Data Processing Schedule
Version 4 November 2026 · POPIA operator terms
This schedule forms part of every agreement between Nerdware (Pty) Ltd, which provides WalkIn ("Nerdware"), and a dealership that uses WalkIn (the "Dealer"). It sets out how Nerdware handles the Dealer's customer data under sections 19 to 22 of the Protection of Personal Information Act 4 of 2013 ("POPIA"). The Dealer accepts it electronically in WalkIn. Terms for resellers are at the end.
1. Roles
1.1 The Dealer is the responsible party for the personal information of its customers and prospective customers that is processed through WalkIn ("Customer Data"). This includes WhatsApp numbers, names, chat messages, vehicle interests, bookings, trade-in details and finance documents.
1.2 Nerdware is the Dealer's operator, as defined in POPIA, and processes Customer Data only to provide WalkIn under this agreement.
1.3 Nerdware is the responsible party for its own records about the Dealer's staff users, such as sign-in details and usage logs.
1.4 This schedule is the written contract between the Dealer and Nerdware required by POPIA section 21(1). If it conflicts with the main agreement on the handling of Customer Data, this schedule wins.
2. Instructions
2.1 Nerdware processes Customer Data only with the Dealer's knowledge and authorisation, as set out in this agreement and in the Dealer's settings in WalkIn, or as the law requires (POPIA section 20).
2.2 Nerdware will not use Customer Data for its own purposes. In particular, it will not sell it, use it for advertising, or use it to train AI models. Lead scoring and reports are run only for the Dealer, inside the Dealer's account. Nerdware may use anonymous message counts for billing.
2.3 If Nerdware believes an instruction breaks POPIA, it will tell the Dealer and may hold off acting on it until the matter is resolved.
3. Confidentiality
3.1 Nerdware treats Customer Data as confidential. It gives access only to staff and approved sub-operators who need it to provide WalkIn, and who are bound by confidentiality.
4. Security
4.1 Nerdware keeps appropriate, reasonable technical and organisational measures in place to protect Customer Data from loss, damage, unauthorised destruction and unlawful access or processing (POPIA sections 19 and 21(1)). The measures in force on the date of acceptance are listed in Annexure B.
4.2 Nerdware may improve these measures, but will not materially reduce the overall level of protection.
5. Security compromises
5.1 Nerdware will tell the Dealer immediately if it has reasonable grounds to believe Customer Data has been accessed or acquired by an unauthorised person (POPIA section 21(2)). It will phone the Dealer principal and confirm in writing.
5.2 The notice will set out what Nerdware knows at the time: what happened, which data and how many people are affected, the likely consequences, what Nerdware has done, and a contact person. Nerdware will update the Dealer as facts emerge.
5.3 Nerdware will help the Dealer meet its own duty to notify the Information Regulator and affected customers under POPIA section 22. This includes drafting the eServices portal submission and the customer notices for the Dealer to approve.
5.4 Nerdware will not notify the Dealer's customers or the Regulator about Customer Data on the Dealer's behalf without the Dealer's written approval, unless the law requires it.
6. Sub-operators
6.1 The Dealer authorises Nerdware to use the sub-operators listed in Annexure A.
6.2 Nerdware will give the Dealer at least 30 days' written notice before adding or replacing a sub-operator that processes Customer Data. If the Dealer has a reasonable data protection objection and the parties cannot resolve it, the Dealer may end the affected service without penalty.
6.3 Nerdware will bind each sub-operator to written terms that protect Customer Data at least as well as this schedule. Nerdware stays responsible to the Dealer for its sub-operators.
7. Data outside South Africa
7.1 Nerdware stores Customer Data, including documents and backups, on Google Cloud in Johannesburg, South Africa. (Database backups taken before 4 November 2026 were stored in Google's EU multi-region; these expire automatically by 18 November 2026.)
7.2 Some processing takes place outside South Africa: AI processing of chat messages (Google Vertex AI) and message delivery (Meta WhatsApp). The Dealer authorises these transfers. Nerdware will only make them to recipients bound by law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA (POPIA section 72).
8. Customers' rights
8.1 If a customer contacts Nerdware directly to access, correct, object to or delete their information, Nerdware will pass the request to the Dealer within 2 working days and will not respond itself unless the Dealer asks it to.
8.2 WalkIn gives the Dealer tools to export a customer's information, delete it, and honour opt-outs. Nerdware will help with any request these tools cannot handle.
9. Retention
9.1 Nerdware keeps Customer Data only for as long as the Dealer needs it, or as long as the law requires.
9.2 The retention periods are set out in Annexure C, unless the parties agree different periods in writing. Nerdware sets them in WalkIn, which then deletes data automatically when those periods end.
10. End of the agreement
10.1 Within 30 days after the agreement ends, Nerdware will give the Dealer an export of its Customer Data if the Dealer asks for one, and will then delete all Customer Data.
10.2 Copies in encrypted backups are deleted automatically within 14 days of that. Nerdware may keep records the law requires, such as invoices, but no Customer Data beyond that.
11. Showing compliance
11.1 Once a year, or after a security compromise, Nerdware will answer the Dealer's reasonable security and privacy questions and share a summary of its latest security review.
12. The Dealer's part
12.1 The Dealer is responsible for having a lawful reason to process its customers' information, and for telling customers how it is used, for example through its own privacy notice (POPIA sections 11 and 18).
12.2 The Dealer will only ask WalkIn to send marketing messages to customers who have agreed to receive them or who are existing customers, as POPIA section 69 allows. WalkIn records opt-ins and honours opt-outs to support this.
12.3 The Dealer will keep its own staff accounts secure: named users only, no shared logins, and leavers deactivated on their last day.
12.4 The Dealer will tell Nerdware promptly about any customer complaint, or any query from the Information Regulator, that involves WalkIn.
Annexure A: Sub-operators
| Sub-operator | What it does | Where |
|---|---|---|
| Google Cloud (Google LLC and affiliates) | Hosting, database, file storage and backups | Johannesburg, South Africa |
| Google Cloud Vertex AI | AI processing of chat messages to write Dan's replies. Not used to train Google's models | Global Google data centres |
| Meta Platforms (WhatsApp Business Platform) | Delivering WhatsApp messages between the Dealer and its customers | Meta's global data centres |
| Reseller named in the dealer agreement, if any | Setup and support, with admin access to the Dealer's WalkIn account | South Africa |
Calendar and email accounts that the Dealer's staff choose to connect (Google or Microsoft) belong to the Dealer, not Nerdware. WalkIn puts booking details, including the customer's name, into those calendars.
Annexure B: Security measures
- Access: each dealership sees only its own data, checked on the server for every request. Sales staff see only their own and unassigned customers. Finance documents are limited to F&I, managers and principals.
- Sign-in: passwords stored with scrypt hashing; sessions stored only as hashes; sign-in limits per account and per address; 12-character minimum with breached-password checks; two-step sign-in required for Nerdware and reseller admins.
- Encryption: HTTPS for all traffic; data encrypted at rest by Google Cloud; dealer keys and connection tokens also encrypted by WalkIn with AES-256-GCM; database connections require SSL.
- Documents: customer uploads go through single-purpose links that expire after 14 days. Only photos and PDFs are accepted, checked by their contents. Files sit in a private storage bucket and are served only to signed-in staff with permission.
- Records: an audit log of sign-ins, team changes, document views, exports, deletions and acceptances of this schedule.
- Messaging: WhatsApp webhooks are signature-checked; opt-outs (STOP) are honoured across every dealership; Dan tells customers he is an AI assistant in his first reply.
- Operations: secrets kept in Google Secret Manager; changes deployed only through automated tests and pipelines; daily database backups kept for 14 days in Johannesburg, with point-in-time recovery for the last 7 days and deletion protection on the database; restores tested; default remote-access firewall rules removed.
- People and process: an incident response plan with named roles; a security review before major releases; an annual independent penetration test (from 2027).
Annexure C: Retention periods
WalkIn is a sales and service tool, not the Dealer's record of a sale. The laws that require long retention apply to the Dealer's own deal file and dealer management system: FICA record keeping for car dealers (who are accountable institutions as high-value goods dealers), the Second-Hand Goods Act's five-year register for trade-ins, and tax records. So WalkIn keeps data only while it is useful for selling or servicing, and the Dealer copies anything it must keep into its own records first. This is how POPIA section 14 is applied.
| Data in WalkIn | Kept for | Then | Why this period |
|---|---|---|---|
| Customer profile, chats, bookings and notes | 24 months after the last activity: a message either way, or staff touching the record | Personal information erased, anonymous counts kept for reports | Covers a normal car buying cycle and service follow-ups. Active customers, such as those booking services, never reach the limit |
| Finance documents (ID, payslips, bank statements, licence) | 90 days after upload | File deleted | Needed only to submit a finance application to the banks, which decide within days. The Dealer files what FICA requires in its own deal file |
| Trade-in photos and details | With the customer profile: 24 months after last activity | Deleted with the profile | The Second-Hand Goods Act register (5 years) is kept by the Dealer in its own system, not in WalkIn |
| Customers who say STOP or ask to be deleted | Opt-out honoured at once. Deletion requests done by the Dealer within 30 days | Erased | POPIA sections 11(3) and 24 |
| Staff accounts | Until the account is deactivated, then 12 months | Deleted by Nerdware | Security investigations and audit trail |
| Audit log (sign-ins, document views, exports, deletions) | 3 years | Deleted automatically | Matches the 3-year prescription period for most claims, so we can answer a complaint or dispute |
| Backups | 14 days, rolling | Overwritten automatically | Recovery only |
| Sign-in attempt records | 15 minutes | Deleted automatically | Rate limiting only |
| Everything, when the agreement ends | 30 days, plus up to 14 days in backups | Export on request, then deleted | Clause 10 |
What WalkIn enforces automatically: the 24-month customer period, the 90-day document period and the 3-year audit log period, plus backups and sign-in records. Staff accounts are handled by Nerdware's quarterly housekeeping.
When it starts: for new Dealers, from acceptance of this schedule. For any Dealer already on WalkIn, 30 days after written notice, so it can export anything it must keep for FICA, the Second-Hand Goods Act or tax.
Reseller terms
These terms form part of every agreement between Nerdware and a reseller of WalkIn (the "Reseller"), and the Reseller accepts them electronically in WalkIn. Resellers can see their dealers' Customer Data, so each one is a sub-operator under Nerdware.
R1. The Reseller will access dealers' Customer Data only to set up and support WalkIn for those dealers, and only through WalkIn.
R2. The Reseller will keep that data confidential and will not copy, export or use it for anything else, including its own marketing.
R3. The Reseller will keep two-step sign-in on for every WalkIn admin account, limit access to named staff, and tell Nerdware within one working day when someone leaves.
R4. The Reseller will tell Nerdware immediately if it suspects a security compromise, and will help Nerdware and the dealer respond.
R5. The Reseller is bound by clauses 3, 4, 5 and 10 of this schedule as if it were Nerdware, for any Customer Data it can reach.
R6. When the reseller agreement ends, Nerdware removes the Reseller's access the same day.
Acceptance
A person who accepts this schedule in WalkIn confirms that they are authorised to bind the Dealer or Reseller. WalkIn records their name, role, the organisation, the version accepted, the date and time, and the network address used, and emails them a copy. Acceptance by data message meets the requirement for a written contract (Electronic Communications and Transactions Act 25 of 2002, sections 12 and 22). Questions: hello@nerdw.com.