Personal Information directly. Where you can deal with a request through the platform, Taxspace’s assistance is included in your subscription fee. For requests that go beyond what is available in the platform, such as a full export of Client Personal Information, please contact us at information-officer@taxspace.app and we will assist.

12. Security Compromise notification

Taxspace will notify you of any Security Compromise affecting Client Personal Information without undue delay after becoming aware of it, and in any event in time to allow you to meet your own notification obligations under Section 22 of POPIA.

Notification will be sent to the email address linked to your account, and, where appropriate, through the platform itself. The notification will include, to the extent known at the time:

• A description of the nature of the Security Compromise.
• The categories and approximate numbers of data subjects and records affected.
• The likely consequences of the Security Compromise.
• The measures Taxspace has taken or proposes to take to address the Security Compromise and to mitigate its effects.

Taxspace will continue to update you as more information becomes available. Taxspace will support you in complying with your own notification obligations to the Regulator and to affected data subjects.

You are responsible for making any notifications to the Regulator and to affected data subjects as required by POPIA.

13. Audits and information

On reasonable written request, Taxspace will make available to you the information you reasonably need to demonstrate compliance with this Operator Agreement and with POPIA, including:

• A summary of the security measures Taxspace has in place.
• The current list of Sub-Operators.
• Any certifications or third-party audit reports that Taxspace or its Sub-Operators hold.

If you reasonably require further information that cannot be provided through these means, the parties will agree in good faith on a proportionate way to provide it, taking into account the size of your subscription and the sensitivity of the information involved.

14. Return and deletion of Client Personal Information

You may delete Client Personal Information through the platform at any time.

On termination of your subscription for any reason:

• Your access to Client Personal Information on the platform continues until the end of the current billing month, in line with the Terms of Use.
• Taxspace will retain Client Personal Information for a further 90 days after the end of the billing month, during which you may reactivate your account or request an export of your data by contacting us.
• After the 90-day period, Taxspace will permanently delete Client Personal Information from the platform, except where the law requires Taxspace to retain it for longer.

Where Taxspace retains any Client Personal Information after the 90-day period in order to meet a legal obligation, Taxspace will continue to apply this Operator Agreement to that information for as long as it is retained.

15. Liability

The liability provisions of the Terms of Use apply to this Operator Agreement. Nothing in this Operator Agreement increases or extends the liability of either party beyond what is set out in the Terms of Use, except as required by POPIA.

Nothing in this Operator Agreement excludes or limits liability that cannot lawfully be excluded or limited under POPIA.

16. Duration and termination

This Operator Agreement starts when you create your Taxspace account or accept these terms, whichever is earlier, and continues for as long as Taxspace processes Client Personal Information on your behalf.

This Operator Agreement terminates automatically when your subscription ends and when Taxspace has completed the deletion of Client Personal Information in line with clause 14.

The obligations of confidentiality, security, and any other obligations that are by their nature intended to survive termination will survive termination.

17. Changes to this Operator Agreement

Taxspace may update this Operator Agreement from time to time to reflect changes in the law, in the platform, or in industry practice. Taxspace will:

• Update the “Effective from” date and the version number at the top.
• Notify you of material changes through the platform or by email.
• Give you reasonable notice before material changes take effect.

If you do not accept a material change, you may cancel your subscription in line with the Terms of Use.

18. General

Whole agreement on data protection. This Operator Agreement, together with the Terms of Use and the Privacy Policy, sets out the whole agreement between you and Taxspace in relation to the processing of Client Personal Information.

Cession and assignment. You may not cede or assign your rights or obligations under this Operator Agreement without Taxspace’s written consent. Taxspace may cede or assign its rights or obligations in the ordinary course of business, including in the context of a sale of the business, provided that any cessionary or assignee is bound by terms that are no less protective than this Operator Agreement.

Severability. If any clause of this Operator Agreement is found to be unenforceable, the rest of the agreement remains in full effect.

Notices. Notices to Taxspace under this Operator Agreement should be sent to information-officer@taxspace.app. Notices to you will be sent through the platform or to the email address linked to your account.

19. Governing law and jurisdiction

This Operator Agreement is governed by the laws of the Republic of South Africa. Any dispute arising from this Operator Agreement is subject to the exclusive jurisdiction of the courts of the Western Cape, South Africa.

20. How to contact us

For any question about this Operator Agreement, or to give an instruction or raise a concern in relation to the processing of Client Personal Information, please contact:

Taxspace (Pty) Ltd

57 Main Road, Paarl, Western Cape, South Africa, 7646

Information Officer: Francois Adriaan Du Toit

Information Officer email: information-officer@taxspace.app

General contact: contact@taxspace.app