Data processing agreement

Last updated 30 September 2026 (version 1.0)

A super admin accepts this agreement for their organisation in the app, under Settings, Agreements. You do not need to sign or send anything.

This agreement is between UCR Consulting (Pty) Ltd (registration 2022/249553/07, "UCR", "we") and the organisation that uses Incident Commander (the "Organisation", "you"). It is the written contract that the Protection of Personal Information Act, 2013 (POPIA) requires between a responsible party and an operator. A super admin of the Organisation accepts it online in the app, which makes it binding, in the same way as signing it.

1. Words used

  • Organisation data means everything the Organisation and its people put into Incident Commander about incidents, patients, family enquiries, messages, maps, photos and reports.
  • Personal information, special personal information, processing, responsible party, operator and data subject have the meanings in POPIA. Health information is special personal information.
  • Service means Incident Commander at incidentcommanders.com and its apps.

2. Who is who

For Organisation data, the Organisation is the responsible party: it decides why and how the information is collected. UCR is the operator: it processes the information for the Organisation, only to run the service. For account and billing details (such as email addresses and payments), UCR is the responsible party, as set out in the privacy policy.

3. What UCR will and won't do with Organisation data

  • Process it only to provide, secure and support the service, and as the Organisation directs through the way it uses the service and its settings.
  • Never sell it, use it for advertising, share it with other organisations on the service, or use it to train artificial intelligence.
  • Not look at it unless needed to fix a fault, keep the service secure, answer the Organisation's own support request, or meet a legal duty. When we do, only the minimum needed.
  • Tell the Organisation if we believe an instruction breaks POPIA.

4. Confidentiality

Everyone at UCR who can reach Organisation data is bound to keep it confidential, and access is limited to those who need it.

5. Keeping it safe

UCR keeps appropriate, reasonable technical and organisational measures in place (section 19 of POPIA), including:

  • each organisation's data kept separate by rules inside the database, tested against attempts to cross between organisations;
  • encryption while data travels, and encryption of stored data by the hosting provider;
  • access by invitation only, with roles so each person sees and changes only what their role needs;
  • payment card details handled only by Paddle, never stored by UCR;
  • automatic backups, security updates and regular review of these measures.

6. If something goes wrong

If UCR becomes aware that Organisation data has been, or may have been, accessed or acquired by someone not allowed to (a security compromise under section 22 of POPIA), we will tell the Organisation's super admins without undue delay, and within 72 hours where we can, with what we know. We will help the Organisation notify the Information Regulator and the people affected, and take steps to limit the harm.

7. Other companies that help run the service (sub-operators)

The Organisation agrees that UCR may use these providers, each bound by contract to protect the information:

  • Supabase: database, files and sign-in. Organisation data is stored in Frankfurt, Germany (European Union).
  • Netlify: delivers the website and app. Does not store Organisation data.
  • Google: maps and address search. Receives map positions and searched addresses, not patient details.
  • Open map services (OpenStreetMap and similar): address and route look-ups. Receive map positions only.
  • Resend: sends service emails such as invites and billing notices.
  • Paddle: payments. Receives billing details only, never Organisation data.

Before adding a provider that stores Organisation data, UCR will update this list and email the Organisation's super admins at least 30 days ahead. If the Organisation objects, it may end its use of the service before the change.

8. Information stored outside South Africa

Organisation data is stored in the European Union. Section 72 of POPIA allows this because the EU's General Data Protection Regulation gives protection at least as strong as POPIA, and UCR's providers are bound by contract to protect it.

9. Health information and children

The Organisation confirms it may lawfully record the health information and information about children that it puts into the service, for example to provide emergency care, protect life and reunite families (sections 27, 32 and 35 of POPIA), and that its people are trained to handle it.

10. Requests from people about their information

If a patient or other person asks UCR to see, correct or delete their information, we will pass the request to the Organisation and help it respond. The Organisation decides the answer.

11. How long information is kept, and when the Organisation leaves

  • Organisation data is kept while the Organisation uses the service. Records are medical records, so the Organisation decides how long it must keep them.
  • If the Organisation stops using the service, it can ask for an export of its data within 30 days.
  • After that, or earlier if the Organisation asks, UCR deletes the Organisation data within 90 days, including from backups as they are replaced, unless the law requires otherwise.

12. Showing that we comply

On reasonable request, no more than once a year unless there has been a security compromise, UCR will give the Organisation the information it reasonably needs to show that this agreement is being followed.

13. Other terms

  • This agreement forms part of the terms of service. If they conflict about personal information, this agreement wins.
  • Liability is as set out in the terms of service, except where POPIA or other law does not allow it to be limited.
  • UCR may update this agreement. A new version is shown in the app and a super admin is asked to accept it; until then, the previous version continues to apply.
  • South African law applies.

14. Contact

UCR Consulting (Pty) Ltd, 22 Cross Road, Glenhazel, Johannesburg, South Africa. Information Officer: Uriel Rosen, support@incidentcommanders.com.