This Addendum governs how Limuda Solutions (Registration No. 2024/433111/07), trading as MartialQA, processes personal information on your behalf when you use our services. It forms part of your agreement with us. For a countersigned copy, email info@martialqa.co.za.
Version 1.0 · Effective: 19 July 2026
You stay in control of your data. We only process it to run QA for you, we protect it as described on our Security page, we tell you promptly if something goes wrong, we only use the providers on our Subprocessors page, and we delete your data when we are done. The sections below say the same thing in contract language.
"Personal information" has the meaning given in the Protection of Personal Information Act, 2013 (POPIA) and, where applicable, "personal data" as defined in the EU General Data Protection Regulation (GDPR). "Customer content" means the calls, chats, emails, recordings, transcripts, knowledge-base materials and related data you submit to the service.
For customer content, the Customer is the responsible party (controller) and MartialQA is the operator (processor). MartialQA processes customer content only on the Customer's documented instructions, as set out in this Addendum and the underlying agreement.
MartialQA processes customer content only to provide and support the service, and will not use it for any other purpose. In particular, MartialQA does not use customer content to train machine-learning models, and does not permit its AI providers to do so. If we believe an instruction conflicts with POPIA or other applicable law, we will tell you before proceeding.
Access to customer content is limited to personnel who need it to deliver the service. All MartialQA personnel with such access are bound by written confidentiality obligations and complete security and privacy training at onboarding and annually thereafter.
MartialQA maintains appropriate technical and organisational measures to protect customer content, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256), workspace-level tenant separation, role-based access controls, multi-factor authentication, centralised logging and monitoring, encrypted backups, vulnerability scanning and independent penetration testing. These measures are described in detail on our Security page and will not be materially weakened during the term.
The Customer authorises MartialQA to engage the subprocessors listed on our Subprocessors page. Each subprocessor is bound by a written agreement imposing data protection obligations no less protective than this Addendum, and MartialQA remains responsible for each subprocessor's performance of those obligations. We will give the Customer advance written notice before adding or replacing a subprocessor that processes customer content. If you object on reasonable data protection grounds, notify us within 14 days of that notice and we will work with you in good faith to resolve the objection; if we cannot, you may terminate the affected service.
Customer content is primarily hosted in the European Union. Where processing involves a transfer outside South Africa or the EU, for example to an AI provider processing in the United States, we ensure the recipient is subject to a written agreement providing an adequate level of protection consistent with section 72 of POPIA and, where the GDPR applies, an approved transfer mechanism such as Standard Contractual Clauses.
If a data subject contacts MartialQA directly about personal information in customer content, we will refer them to you and not respond on your behalf except as required by law. Taking into account the nature of the processing, we will provide reasonable assistance so you can respond to requests for access, correction, deletion or objection under POPIA or the GDPR.
If MartialQA becomes aware of a breach affecting customer content, we will notify you without undue delay, consistent with the operator notification obligations under POPIA and, where applicable, the GDPR's requirements for processors. The notification will describe the nature of the breach, the data and data subjects likely affected, the measures taken or proposed, and a contact point. We will cooperate with your own notification obligations to the Information Regulator or other authorities.
On termination or expiry of the agreement, MartialQA will, at your choice, return customer content in a commonly used format or delete it, and will delete remaining copies within 30 days, except where retention is required by law. Data shared for a free QA audit is deleted from our systems within 14 days of the audit report being delivered. Backups containing customer content expire on their normal rotation schedule and remain protected until then.
On written request, no more than once per year unless required by a regulator or following a breach, MartialQA will make available the information reasonably necessary to demonstrate compliance with this Addendum, including our SOC 2 report and penetration testing summary under NDA. Where that information is insufficient, you may conduct an audit at your cost, on reasonable notice, during business hours, and without access to other customers' data.
This Addendum is incorporated into, and forms part of, your agreement with MartialQA from the date you begin using the Service, and prevails over the underlying agreement on the processing of personal information in the event of a conflict. A signature is not required for it to apply. If you would like a countersigned copy for your records, email info@martialqa.co.za.