Data Processing Addendum

The full contractual addendum — liability, audit rights and deletion timelines — is being finalised with legal counsel and will be published here. This page exists as the link target for the acceptance checkbox shown at signup — accepting it records that you agreed to this document at the version shown on that form, which we keep on file. What follows is accurate today and will carry into that document unchanged.

Operator role

For your firm’s own people’s information, Watchly acts as an operator under POPIA: we process it only on your firm’s instruction, for the purposes your firm uses Watchly for, and not for a separate purpose of our own. Each firm’s data is isolated from every other firm’s at the database layer — see our privacy notice for the general position.

Sub-processors

• Supabase — database and hosting, in the European Union (Frankfurt, Germany), for every firm.
• Anthropic (the Claude API) — only once Watchly has switched on an AI-assisted feature, such as the payroll double-check, for the whole product; this is a single platform credential, not a setting an individual firm turns on for itself. Only already pseudonymised figures are sent for that check, never a name, PSIRA number or contact detail, and the feature does nothing for any firm until that credential is set. See our AI processing notice for detail.

We add a sub-processor here before it starts handling personal information, not after.