Last updated: August 2026
This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the agreement between Bespoke Solutech (Pty) Ltd, trading as Looom ("Looom", "we", "us"), and the client identified in the applicable order form, subscription agreement, or master services agreement ("Customer") for the provision of the Looom audit intelligence platform and related services ("Services"). This DPA sets out the terms on which Looom processes personal information on the Customer's behalf in connection with the Services, in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and, where applicable to the Customer's own regulatory footprint, other data protection laws such as the GDPR.
Where anything in this DPA conflicts with the underlying services agreement, this DPA takes precedence in relation to the processing of personal information only.
Capitalised terms not defined below have the meaning given to them in POPIA (or, where applicable, the equivalent data protection law governing the relevant processing). In this DPA:
"Data Protection Laws" means POPIA and any other applicable law, regulation, or binding guidance relating to the processing, privacy, or security of personal information, as amended or replaced from time to time.
"Data Subject" means an identified or identifiable natural person (or, where applicable under the relevant law, a juristic person) to whom Personal Information relates.
"Operator" has the meaning given to that term in POPIA — broadly, a party that processes personal information for a Responsible Party in terms of a contract, without coming under the direct authority of that party. Where GDPR or another law applies instead, "Operator" is to be read as "Processor".
"Personal Information" means information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person, that the Customer, its personnel, or its own end-users submit to, or generate through use of, the Services.
"Responsible Party" has the meaning given to that term in POPIA — broadly, a party that determines the purpose and means of processing personal information. Where GDPR or another law applies instead, "Responsible Party" is to be read as "Controller".
"Security Compromise" means any incident that has led, or may reasonably be suspected to have led, to unauthorised access to, or accidental or unlawful destruction, loss, alteration, disclosure of, or access to, Personal Information processed under this DPA.
"Sub-Operator" means any third party appointed by Looom to process Personal Information on Looom's behalf in connection with the Services.
As between the parties, the Customer is the Responsible Party and Looom is the Operator in respect of Personal Information processed through the Services, except where the Customer is itself acting as an Operator on behalf of its own clients — in which case Looom acts as a Sub-Operator, and Looom's obligations under this DPA apply accordingly. Looom will process Personal Information only on the Customer's documented instructions, including those given through the Customer's configuration and use of the Services, unless otherwise required by law, in which case Looom will inform the Customer of that legal requirement before processing, unless the law prohibits such notice.
The Customer warrants that it has, and will maintain throughout the term of the Services, a valid legal basis under Data Protection Laws for the Personal Information it submits to, or processes through, the Services, including any Personal Information relating to its own personnel, clients, or other third parties. The Customer is responsible for the accuracy, quality, and legality of the Personal Information it provides, and for ensuring that any Data Subject notices or consents required for the Customer's use of the Services have been given. The Customer agrees not to submit Personal Information to the Services in a manner that would place Looom in breach of Data Protection Laws.
Looom will process Personal Information solely for the purpose of providing, securing, supporting, and improving the Services, in accordance with the Customer's instructions and this DPA, and for no other purpose, unless otherwise agreed in writing or required by law.
Looom will ensure that personnel authorised to process Personal Information are subject to an appropriate obligation of confidentiality, whether contractual or statutory, and that access to Personal Information is limited to those personnel who require it to perform the Services.
Looom maintains appropriate technical and organisational measures to protect Personal Information against loss, unauthorised access, and unlawful processing, having regard to the nature of the information and the risks involved. These measures are described in further detail on our Privacy & Security page and include encryption of data in transit and at rest, role-based access controls, audit logging, and regular review of security practices.
The Customer authorises Looom to engage Sub-Operators to assist in providing the Services, provided that Looom imposes data protection obligations on any such Sub-Operator that are substantially no less protective than those set out in this DPA, and remains responsible to the Customer for that Sub-Operator's performance of those obligations. Looom will make available, on request, a current list of the categories of Sub-Operators engaged in connection with the Services, and will provide reasonable advance notice of any material change to that list where practicable.
Where Looom transfers Personal Information outside South Africa — including to Sub-Operators, cloud infrastructure providers, or Looom group entities — Looom will ensure that appropriate safeguards are in place in accordance with Section 72 of POPIA, such as a written agreement obliging the recipient to apply data protection standards substantially similar to POPIA, before such a transfer takes place.
Looom will notify the Customer without undue delay, and in any event as soon as reasonably practicable, after becoming aware of a Security Compromise affecting the Customer's Personal Information. That notification will, to the extent then known, describe the nature of the Security Compromise, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address it. Looom will cooperate with the Customer's reasonable requests for information needed to meet the Customer's own notification obligations to Data Subjects or the Information Regulator.
Taking into account the nature of the processing, Looom will provide reasonable assistance to the Customer, by appropriate technical and organisational means, to enable the Customer to respond to requests from Data Subjects exercising their rights under Data Protection Laws, and to meet the Customer's obligations relating to security, breach notification, and, where applicable, data protection impact assessments.
On termination or expiry of the Services, Looom will, at the Customer's election, delete or return all Personal Information processed on the Customer's behalf, and delete existing copies, unless retention is required by law. Where the Customer does not make an election within a reasonable period, Looom will delete the Personal Information in accordance with its standard data retention practices.
Looom will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, and will permit and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, subject to reasonable advance notice, confidentiality, and no more than once per year unless required by a regulator or in response to a suspected Security Compromise. Looom may, in place of an on-site audit, provide a current third-party security report or certification where one is available and reasonably addresses the Customer's requirements.
The processing of Personal Information under this DPA is for the purpose of providing the Services described in the underlying agreement between Looom and the Customer, for the duration of that agreement, and thereafter only for as long as Looom retains Personal Information in accordance with Section 4.8 above.
Looom processes Personal Information to operate, secure, and support the audit intelligence platform, including collection, storage, organisation, retrieval, structuring, and analysis of data submitted by the Customer, generation of AI-assisted audit outputs, user authentication and access control, and technical support.
Personal Information processed through the Services may relate to: the Customer's employees, contractors, and authorised users; individuals whose information appears within the Customer's own audit, financial, or operational records uploaded to the platform; and the Customer's own clients or stakeholders, where such information forms part of the audit data the Customer submits.
Depending on how the Customer configures and uses the Services, this may include: names and contact details; employee numbers and role information; information contained within uploaded audit working papers, financial records, and supporting documentation; system access and activity logs; and any other Personal Information the Customer chooses to submit in the course of using the platform. The Customer determines what data it submits and is responsible for ensuring it does not submit special personal information (as defined under POPIA) unless strictly necessary and lawfully permitted.
This DPA takes effect on the date the Customer first accepts the underlying services agreement and continues for as long as Looom processes Personal Information on the Customer's behalf.
Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the underlying services agreement.
This DPA is governed by the laws of the Republic of South Africa, and the parties submit to the jurisdiction set out in the underlying services agreement.
We may update this DPA from time to time to reflect changes in Data Protection Laws or our processing activities. Material changes will be communicated to active clients in advance where reasonably practicable. The date at the top of this page reflects the most recent revision.
Bespoke Solutech (Pty) Ltd, trading as Looom
Attention: Information Officer
Email: info@looom.co.za
For more on how we handle personal information generally, see our Privacy Policy and PAIA & POPIA Manual. To request a signed copy of this DPA for your own records or vendor due diligence process, contact us at the address above.