Cloud Backup and NetApp-Backed Object Storage
1. Description of services and processing
1.1 Hexion provides cloud-based backup storage and related infrastructure services using NetApp-backed object storage hosted in Hexion's South African data centres.
1.2 In providing the Services, Hexion may store and retrieve Personal Information contained in Customer Data, together with associated metadata and technical information, solely to provide, secure, maintain and support the Services in accordance with the Agreement.
1.3 The Customer determines the categories of data uploaded, the purposes for which the data is processed, the retention requirements and the configuration of customer-accessible data protection and security features.
1.4 The Parties acknowledge that the Customer acts as the Responsible Party in respect of Personal Information it determines to store through the Services, and Hexion acts as its Operator to the extent that Hexion processes such Personal Information on the Customer's behalf.
2. Customer responsibilities and configuration
2.1 The Customer is responsible for determining the lawfulness of its collection, use, retention and disclosure of Personal Information and for ensuring that its use of the Services complies with applicable data protection law.
2.2 The Customer is responsible for configuring and administering customer-accessible security, encryption, access-control, retention, immutability, deletion and other data-protection features made available through the Services, to the extent such configuration is allocated to the Customer in the applicable service documentation.
2.3 Hexion shall provide reasonable information concerning available security and data-protection features to enable the Customer to make informed configuration decisions.
2.4 The Customer acknowledges that the availability of a security or data-protection feature does not mean that the feature has been enabled, configured or independently verified for the Customer's environment.
2.5 Nothing in this clause relieves Hexion of its obligation to establish and maintain the security safeguards that are within Hexion's control and required by section 21 of POPIA.
3. Hexion's security obligations
3.1 Hexion shall establish, implement and maintain appropriate, reasonable technical and organisational security measures for the infrastructure and services under its control, taking into account the nature of the processing and the risks to Personal Information, as contemplated in sections 19 and 21 of POPIA.
3.2 Such measures shall include, as appropriate to the Services:
(a) physical security measures for Hexion's data centres;
(b) access controls for Hexion personnel and administrative systems;
(c) network and infrastructure security;
(d) appropriate monitoring, logging and incident management;
(e) vulnerability and patch management for infrastructure managed by Hexion;
(f) backup-service resilience and recovery arrangements within the contracted service scope; and
(g) procedures for the secure handling of Personal Information by authorised personnel.
3.3 The specific measures implemented by Hexion shall be described in the applicable security schedule or service documentation. Hexion shall not be deemed to warrant the effectiveness of customer-configured features that Hexion does not manage.
4. Confidentiality and access
4.1 Hexion shall treat Personal Information processed in connection with the Services as confidential and shall not disclose it except as authorised by the Customer, required by law or necessary for the proper performance of the Services.
4.2 Hexion shall restrict personnel access to Customer Data to authorised persons who require such access for service delivery, administration, maintenance, security or support, subject to appropriate confidentiality obligations.
4.3 Hexion shall not access or use the substantive contents of Customer Data for purposes unrelated to the provision, security or support of the Services, except as authorised by the Customer or required by law.
5. Security compromises
5.1 Hexion shall notify the Customer immediately upon having reasonable grounds to believe that Personal Information processed by Hexion for the Customer has been accessed or acquired by an unauthorised person, in accordance with section 21(2) of POPIA.
5.2 Hexion shall provide information reasonably available to it concerning the incident, its likely impact, containment measures and remediation, and shall cooperate reasonably with the Customer's investigation and applicable notification obligations.
5.3 The Customer remains responsible for making notifications required of it as Responsible Party under section 22 of POPIA, without prejudice to any independent statutory obligations that may apply to Hexion.
6. Data location and subprocessors
6.1 Hexion shall maintain Customer Data within South Africa to the extent stipulated by the applicable service specification.
6.2 Hexion shall identify material third-party providers involved in storing or processing Personal Information for the Services and shall ensure that applicable contractual safeguards are in place for their activities.
6.3 Hexion shall notify the Customer of any material proposed change to the storage location or relevant processing arrangements where such change affects the agreed data-location commitment or applicable legal obligations.
6.4 If Hexion proposes to transfer Personal Information to, or permit its processing by a third party in, another country, the Parties shall assess the applicable requirements of section 72 of POPIA and implement any necessary lawful transfer arrangements before the transfer occurs.
7. Retention and deletion
7.1 Hexion shall retain Customer Data in accordance with the applicable service configuration, contractual retention period and documented Customer instructions, subject to applicable law.
7.2 The Customer is responsible for selecting and maintaining customer-configurable retention and deletion settings and for requesting deletion where required, except to the extent that the relevant function is expressly managed by Hexion.
7.3 Upon termination of the Services, Hexion shall provide for the return or deletion of Personal Information in accordance with the Agreement and the applicable service specification, subject to agreed retrieval periods, technical limitations disclosed in advance and any legal retention obligation.
7.4 Where information remains in routine backups or immutable storage for a defined period, Hexion shall apply the applicable retention and deletion procedures and protect that information during the remaining retention period.
8. No blanket compliance certification
8.1 The Parties acknowledge that the Services provide storage infrastructure and that compliance with POPIA depends on the respective legal obligations, security arrangements, configurations and processing activities of both Parties.
8.2 Hexion does not warrant that the Customer's use of the Services, or the Customer's overall information-processing environment, is POPIA-compliant merely because the Services include particular security or data-protection features.
8.3 Nothing in this clause excludes or limits Hexion's express contractual obligations or any liability that cannot lawfully be excluded or limited.