Parties: Synapser (Pty) Ltd (“Synapser”) and the integrating Customer entity (“Customer”).
1. Scope, Purpose, and Processing Roles Across Products
1.1 Scope: This Data Processing Addendum (“DPA”) governs the processing of personal information and biometric data in connection with the Customer’s use of any Synapser product, including Entry, EntryIDP, EntryMFA, The Key Platform, SecureUs, Gain for Me, Project TIDE, and Utility Africa.
1.2 Identity & Biometric Processing (Entry and EntryIDP):
- Synapser Controller Status: Synapser acts as an independent Responsible Party / Data Controller under POPIA and GDPR for biometric enrolment, facial liveness verification, template matching, and atomic authentication within the Entry and hosted EntryIDP boundaries.
- Customer Controller Status: The Customer acts as an independent Responsible Party / Data Controller for personal data within its own systems, initiating verification requests, and processing returned signed JWT assertions or verification outputs.
1.3 SaaS Platforms & Operator / Processor Scope: Where Synapser processes personal information strictly on behalf of the Customer without determining the means and purposes of processing (e.g., custom attributes routing, policy administration, or enterprise platform workflows), Synapser acts as an Operator / Processor under POPIA/GDPR.
2. Biometric and Special Category Data Obligations
2.1 Statutory Conformance: Both parties shall comply with POPIA, GDPR, and US state biometric privacy statutes (including Illinois BIPA).
2.2 Consent & Fallback Requirements:
- Synapser will present statutory notices and capture explicit biometric consent on hosted EntryIDP interfaces or SDK capture screens.
- The Customer warrants that it provides an alternative non-biometric verification flow within its application if a user declines biometric processing.
2.3 Non-Commercialisation: Synapser shall not sell, lease, trade, or commercially profit from raw biometric data, vectors, or templates.
3. Technical & Organizational Measures (TOMs)
3.1 Isolation & Data Minimisation: Biometric templates and raw samples remain strictly isolated within Synapser’s secure boundary and are never returned to Customer environments.
3.2 Cryptographic Safeguards: All data in transit must enforce TLS 1.2+ (TLS 1.3 recommended) and data at rest must use AES-256 encryption within hosted cloud environments.
3.3 Deletion Enforcement: Synapser enforces automated deletion of biometric identifiers upon consent withdrawal, subscription termination, or reaching the 3-year inactivity threshold.
4. Subprocessors and Cross-Border Transfers
4.1 Subprocessors: Customer grants general authorization for Synapser to engage Amazon Web Services (AWS) for hosting and backup infrastructure under equivalent data protection terms.
4.2 International Transfers: Cross-border transfers adhere to POPIA Section 72 and Standard Contractual Clauses under GDPR Chapter V.
5. Security Incident Notification
5.1 Notification: In the event of a confirmed security incident affecting Synapser identity databases or Customer data, Synapser will notify affected Customers without undue delay (and within 72 hours of becoming aware of the incident).