Operator Agreement
This is our standard-form operator agreement. By creating an account and ticking the consent box at signup, you, the estate agent or agency that holds the account (the "Agency" or "Responsible Party"), accept it. It governs how ProperPics (the "Operator") processes the listing photographs and associated information you send us, on your behalf, under the Protection of Personal Information Act 4 of 2013 (POPIA). It prevails over our Terms of Service on data-protection matters. Its effective date for you is the date you accept it at signup, which we record against your account.
The Operator: Warwick Brown (sole proprietor), trading as ProperPics, of 18 Murray Avenue, Morningside Manor, Sandton, Gauteng, South Africa.
1. Roles and the nature of the relationship
1.1 The Agency is the Responsible Party. It determines the purpose and means of processing the listing photographs and associated information, and warrants that it holds the mandate of, and the necessary consent from, the relevant property owner, seller or lessor.
1.2 ProperPics is the Operator and processes the Agency's personal information only on the Agency's documented instruction, and only to provide the Service (virtual staging, enhancement, and listing-copy generation).
1.3 The Agency's standing instruction. The Agency instructs and authorises ProperPics, as its operator and on its behalf, to: (a) use Google (Gemini or Vertex AI) as a sub-operator; (b) transfer the personal information across the South African border to Google for processing; and (c) apply ProperPics's standard security, retention and people-exclusion settings set out below. ProperPics exercises these operational choices under the Agency's authority, not as an independent decision-maker. The Agency confirms it has reviewed and accepts these choices.
2. Processing only on instruction (POPIA s20)
ProperPics will: (a) process the Agency's personal information only for the purpose in clause 1.2 and only on the Agency's documented instruction; (b) never reuse the Agency's client photographs for its own portfolio, marketing, or model-training without the Agency's separate written authority; (c) treat all of it as confidential (clause 9); and (d) tell the Agency if, in its opinion, an instruction breaches POPIA.
3. Security measures (POPIA s19, s21)
ProperPics maintains risk-appropriate technical and organisational measures, including: HTTPS/TLS encryption in transit; encryption of backups at rest (the backup process refuses to write plaintext); per-record, owner-scoped access control; least-privilege administrator access; automatic deletion within the retention window; the people-photo exclusion in clause 4; and a written breach-response procedure (clause 7).
4. Special personal information and people (POPIA s26)
4.1 ProperPics's default excludes photographs detected as containing people from processing; such photographs are never sent to the sub-operator.
4.2 The Agency warrants that it will not supply photographs containing identifiable people, or any special personal information, without the necessary authority, and acknowledges that the exclusion in 4.1 is a shared safeguard, not a substitute for that warranty.
4.3 If a photograph containing a person is supplied despite 4.2 and is processed before the exclusion catches it, the parties will treat it under the breach procedure (clause 7) and the Agency, as the party holding the mandate and consent, is responsible for the consequences of having supplied it; ProperPics remains responsible for maintaining the exclusion control.
5. Sub-operators and cross-border transfer (POPIA s72)
5.1 The Agency authorises ProperPics to engage Google (Gemini or Vertex AI) as a sub-operator and to transfer personal information outside South Africa to Google to perform the Service.
5.2 ProperPics warrants that Google is engaged on a paid tier with no training on customer data and no human review for product improvement, under the Google Cloud Data Processing Addendum, and that ProperPics relies on POPIA s72(1)(a) (a binding agreement providing adequate protection) as the ground for the transfer.
5.3 ProperPics will not add or change a sub-operator that materially affects this transfer without giving the Agency prior notice and the opportunity to object.
6. Assistance to the Agency
ProperPics will, within 5 business days of a written request, assist the Agency to meet its own POPIA obligations, including: (a) data-subject requests, where ProperPics acts on the Agency's instruction (for example, the delete-on-instruction action) and does not field homeowner requests directly; and (b) breach support per clause 7.
7. Breach notification (POPIA s21(2), s22)
7.1 On reasonable grounds to believe the Agency's personal information has been accessed or acquired by an unauthorised person, ProperPics will notify the Agency without undue delay and in any event within 24 hours of becoming aware, with the facts the Agency needs for its own s22 notification to the Regulator and the affected data subjects.
7.2 ProperPics will follow its written breach runbook and keep it matched to this clause.
8. Retention, return and deletion (POPIA s14)
8.1 By default, the Agency's client photographs and all outputs are deleted 30 days after delivery (enforced automatically), and can be deleted sooner on the Agency's instruction (the delete-on-instruction action). A different period applies only where we separately agree it in writing.
8.2 On termination or on instruction, ProperPics deletes (or returns then deletes) all of the Agency's personal information and confirms deletion in writing.
9. Confidentiality
Each party keeps the other's photographs, business information and outputs confidential, and uses them only to give effect to this agreement (POPIA s20). This clause survives termination.
10. Liability and indemnity
10.1 Each party's total aggregate liability arising out of this agreement is limited to the greater of (a) the fees paid or payable by the Agency to ProperPics in the 12 months before the event giving rise to the claim, or (b) R5,000.
10.2 The cap in 10.1 does not apply to: a party's breach of its confidentiality or data-protection obligations; the indemnities in 10.3; or liability that cannot be limited under South African law.
10.3 The Agency indemnifies ProperPics against loss arising from the Agency's breach of its warranties in clauses 1.1 and 4.2 (mandate, consent, no unauthorised people/special personal information). ProperPics indemnifies the Agency against loss arising from ProperPics's breach of clauses 2, 3 or 5.
11. Commencement and precondition to processing
This agreement takes effect when you accept it at signup, and a signed agreement (your electronic acceptance) must be in force before ProperPics processes any of the Agency's client photographs.
12. Audit and records
ProperPics keeps records of its processing and makes available, on reasonable request, the information needed to demonstrate compliance with this agreement.
13. Governing law and disputes
South African law governs; POPIA and the Consumer Protection Act 68 of 2008 apply. Disputes are resolved as set out in ProperPics's Terms of Service. Venue: Johannesburg, Gauteng.
- Who we are
- Warwick Brown (sole proprietor), trading as ProperPics.
- Registration: Not applicable — sole proprietorship (no CIPC registration)
- Address
- 18 Murray Avenue, Morningside Manor, Sandton, Gauteng, South Africa
- Contact
- General: hello@properpics.co.za
- Privacy / data requests: privacy@properpics.co.za
- Information Officer (POPIA)
- Warwick Brown