Version 2026-10 · Effective 1 October 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service or other written agreement (the "Agreement") between Dimeri (Pty) Ltd ("Dimeri") and the customer that has accepted it ("Customer"). It applies whenever Dimeri processes personal information on the Customer's behalf in providing the Dimeri governance, risk and compliance platform (the "Service"). It lasts for as long as the Customer's subscription under the Agreement, and for any further period in which Dimeri still holds Customer Personal Data.
It is written to meet the requirements of the Protection of Personal Information Act 4 of 2013 (POPIA) and other data protection laws that apply to the Customer, including the data protection laws of other African countries and, where relevant, the EU and UK General Data Protection Regulation. If this DPA and the Agreement conflict on the processing of personal information, this DPA applies.
The Customer is the responsible party (or controller) for Customer Personal Data and Dimeri is its operator under sections 20 and 21 of POPIA (or processor under Article 28 of the GDPR). Where the Customer itself acts for another organisation, such as a consultant running a workspace for a client, Dimeri acts as a sub-operator and the Customer remains responsible for having the authority to instruct Dimeri.
Dimeri is a responsible party in its own right for account, billing and usage information it uses to run its business, as described in its Privacy Policy.
Dimeri will:
The details of the processing are set out in Annex 1.
Dimeri will put in place and maintain appropriate, reasonable technical and organisational measures to protect Customer Personal Data against loss, damage, unauthorised destruction and unlawful access or processing, as required by sections 19 and 21(1) of POPIA and equivalent Data Protection Laws. These measures are summarised in Annex 2 and on our Security page. Dimeri may update them, as long as the overall level of protection is not reduced.
The Customer authorises Dimeri to use the sub-processors listed on our Sub-processors page. Dimeri will:
Customer Personal Data held in the Service is hosted in South Africa (Cape Town). When the Customer uses AI features, text may be sent to the AI providers listed on the Sub-processors page, some of which are outside South Africa. Personal details in that text are masked before it is sent, where possible.
Dimeri will only transfer Customer Personal Data across borders where the transfer is permitted by section 72 of POPIA and other applicable Data Protection Laws: for example, where the recipient is bound by a binding agreement or law that gives an adequate level of protection, or, for transfers from the EU or UK, under the applicable standard contractual clauses.
Workspace administrators can choose "South Africa only" AI processing, which blocks AI providers outside South Africa so that workspace content is not sent to them.
If Dimeri becomes aware of a security compromise affecting Customer Personal Data, it will notify the Customer without undue delay and in any event within 72 hours. The notice will give, as far as is then known, what happened, the data and people affected, the likely consequences and the steps taken or proposed, so that the Customer has what it needs to notify under section 22 of POPIA or Article 33 of the GDPR. Dimeri will cooperate with the Customer and help it meet its own duties to notify the Information Regulator, other supervisory authorities and the people affected.
Taking into account the nature of the processing, Dimeri will help the Customer respond to requests from data subjects to access, correct, delete or object to the processing of their personal information, including requests under sections 23 to 25 of POPIA and the Promotion of Access to Information Act. If Dimeri receives a request directly, it will pass it to the Customer and not respond itself unless told to. Dimeri will also give reasonable help with data protection impact assessments and consultations with regulators.
Dimeri will make available the information reasonably needed to show that it meets this DPA, including security documentation and, where available, independent audit reports. Where that information is not enough to meet a legal requirement, the Customer may carry out an audit on at least 30 days' written notice, no more than once a year, during business hours and under confidentiality, at its own cost.
The Customer can export its data from the Service at any time while its subscription is active. When the Agreement ends, the Customer has 30 days to export its data, after which Dimeri deletes the workspace and its Customer Personal Data within 90 days. Dimeri may keep data for longer only where the law requires it or a legal hold applies, and only for that purpose. Copies held in backups are deleted on the normal backup cycle and stay protected by this DPA until then.
Each party's liability under this DPA is subject to the limitations of liability in the Agreement. This DPA lasts as long as Dimeri processes Customer Personal Data under the Agreement, and is governed by the laws of the Republic of South Africa.
Questions about this DPA, requests for a signed copy, or notices under it should go to our Information Officer at phumi@dimeri.ai.