Schedule to the AskZuri Terms of Service · Version 2.1 · effective 8 November 2026
This agreement is between the business that signs up for AskZuri (the "Client", the responsible party) and Blackbird Trading 390 CC, trading as AskZuri, registration no. 2011/024476/23, Information Regulator registration no. 2026-071481 ("AskZuri", the operator). It forms part of the AskZuri Terms of Service and applies whenever AskZuri processes personal information on the Client's behalf. It is the written contract required by section 21 of the Protection of Personal Information Act 4 of 2013 ("POPIA").
1.1 For personal information about the Client's customers and enquirers ("Customer Data"), the Client is the responsible party and AskZuri is its operator, as defined in POPIA.
1.2 For the Client's own account details (owner name, login, billing), and for visitors to AskZuri's own website, AskZuri is the responsible party. Our Privacy Policy covers that processing, not this agreement.
| Purpose | Answering the Client's customers on the Client's behalf (website chat, business page, WhatsApp, and phone where enabled), capturing enquiries, bookings, quotes and invoices, alerting the Client, and reporting results to the Client. |
|---|---|
| Data subjects | People who contact the Client through AskZuri: customers, prospective customers and callers. |
| Categories of personal information | Name; phone number; email address; what the person asks, writes or says in conversation; booking times; quote and invoice details. Call recordings are not kept, but call transcripts are. Voice notes are transcribed and the audio is not kept after transcription. |
| Special personal information | Not requested by the assistant. The assistant is instructed not to ask for ID, medical-aid or card numbers, medical history or diagnoses, and AskZuri automatically removes identity, card, account and medical-aid numbers from stored chats. Free text about symptoms or health is not automatically rewritten. Some Client businesses (for example dental, physiotherapy, veterinary or medical practices) may receive health information from their own customers. Where that happens, the Client is responsible for having the authorisation and explicit consent required by POPIA sections 26 and 27, for telling customers not to send clinical details through the assistant, and for handling any special personal information it receives. The Client must not configure the assistant to collect special personal information or information about children without AskZuri's written agreement. |
| Duration | For as long as the Client has an AskZuri account, plus the retention periods in clause 7. |
AskZuri will:
3.1 process Customer Data only on the Client's documented instructions: the Terms of Service, the Client's settings in its dashboard, and any written instruction from the Client. AskZuri will tell the Client if it believes an instruction breaks POPIA;
3.2 treat Customer Data as confidential, and make sure everyone who works on AskZuri is bound by confidentiality;
3.3 maintain appropriate, reasonable technical and organisational security safeguards under section 19 of POPIA, as summarised in Annexure A;
3.4 notify the Client without undue delay, and in any event within 72 hours of becoming aware of it, if there are reasonable grounds to believe Customer Data has been accessed or acquired by an unauthorised person (section 22), with the information the Client needs to notify the Information Regulator and the people affected;
3.5 help the Client, as far as reasonably possible, to respond to requests from data subjects to access, correct or delete their information (sections 23 to 25), and pass on any such request it receives directly;
3.6 not use Customer Data for its own purposes, never sell it, and not use it to market to the Client's customers;
3.7 make available the information reasonably needed to show compliance with this agreement, and answer the Client's reasonable written security questions;
3.8 review a sample of conversations, and any conversation the Client asks it to check, only to operate the service, fix errors, prevent abuse and improve the assistant. This is a documented instruction from the Client, limited to what is needed for those purposes. AskZuri will not use Customer Data for its own marketing or analytics, and will not sell it.
The Client will:
4.1 have a lawful basis to process the Customer Data and give its customers any notice POPIA requires, including that they are chatting to an AI assistant operated for the Client (AskZuri also shows this in the chat);
4.2 put only accurate, lawful information in the assistant's facts, and not instruct it to collect special personal information or children's information (clause 2);
4.3 not use AskZuri for direct marketing to people who have not agreed to it (section 69 of POPIA);
4.4 keep its dashboard login and links confidential, and tell AskZuri immediately if it suspects they have been shared or misused;
4.5 be responsible for the third-party services it chooses to connect (for example its own CRM, Zapier or webhooks), which then act on the Client's behalf, not AskZuri's.
5.1 The Client authorises AskZuri to use the sub-operators listed on our Trust page (Annexure B) to provide the service.
5.2 AskZuri relies on each sub-operator's written data-processing terms, which protect Customer Data at least as well as this agreement requires, and remains responsible to the Client for their performance.
5.3 AskZuri will update the list at least 30 days before adding or replacing a sub-operator that processes Customer Data. The Client may object on reasonable data-protection grounds; if we can't resolve it, the Client may end the service without any minimum-term charge and receive a pro-rata refund of any prepaid fees.
6.1 Some sub-operators process Customer Data outside South Africa (for example, AskZuri's database is hosted in Western Europe). AskZuri only transfers Customer Data to recipients subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA, including the sub-operators' data-processing agreements and, where they apply, standard contractual clauses.
6.2 The Client acknowledges that these transfers are necessary to provide the service it has asked for.
7.1 Chat conversations are deleted automatically after 90 days.
7.2 Enquiries, bookings, quotes and invoices are kept while the Client's account is active, so the Client can see its history, unless the Client deletes them sooner.
7.3 When the account ends, AskZuri will, at the Client's choice, provide an export (CSV) and then delete Customer Data within 30 days, except where the law requires AskZuri to keep it (for example records AskZuri itself needs for tax).
7.4 Backups held by sub-operators are overwritten on their normal cycle and are restored only to recover the service.
Each party's liability under this agreement is subject to the limits in the Terms of Service, except where the law does not allow liability to be limited.
9.1 If this agreement conflicts with the Terms of Service on data protection, this agreement applies.
9.2 South African law applies.
9.3 Contact for data-protection matters: AskZuri's Information Officer, hello@askzuri.co.za.
The current list, with what each one does and where it processes data, is on our Trust page.