HENRYEXCHANGEJoin the Exchange

OPERATOR AGREEMENT

Effective Date: 24 August 2026
Version: 1

This Operator Agreement forms part of the Terms of Service and must be read with the Privacy Policy, Henry Consumer Privacy Notice, Suboperator List, Security and Incident Schedule, Retention, Deletion and De-identification Schedule, International Transfer and Recipient Register, applicable Product and Processing Schedule, Customer Acceptable Use Policy, Online Order Record and Commercials Record. It is the standard written operator agreement contemplated by sections 20 and 21 of the Protection of Personal Information Act 4 of 2013 (POPIA).

Standard and Enterprise arrangements: The standard position described in this document applies unless a signed Enterprise Annex expressly varies an eligible, identified contractual matter. Where legally and operationally available, any enhanced or non-standard scope, service level, support, infrastructure, assurance, reporting, implementation or other commitment must be separately requested, assessed, approved and priced under the Enterprise Agreement. An Enterprise Annex cannot alter statutory rights or mandatory legal obligations.

1. Application and Processing Roles

1.1. This Operator Agreement applies automatically whenever either party processes Personal Information as Operator for the other, including for an Enterprise Plan Customer. A signed Enterprise Annex may vary only the clauses it expressly identifies; all remaining provisions continue to apply and may change under the standard Agreement's change-control provisions.

1.2. Roles are determined separately for each processing activity:

  • for Tenant Data, the Tenant is generally the Responsible Party and Henry AI (Pty) Ltd, registration number 2023/620906/07, trading as Henry, Henry AI, Henry Ingest, Henry Insights and Henry Exchange (Henry), is the Operator where Henry processes only for Tenant-determined purposes; and
  • for Henry Lead Data, Henry is the Responsible Party and a receiving Tenant is the Operator while it accesses or processes that information for Henry's documented lead-routing, qualification, communication or transaction instructions.

1.3. Henry Lead Data means Personal Information that Henry sources or collects directly, or receives from a source organisation and thereafter controls as Responsible Party for Henry-determined preliminary matching, product presentation, routing or an authorised ecosystem workflow. The term describes the processing relationship and does not claim ownership of a person's information.

1.4. A party may have different roles at different stages. A receiving Tenant remains Henry's Operator only while acting on Henry's instructions. If it later determines an independent purpose or essential means—for example, to conduct its own underwriting, meet its own legal duties, enter into a customer contract or undertake separately authorised marketing—it acts as a Responsible Party for that distinct processing and must meet the applicable requirements in the Privacy Policy.

1.5. In a regulated transaction, Henry provides technology, data processing, matching, routing and workflow support and is not the credit provider, lender, insurer, underwriter or financial adviser unless the applicable product notice expressly identifies Henry in that role. Henry is the Responsible Party for preliminary matching, product presentation, participant-network selection, ranking and routing that Henry determines. A licensed participant is an independent Responsible Party from the stage at which it applies its own eligibility criteria, affordability or underwriting assessment, advice, disclosures, product terms, approval or fulfilment, whether or not Henry has released direct consumer contact details. The transaction record must identify the applicable roles before the relevant processing or regulated action.

1.6. Each Responsible Party appoints the other party as Operator for the applicable processing described above, and each Operator accepts its appointment. This Agreement does not reclassify processing for which a party independently determines the purpose or essential means.

1.7. This Operator Agreement is concluded electronically when the Tenant affirmatively accepts the Terms of Service, this Agreement and the applicable Product and Processing Schedule. It remains in force while either party performs Operator processing for the other. Capitalised terms not defined here have the meanings given in the Terms of Service or Privacy Policy.

1.8. Before Henry receives a Tenant-sourced lead, the Tenant is solely responsible for its own collection, lawful basis, section 18 notice, information quality and authority to disclose the Personal Information to Henry. Henry does not control and does not assume responsibility for the Tenant's independent conduct before receipt. Henry remains responsible for processing whose purpose or essential means Henry determines after receipt.

1.9. Where a Tenant uses the Service to evaluate or supply its own product and determines the product purpose, eligibility, decision, statutory duties or retention, the Tenant is the Responsible Party for that processing and Henry acts as Operator only to the extent Henry follows the Tenant's lawful documented instructions without independently determining those matters.

2. Description of Processing

2.1. Processing is undertaken to provide, support, secure and operate the selected Service and authorised ecosystem workflows for the Subscription Period and lawful retention period.

2.2. The applicable Product and Processing Schedule gives the most specific standard description of the Data Subjects, information, purposes, operations and shared responsibilities for Henry Ingest, Henry Insights or Henry Exchange. The Privacy Policy Sections 1 to 4 provide the general description, and provider, transfer, retention, security and rights details appear in the supporting schedules and Sections 6 and 8 to 11 of that Policy.

2.3. Operations may include collection, receipt, storage, access, organisation, extraction, analysis, validation, matching, routing, communication, disclosure to authorised participants, transaction administration, reporting, correction, restriction, return, de-identification and deletion.

2.4. Henry may collect, store, cache, replicate, back up and otherwise process Personal Information on Henry-controlled or authorised provider infrastructure. These operations are necessary service processing and do not transfer ownership. A receiving Tenant may access Henry Lead Data through the Service or an authorised integration only to perform the enabled workflow and documented instructions.

2.5. Health, race, religion, trade-union, sex-life, biometric, criminal-behaviour, Children's, legally privileged, authentication, identity-document and other highly sensitive information may be collected incidentally from connected mailboxes, documents, calls or archives even where it was not requested. The applicable Product Schedule and documented workflow must therefore define field, source, folder and document limits; quarantine, redaction and deletion controls; authorised access; and any enhanced notice, consent, additional condition, legal ground, regulation or prior authorisation, including the 2026 Regulations relating to the Processing of Data Subjects' Health Information by Certain Responsible Parties where applicable. A contract prohibition does not remove the Operator's protection duties after incidental receipt.

2.6. Before enabling a workflow that links unique identifiers for a new purpose with information from another Responsible Party, conducts credit reporting, processes criminal-behaviour information for a third party, transfers special or Children's Information to a country without adequate protection, or performs another activity listed in sections 57 or 58 of POPIA, the Responsible Party must record the assessment and obtain prior authorisation where required. The Operator may require the approval reference before processing.

3. Documented Instructions

3.1. Instructions may be documented in the Agreement, Online Order Record, accepted Commercials Record, enabled settings and workflows, authenticated administrator instructions, approved Statements of Work, and signed Enterprise Annexes. An Online Order Record or Statement of Work does not independently vary a legal clause unless incorporated into an Enterprise Annex.

3.2. Each Operator must process Personal Information only with the Responsible Party's knowledge or authorisation, for the purposes in Section 2 and in accordance with lawful documented instructions, unless applicable law requires otherwise. Where legally permitted, the Operator will inform the Responsible Party before processing required by law.

3.3. To protect Data Subjects and both parties, an Operator may seek clarification, pause affected processing or refuse an instruction it reasonably considers unlawful, unsafe, technically infeasible or outside the agreed scope. The parties will work in good faith to resolve the concern. Material additional scope may require an updated order, Commercials Record or Enterprise arrangement.

3.4. A Tenant receiving Henry Lead Data may use it only for the lead, product, channel, purpose, period and personnel authorised by Henry. Unless separately authorised by Henry and supported by an appropriate lawful basis and notice, the Tenant may not use it for unrelated marketing, build an independent lead database, sell it, disclose it onward or combine it for an incompatible purpose.

3.5. An instruction to enable an integration, AI feature or recipient authorises the data transmissions reasonably required for that configured feature, subject to the applicable Product and Processing Schedule. Disabling the feature stops new instructed transmissions but does not automatically delete copies already lawfully created; those copies follow the applicable retention and deletion rules.

3.6. An instruction is valid only for its documented purpose, source, data, recipient set and period. A general instruction or acceptance of the Privacy Policy does not substitute for specific consent where law requires it.

3.7. A Tenant instruction does not by itself authorise Henry to create, disclose, demonstrate, configure or enable a new processing purpose, role, data category, AI use, recipient, provider, country, transfer, retention rule, security exception or regulated workflow. Such a matter is effective only after the applicable workflow record, assessment, Henry internal approvals, review by appropriately qualified external legal or compliance counsel and signed Enterprise Annex where required are complete. Henry may pause or refuse processing while those requirements are assessed.

3.8. Henry may perform limited preliminary validation, eligibility screening and matching on receipt of a lead only where the Tenant warrants that its collection notice and authority covered disclosure to Henry for that activity or Henry records another approved lawful ground. The activity is limited to identifying potentially relevant displayed product categories or materially consistent alternatives. Henry must record the required category choice before pursuing or disclosing an unselected product.

3.9. A Henry product-category choice may cover one, several or all displayed and meaningfully described categories. It may cover a materially consistent alternative clearly included in the category description but does not authorise a materially different or undisclosed product, purpose, information requirement or recipient category. Henry controls the approved participant network, matching and routing for Henry-determined workflows.

4. Responsible Party Obligations

4.1. For processing it controls, each Responsible Party must comply with POPIA, including lawfulness, purpose specification, minimality, openness, information quality, security, retention, data-subject rights and required records, notices, consent or prior authorisation.

4.2. The Responsible Party must have authority to provide or enable access to Personal Information and must give complete, lawful and reasonably clear instructions. It remains responsible for decisions about purpose, essential means and any required regulatory or data-subject notification.

4.3. Where an Operator collects information directly for the Responsible Party, the Responsible Party must provide or approve the required notice, choices and consent wording. The Operator may present that material and retain evidence of the version and response as described in the Privacy Policy Section 12.

4.4. The Responsible Party must reasonably assist the Operator with context needed to follow instructions lawfully and must not require prohibited information or unlawful use of the Service.

4.5. The Responsible Party must maintain a current record of the purpose, lawful basis, source, collection method, notice owner, security and incident owner, rights-request owner and retention owner for each material stage. It must record required section 57 or special-information assessments, licensed-participant authority, direct-marketing authority and any consent or alternative-routing choice before enabling the stage.

4.6. The Responsible Party must take reasonably practicable steps to ensure that material source and derived information is complete, not misleading and updated where necessary for its purpose. It must investigate a substantiated dispute without requiring proof of manifest error, restrict consequential use where appropriate and notify affected recipients of a verified correction where law requires it.

4.7. Before supplying a lead to Henry, the Tenant warrants on a continuing basis that it:

  • lawfully collected the Personal Information and may disclose it to Henry for the documented preliminary matching and funnel purpose;
  • provided all notices and obtained all consent or other authority required for its collection and disclosure;
  • supplied accurate source and provenance information and did not misrepresent the consumer's request;
  • will provide Henry with the applicable privacy notice or identify its current public location before production lead delivery; and
  • will promptly notify Henry of a material change, withdrawal, objection, correction, complaint or suspected defect affecting that authority.

4.8. Henry may retain the privacy notice supplied by the Tenant or retrieve and archive a publicly available copy together with the URL, version or effective date where available and retrieval date. A public notice does not replace the Tenant's warranty or prove that a particular Data Subject received it. On reasonable request, the Tenant must provide evidence sufficient to support the lawfulness of an affected lead or workflow, subject to minimisation and third-party rights.

4.9. The Tenant acknowledges that Henry cannot control which leads the Tenant submits or independently verify every upstream interaction. Henry may rely on the warranties and records in this Section unless it has reasonable grounds to question them, without limiting Henry's right to seek evidence, restrict, quarantine, reject or stop affected processing. The Tenant remains responsible for its pre-delivery conduct and for loss or regulatory exposure caused by its breach, subject to the remedies and liability allocation in the Terms of Service.

5. Operator Obligations

5.1. For processing performed as Operator, each party will:

  • follow Section 3 and the applicable provisions of the Privacy Policy;
  • treat Personal Information as confidential and limit access to authorised personnel who are subject to appropriate confidentiality duties;
  • establish and maintain the risk-based safeguards described in the Privacy Policy Section 10;
  • not sell Personal Information, use it for targeted advertising, create unrelated user profiles or use it for an independently determined, incompatible purpose while acting as Operator; and
  • ensure that pseudonymised information remains protected as Personal Information unless the de-identification standard in the Retention, Deletion and De-identification Schedule is met.

5.2. The Operator may make a disclosure required by law or necessary for the proper performance of its authorised duties. Where lawful and appropriate, it will direct a compulsory requester to the Responsible Party, notify the Responsible Party before disclosure, obtain legal review, seek to narrow or challenge a disproportionate request, and disclose only what is legally required.

5.3. The Tenant must keep Henry Lead Data within authorised accounts, interfaces and integrations; apply least privilege; prevent copying or export except where the workflow permits it; and ensure its Users follow Henry's instructions and the Customer Acceptable Use Policy.

5.4. Henry may use appropriately controlled administrative access to support and secure Tenant processing. Privileged access must be need-based, approved, protected by multi-factor authentication, logged and time-bounded where technically supported; Henry will not maintain standing content access for support personnel where the relevant system permits just-in-time access. Tenant administrative access to Henry Lead Data remains limited to the personnel and purposes configured for the relevant workflow.

5.5. Taking account of available product capability, the Operator will preserve source references, extraction or receipt time, material transformations, confidence or exception information, linked records, model or rule version and authorised recipient history reasonably necessary to support provenance, review and correction of a material field or output.

6. Suboperators, Recipients and Transfers

6.1. The Tenant gives Henry general written authorisation to appoint providers listed in the Suboperator List as Suboperators for Tenant Data. Henry will bind each Suboperator by written terms that permit access and use only for the delegated service, prohibit an unrelated purpose and require protection no less protective in substance than the applicable Operator duties. Henry remains responsible for performance of its obligations under this Agreement notwithstanding its appointment of a Suboperator, subject to the lawful liability limits in the Terms of Service.

6.2. A Tenant may not appoint a suboperator for Henry Lead Data or disclose it to another recipient without Henry's prior written authorisation. Any approved suboperator must be bound by written obligations no less protective than the applicable requirements of this Agreement, and the Tenant remains responsible for its Operator obligations.

6.3. Provider changes and Tenant objections concerning Henry-appointed Suboperators are governed by the Suboperator List, including at least 30 days' ordinary advance notice for a material new Suboperator. International transfers are governed by the Privacy Policy Section 8 and International Transfer and Recipient Register and must be approved or enabled by the applicable Responsible Party.

6.4. An authorised ecosystem participant may be an Operator, independent Responsible Party or other recipient depending on the actual processing. A label in the Service does not override that legal assessment.

7. Security, Incidents and Assistance

7.1. Each Operator will maintain appropriate, reasonable technical and organisational measures as required by POPIA, the Privacy Policy Section 10 and, for Henry, the Security and Incident Schedule.

7.2. An Operator must notify the affected Responsible Party immediately once it has reasonable grounds to believe that Personal Information was accessed or acquired by an unauthorised person. The initial notice will not be delayed solely because the investigation is incomplete and will be supplemented with available information concerning the event, affected systems and data, likely consequences, containment, mitigation and contact point. The Operator will preserve material evidence and reasonably assist investigation, remediation and legally required notifications. Notice is not an admission of liability.

7.3. Taking account of the processing and information available, an Operator will assist the Responsible Party with data-subject requests, information quality, security, impact or prior-authorisation enquiries and evidence of compliance. It will acknowledge an assistance request promptly and provide available information or a reasoned progress update within five Business Days, or sooner where the Responsible Party identifies a shorter legal deadline. Each party bears its ordinary internal costs; material additional work may be scoped and charged only where lawful, proportionate and agreed without preventing timely compliance.

7.4. Assurance concerning Henry as Operator is governed by the Privacy Policy Sections 7.4 and 7.5 and the Security and Incident Schedule. Standard documentary evidence and reasonable written questions are used first. If they cannot reasonably demonstrate compliance with a material obligation, or after a material Security Compromise affecting the Tenant, the parties may agree a focused independent audit that protects other tenants, security and confidential information. Henry may request proportionate assurance concerning a Tenant's processing of Henry Lead Data and will keep supplied assurance information confidential.

8. Retention, Return and Deletion

8.1. Retention and deletion are governed by the Privacy Policy Section 9 and Retention, Deletion and De-identification Schedule. An Operator must follow the Responsible Party's lawful retention, return, restriction and deletion instructions, subject to mandatory law, product capability, minimum security evidence and secure backup cycles.

8.2. On Henry's instruction or when authorised access to Henry Lead Data ends, the Tenant must stop using it and securely return or delete accessible copies, except for information that the Tenant must retain as an independent Responsible Party under law. Any retained information must be isolated, protected and used only for that lawful retention purpose.

8.3. The Tenant's export rights for Tenant Data and licensed Tenant-Specific Henry Outputs are governed by the Terms of Service Sections 2 and 9. Unless a Product Schedule or signed Enterprise Annex states otherwise, Henry will maintain a limited-function export opportunity for 90 days after termination and disable it thereafter. Export of a Henry Output is licensed delivery and does not transfer ownership. Henry will delete remaining Tenant Data from active production systems and protected backups within the following 90 days, except data subject to a documented legal hold or lawful independent retention purpose. Deletion-pending backups are isolated from ordinary use, and deletion instructions will be reapplied if a backup is restored.

8.4. On reasonable written request after the applicable deletion deadline, the Operator will provide a deletion or return confirmation describing the systems and Suboperators covered, any lawful retention exception and its review trigger, subject to security and third-party confidentiality limits. A verified correction or deletion instruction must be propagated to affected active linked records and instructed Suboperators where reasonably practicable.

8.5. Henry will correct, restrict or delete Henry-controlled records as required and notify affected active Tenants or independent recipients where reasonably necessary. Henry may coordinate a request but does not warrant or promise deletion of information independently controlled or lawfully retained by a Tenant, dealer, lender or other Responsible Party. Each such party remains responsible for its own response, record and lawful retention decision.

9. Confidentiality, Rights and Records

9.1. Personal Information is Confidential Information under the Terms of Service Section 10. Nothing in this Agreement transfers ownership of identifiable Personal Information.

9.2. A Tenant receiving a request or objection concerning Henry Lead Data must promptly direct or relay it to Henry and must not respond on Henry's behalf unless instructed. Henry will do the same where it receives a request concerning Tenant-controlled Operator data.

9.3. Each Operator will maintain records reasonably necessary to demonstrate its compliance and make them available to the Responsible Party where proportionate and legally required, subject to confidentiality, security and third-party rights. Records may include processing instructions, authorised recipients, access, disclosures, incidents, assistance, return and deletion evidence.

9.4. For a Tenant classified in its Online Order Record as material or business-critical, the parties will retain the run-off transaction, confidentiality, security, request-assistance and audit records identified in the applicable Enterprise Annex for the stated survival period. Post-termination access is limited to the identified purpose and does not revive ordinary Service access.

9.5. This Agreement regulates processing authority and responsibilities only. It does not transfer ownership of Personal Information or unchanged source Tenant Data to Henry, and privacy, Operator, correction, deletion or purpose-limitation duties do not transfer ownership of Henry Technology, Henry Outputs, Enriched Data, Proprietary Methodology, Improvements or Custom Development to the Tenant. Intellectual-property ownership and licences are governed exclusively by the Terms of Service Section 2.

10. Liability and Remedies

10.1. Warranties, indemnities, exclusions, liability caps, claim periods and remedies are governed exclusively by the Terms of Service Sections 6 and 7. This Operator Agreement does not create a separate or additional liability regime.

11. Duration, Changes and Precedence

11.1. This Operator Agreement ends when neither party processes identifiable Personal Information as Operator for the other, subject to provisions that must survive by nature or law.

11.2. Changes and electronic acceptance are governed by the Terms of Service Sections 11 and 13. The version applicable to a paid fixed Subscription Period will not be materially changed to the Tenant's disadvantage during that period except for law, urgent security or a Tenant-requested new feature. A signed Enterprise Annex may vary this Operator Agreement only under the Enterprise Agreement and only for each clause it expressly identifies.

11.3. For Operator processing, precedence is: (1) an applicable signed Enterprise Annex, but only for each data-processing clause or service level it expressly identifies and varies; (2) the applicable Product and Processing Schedule for product-specific processing; (3) the Security and Incident Schedule, Retention, Deletion and De-identification Schedule, and International Transfer and Recipient Register for their subject matter; (4) this Operator Agreement for appointment, instructions and statutory processing responsibilities; (5) the Terms of Service; (6) the Privacy Policy and Henry Consumer Privacy Notice as transparency documents; and (7) the remaining standard Agreement. An Online Order Record documents scope and instructions but does not independently vary a legal clause unless incorporated into an Enterprise Annex.

11.4. A statement, meeting, demonstration, proposal, email, message, questionnaire, ticket or instruction from either party does not vary this Operator Agreement or establish an approved processing workflow. No person may rely on an informal representation to bypass the documented workflow and signed-variation requirements in the Agreement.

12. Law, Notices and Contact

12.1. Governing law, notices and disputes are governed by the Terms of Service Section 12.

12.2. Operator, privacy and PAIA enquiries, formal notices, security incidents and urgent security reports may be sent to legal@henryai.co.za. Messages must not include unnecessary passwords, secrets or identity documents. Support and finance routing is stated in the Terms of Service Section 12.2.

END OF OPERATOR AGREEMENT