In short: your customers' information belongs to your business. We only use it to run NexAgent AI for you, we keep it safe, we tell you straight away if something goes wrong, and we delete it when you leave.
1. Who this agreement is between
Us (the operator): RD Investment Holdings (Pty) Ltd, trading as NexAgent AI, a private company registered in South Africa with CIPC, registration number 2026/237915/07. Director and Information Officer (registered with the Information Regulator): Ruben Diedericks. Address: 44 Greenock Road, Gqeberha, Eastern Cape, 6025, South Africa. Email: admin@rdinvestmentholdings.co.za. WhatsApp: +27 72 840 0352.
You (the responsible party): the business that signs up for NexAgent AI ("the Client").
Roles: For your customers' information, you are the responsible party and we are your operator. You decide why and how your customers' information is used. We process it for you.
For our own information about you (your contact people, our leads, our invoices and billing ledger including top-ups), we are the responsible party. Our Privacy Policy covers that, not this agreement.
This agreement forms part of our Terms of Service. If they conflict on how your customers' information is handled, this agreement wins.
2. What information we handle and why
| Information | Why we use it |
|---|---|
| Your customers' WhatsApp messages, phone numbers, names and chat history | To reply to enquiries for you and capture leads |
| Quotes, PDFs, invoices and job cards that include customer details | To create, send and store them for you |
| Stock records and staff timesheets you load | To run your stock and timesheet tools |
| Your staff names, working hours, pay rates and payroll/timesheet records | To run your timesheet and payroll tools |
| Monthly usage counts (AI chats and jobs) | To show your usage dashboard and send 80% and 100% alerts |
We do not sell your customers' information. We do not use it for our own marketing. We do not use it for any purpose other than running NexAgent AI for you.
Your employees are data subjects too. We treat their information under this agreement in the same way as your customers' information.
3. We follow your instructions
We only process your customers' information to deliver NexAgent AI as set up for you, and on your other reasonable written instructions (email or WhatsApp is fine). If an instruction looks unlawful to us, we will tell you and may refuse it. If the law forces us to disclose information, we will tell you first unless the law stops us.
4. Confidentiality
We treat your customers' information as confidential. Only our people who need it to run or support your service can see it (currently our director and our operations and technical staff). Everyone with access is bound to keep it confidential, also after they leave us.
5. Sub-processors (vendors we use)
To run NexAgent AI we use these vendors. You agree we may use them:
| Vendor | What it does | Where |
|---|---|---|
| Make.com (Celonis / Make) | Automation that connects the system | EU (Czech Republic) |
| Google (Sheets / Workspace) | Data storage and email | USA |
| Meta (WhatsApp Cloud API) | WhatsApp messaging | USA / Ireland |
| xAI | AI model that writes chat replies | USA |
| PDFMonkey | Quote and invoice PDF generation | EU (France; database in Germany) |
We hold each vendor to data protection terms. We will give you 14 days' notice by email before we add or replace a vendor that handles your customers' information. If you object for a good reason and we cannot solve it, you may cancel without penalty before the change takes effect.
6. Security
Access is restricted to authorised personnel. Data in transit is encrypted via HTTPS/TLS.
Each client's records are kept separately for each client, owned and controlled by NexAgent AI; clients access them via the dashboard and WhatsApp, and receive exports on request. Access is restricted and protected with strong authentication where available. Data stored with Google is encrypted at rest by Google.
7. Information sent outside South Africa
All five vendors are outside South Africa, so your customers' information is processed abroad. We only use vendors that are bound by data protection terms (their published data processing terms or standard contractual clauses) that give protection similar to POPIA.
8. If something goes wrong (data breach)
If we have reasonable grounds to believe someone unauthorised has accessed or taken your customers' information, we will tell you immediately (WhatsApp/phone and email). We will tell you what happened, what information is involved, what we have done to contain it, and who to contact.
Under POPIA it is your duty, as responsible party, to notify the Information Regulator and affected customers as soon as reasonably possible. We will help you: we give you the facts, a draft notice, and help with the Information Regulator's eServices portal.
9. Helping with customer requests
If one of your customers asks to see, correct or delete their information, or objects to its use, we will help you deal with it. If the request comes to us directly, we will send it to you within 5 business days and will not answer it ourselves unless you ask us to. We will make the change you instruct within a reasonable time. During the service, you may ask us to correct or delete records at any time, on request by WhatsApp or email, or via the dashboard, and we do it within a reasonable time. When the service ends, your client file and its version history are deleted.
10. When the service ends
Export during the service: you may ask for a full CSV/Excel export of your data at any time during the service. We deliver it within 5 business days.
When your service ends, you may ask in writing for an export of your data within 30 days. After that we delete your customers' information from our systems and ask our vendors to delete it, within 30 days of the end of service, unless the law requires us to keep it.
Exception: our own billing records about you (invoices and the billing ledger, including top-ups) are our records, not your customers' data. We keep them for as long as tax law requires (see our Privacy Policy).
11. Your duties
As responsible party you agree to:
- Have a lawful reason to collect and use your customers' information (for example, they asked you for a quote).
- Tell your customers who you are and that NexAgent helps run your chat (we give you a short WhatsApp greeting for this).
- Only send marketing messages to customers who agreed, or existing customers who can opt out, and honour every STOP or opt-out.
- Only give us instructions that are lawful.
- Tell us quickly if you think something is wrong.
12. Liability
Each party is responsible for its own breaches of POPIA and this agreement. Our total liability under this agreement is limited in the same way as the Liability section of our Terms of Service. Nothing here limits liability that the law does not allow to be limited.
13. Acceptance
You accept this agreement when you sign up for NexAgent AI, sign our service agreement, or start using the service. It lasts as long as we process your customers' information. Sections 4, 8, 9 and 10 continue after the service ends until all your customers' information is deleted.
We may update this agreement with 14 days' notice by email.