Built to support your compliance obligations.
UK & EU GDPR
We act as a data processor under a written Data Processing Agreement, including international-transfer safeguards such as the UK IDTA or EU Standard Contractual Clauses where required.
POPIA (South Africa)
We act as an operator on your behalf under a written agreement, with security safeguards and breach notification as required by POPIA.
Zimbabwe Cyber and Data Protection Act
Our Zimbabwe branch complies with the Cyber and Data Protection Act [Chapter 12:07] as the local law governing its operations.
Zambia Data Protection Act
Our Zambia branch complies with Zambia's Data Protection Act No. 3 of 2021 as the local law governing its operations.
HIPAA (US healthcare)
For US healthcare clients, we apply HIPAA administrative, physical and technical safeguards and can sign a Business Associate Agreement after reviewing the scope.
One standard, three branches
Every branch follows the same security controls, training and audit checklist, so your data is protected the same way wherever your team sits.
What this means day to day.
- A Data Processing Agreement (or BAA) with every client before access is granted
- Minimum necessary access: only the systems and data each task requires
- Annual data-protection training for every team member
- Records of processing kept for each client
- Support with your data-subject requests and audits
- Breach notification to you within 24 hours of discovery
This page is a summary, not legal advice. Your obligations depend on your business and jurisdiction, so please ask your own adviser. Our agreements set out the exact commitments.