Operator agreement

Version 1.7, published 27 October 2026. Not yet reviewed by counsel. If the Venue accepted version 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 or 1.6, that version keeps applying to it until it accepts this one (clause 12.5).

Parties

1. The Venue: the business named, with its address, when this agreement is accepted below (the Responsible Party). The person who accepts confirms that they are authorised to bind it.
2. Splice Computers (Pty) Ltd, trading as Venuo, a product of Yielde, reg. 2019/272712/07, 55 York Street, George, Western Cape, 6529 (the Operator, Venuo). Venuo's acceptance is given by Chris Botha, authorised representative, under the written authority of the company's sole director, Maria Cornelia Magrieta Botha.

1. What this agreement covers

1.1 The service. The Venuo enquiry desk (the Desk) receives the enquiries that reach the Venue's web form or enquiry email, answers them and the enquirer's later messages in the same conversation from the Venue's own profile, prices and availability, offers and sets viewing appointments with calendar invites, keeps a record of each enquirer (a lead) for the Venue, and sends the Venue notices and a daily summary at 07:00. Replies name the Venue's desk address as the address to reply to, so the enquirer's answers come back to the Desk. The dashboard's Ask box answers the Venue's questions from numbered, unnamed summaries of its leads. The terms of service describe the service and its price.

1.2 Roles.

• The Venue is the responsible party: it decides why and how enquirers' personal information is processed. It sets its profile, prices, availability, and whether replies go out automatically.
• Venuo is the operator: it processes that information for the Venue under this agreement, without coming under the direct authority of the Venue (POPIA s.1).
• Venuo is a responsible party in its own right only for its own records about the Venue: the account, sign-in and session records of the Venue's people, acceptances of these texts, payments (through Paystack), the card token kept for automatic renewal, invoices and credit notes, the campaign labels of the ad a Venue's person came from and, only with that person's consent, their Meta identifiers, and its own emails to the Venue's people about the service. Its privacy notice (venuo.co.za/privacy) covers them, and anyone who uses the demo pages or writes to Venuo directly.

1.3 The personal information is listed in Annex A.

1.4 This agreement is the written contract that POPIA s.21(1) requires. On any conflict about personal information it prevails over the terms of service, and both prevail over Venuo's privacy notice, which describes only Venuo's own processing.

2. Venuo's duties as operator (POPIA s.20, s.21)

2.1 Venuo processes the personal information only to provide the Desk to the Venue, and on the Venue's documented instructions: this agreement, the Venue's settings and profile in its dashboard, and the Venue's written requests. A request made only by phone is confirmed in writing before Venuo acts on it.

2.2 Venuo does not:

• use the information for its own purposes, sell it, or use it to market to enquirers;
• use it, or let a sub-operator use it, to train or improve any AI model (clause 5.3);
• send an enquirer anything except replies to their own messages and the notices about a viewing they agreed to (the invite, a change or a cancellation). No marketing, and no messages to anyone who hasn't written to the Venue.

2.3 Venuo treats the information as confidential and discloses it only as this agreement allows or the law requires (s.20(b)). Only Venuo's authorised representative has access; anyone Venuo later authorises first signs a written confidentiality undertaking.

2.4 If the law requires Venuo to process the information beyond the Venue's instructions, Venuo tells the Venue first, unless the law forbids it. If Venuo believes an instruction breaks POPIA, it tells the Venue promptly and may decline to act on it.

3. Security measures (POPIA s.19)

3.1 Venuo takes appropriate, reasonable technical and organisational measures to prevent loss of, damage to or unauthorised destruction of the personal information, and unlawful access to or processing of it (s.19(1)). It identifies foreseeable risks, keeps safeguards against them, checks regularly that they work, and updates them when risks change (s.19(2)).

3.2 Measures in place. Venuo may change them, but not in a way that lowers protection.

• (a) Encryption in transit. The dashboard and every page and API of the Desk are HTTPS only, with HSTS (app.venuo.co.za). Calls to sub-operators use TLS.
• (b) Sign-in and links. The Venue's people sign in with an email link or 6-digit code that is valid for 15 minutes and works once. Only hashes of codes and session cookies are stored; the approve, stop and view links in an email also appear inside the stored copy of that email, which is deleted after 90 days. Wrong codes are limited (5 per link, and a cap per network address per hour), as are sign-in emails. A session ends 30 days after it was last used and 90 days after sign-in at the latest, and a person can sign out everywhere. Every change made in the dashboard carries an Origin check and a forgery token. Approve, stop, view and news links in emails are signed, name their purpose, expire (approve 7 days, view and stop 30 days, news 60 days) and can be revoked for one Venue; an approve link works once. Every dashboard query is limited to the signed-in person's own venue, and the identifier of a self-serve Venue is never reused.
• (c) Least privilege. Only Venuo's authorised representative holds credentials. Secrets are kept in a secrets manager, never in source code. Operator actions are signed requests, and destructive actions on a Venue's live data (deleting, forgetting, refunding, removing an opt-out) need a typed confirmation. The model key has a hard spend limit.
• (d) Minimisation. Only the conversation being answered is sent to the model, never the Venue's other mail. The model returns a fixed set of fields and, at most, a short neutral note of a special request for the Venue. Replies are built from the Venue's own wording, prices and availability. The only words the AI supplies are the person's name and event date as it read them from their message, checked by fixed rules. The Ask box sends the model numbered summaries of the Venue's leads (status, event type, the event date as the person wrote it, guests, whether a special request was made, and when the lead was last updated), the Venue's 13-week statistics, its upcoming viewing times, today's date, the Venue's own profile, and the Venue's question with the earlier turns of that conversation, never a lead's name, email address or message text. The Desk reads every enquiry with Claude Haiku 5.5 (the Fast setting, the only one offered), and with Claude Sonnet 5.5 only when Haiku 5.5 fails twice on one message. The Ask box always uses Claude Haiku 5.5. For a Venue that Venuo keeps on its earlier models (Annex B), every model call, the Ask box included, uses Claude Haiku 4.5, and Claude Sonnet 5 only when Haiku 4.5 fails twice on one message.
• (e) Special and children's information. The Desk has no field for religion, race, health, sex life, biometrics, political or union membership, or criminal behaviour (POPIA s.26), nothing in the Desk asks for it, and the model is told not to note it. A person may still volunteer it in their own words (for example an access, dietary or religious need in a special request). The Desk then does not interpret it: the message is handled as a special request for the Venue, which decides, and it is deleted on the schedule in clause 6. The Desk is for adults enquiring about a venue; it does not ask for or note a child's information.
• (f) Model providers keep nothing. Model calls go only to endpoints that do not retain prompts and do not train on them (zero data retention). Calls to Claude models are pinned to Amazon Bedrock and Google Vertex AI, with no fallback to other hosts: a double outage turns replies into drafts for the Venue.
• (g) Audit log. Messages, decisions, sends, approvals, sign-ins, acceptances, payments, stops and setting changes are logged with a timestamp; the log holds no message text and is kept 13 months. Technical logs of the Worker hold codes and counts only: never an address, name or message text.
• (h) Retention and purge. Message text and personal fields are deleted automatically, by a daily purge, on the schedule in clause 6.
• (i) Stop switch and fail safe. The Venue can stop all replies from its dashboard or any daily email, within a minute. On the day the Desk starts and the 3 days after it, every reply is a draft, unless the Venue switches automatic replies on itself after confirming the warning in its Settings. The Desk makes a draft for the Venue instead of answering when it is unsure, when it can't verify who sent a message, when an enquirer asks about their personal information or has asked to stop, when the model fails, or when the Venue's paid month's enquiries are used (terms of service, clause 5). A high bounce or complaint rate switches automatic sending off for the Venue.
• (j) Abuse limits. Caps per sender and per venue on enquiries per hour, on automatic replies per hour, on replies to one address per day, on model calls per day and on Ask questions per day.
• (k) Backups and restore. The database is not copied elsewhere by Venuo. Cloudflare keeps restore points of it for a limited period, and Venuo restores from one only for corruption (clause 6.3).
• (l) Monitoring. The Desk records a heartbeat and raises alerts to Venuo's operator mailbox for failures, backlogs, model errors and probing. Those alerts carry codes, venue names and counts, never an enquirer's name or message.

3.3 Venuo holds no ISO 27001, SOC 2 or similar certification and claims none.

4. Sub-operators (POPIA s.20, s.21, s.72)

4.1 The Venue authorises Venuo to use the sub-operators in Annex B. Venuo requires each of them, by contract, to keep security, confidentiality and purpose limits no less protective than this agreement, and remains responsible to the Venue for them. Entries marked conditional apply only while the Venue uses that feature.

4.2 Venuo gives the Venue 14 days' notice by email before it adds or replaces a sub-operator, or turns on a conditional entry for the Venue without the Venue choosing it. The Venue may object, by email within those 14 days, on reasonable data-protection grounds. Venuo then tries to resolve it (for example, by not using that sub-operator for the Venue). If the parties can't resolve it, the Venue may end the service and Venuo refunds the payment for the month in which it ends, in full.

4.3 If a sub-operator must be replaced at once (an outage, or a security problem), Venuo tells the Venue as soon as it can, and in any event within 7 days, and clause 4.2's objection right then applies from that notice.

4.4 A change to Annex B made under this clause does not need the Venue to accept a new version: its protection is the notice and the right to object.

5. Transfers outside South Africa (POPIA s.72)

5.1 The information leaves South Africa. The Desk runs on services in the United States and the European Union (Annex B).

5.2 The basis for each transfer. The parties rely first on s.72(1)(c): the transfer is necessary for pre-contractual measures taken in response to the enquirer's own request (their enquiry about a date, prices and a viewing). In support they rely on s.72(1)(a): each sub-operator is bound by a written data-processing agreement or binding terms that give adequate protection, including limits on onward transfer; Venuo does not rely on (a) alone until it holds each provider's terms.

5.3 No training, no retention by the model host (clause 3.2(f)). Venuo does not change this without the notice in clause 4.2.

5.4 The Venue's notice duty. The Venue tells enquirers in its privacy notice, or on its form, that their details are processed outside South Africa (s.18(1)(g)) and that an AI service reads their message. Annex C is wording the Venue may use. Every reply also carries a short notice.

6. Retention and deletion

6.1 During the service (applied automatically by the daily purge):

• each message and reply (the text, and the personal fields taken from it): 90 days after it was received or sent;
• a lead's record (name, email address, status, the special-request note), its history and its viewings: 90 days after the latest message in the conversation or, if later, after the latest viewing that is booked, moved, held or missed (a cancelled viewing does not count);
• quarantined messages (bounces, auto-replies, spam): 30 days; mail-provider forwarding-confirmation messages: 7 days;
• metadata with no message text (times, states, counts, reason codes, a keyed hash of an address): 13 months; the audit log, 13 months;
• the mail provider's copies of sent emails and delivery logs: up to 30 days; the Desk's own records of send attempts and provider events: 90 days; demo submissions: 30 days;
• the Venue's settings, profile, availability: while the service runs;
• the opt-out record (clause 6.4): while the service runs.

6.2 At the end of the service, on the Venue's request within 10 working days, Venuo gives the Venue an export of its data (JSON), which includes the Venue's opt-out record (clause 6.4). Within 30 days of the end, Venuo deletes everything it holds for the Venue (its accounts, settings, profile, message text, leads and their history, viewings, availability, opt-outs and metadata), except the encrypted ledger lines in clause 6.3, which stay in Venuo's operator mailbox (clause 6.4). Venuo also detaches the Venue's desk address from the Venue (it is not given to another venue for 90 days) and confirms the deletion in writing. The same applies when the Venue asks for its data to be deleted. Apart from those ledger lines, Venuo keeps only its own records under clause 1.2: payments (reference, plan, amount, status, dates, invoice and credit-note numbers, any referral code and campaign labels) for 7 years after the latest of the payment, refund and billing-period end dates (and longer while an audit or objection is open), and acceptances of these texts for 5 years after the contract ends (the day the Venue is deleted), for accounting and tax (Companies Act, VAT Act, Tax Administration Act) and as evidence of the contract; then it deletes them.

6.3 Restoring a backup. Venuo restores the database from a restore point only to repair corruption. Each forget request and each opt-out the Desk records is also emailed to Venuo's operator mailbox as one line holding the person's address in encrypted form, which only Venuo can decrypt (a privacy ledger kept outside the database). After a restore, Venuo replays those lines within 5 working days, so every deletion, forget request and opt-out made since the restore point is applied again, and tells the Venue if that covers the Venue's data.

6.4 The opt-out record. When an enquirer asks the Desk to stop, objects, or asks for deletion, the Desk keeps a short record so that it never answers that person automatically again: a SHA-256 fingerprint of the Venue's identifier and the person's address, what they asked, and when. The fingerprint is not keyed, so a rotated secret never loses it. It is not an address, but addresses are guessable, so anyone who already has an address can check whether it is on the list; Venuo therefore treats the record as personal information and shows it only in an export to the person or the Venue. It survives the 90-day purge and a forget request, because it is the proof that the person's request was honoured (the Venue's duty under POPIA s.11(4) and, for marketing, s.11(3)(b) and s.69, and the person's own interest in being left alone), and it is deleted when the Venue is deleted (the encrypted ledger line in clause 6.3 stays in Venuo's operator mailbox). The Desk records it only when the message arrived by email and Cloudflare verified the sender's address; a web-form notification is not kept. It makes the Desk draft instead of send: it does not block the Venue, who remains responsible for honouring the request. A person who wants to be taken off the list (for example, to be answered again) can ask the Venue or write to [email protected]; on the Venue's written instruction Venuo removes it within 5 working days (clause 8.4).

7. Security compromises (POPIA s.21(2), s.22)

7.1 Where there are reasonable grounds to believe that the personal information has been accessed or acquired by an unauthorised person, Venuo notifies the Venue immediately, and in any event within 24 hours of becoming aware, by email to the Venue's contact addresses on its account, and by phone as well where the Venue has given Venuo a number for this purpose. The notice says, as far as known, what happened, the categories and approximate number of people and records affected, the likely consequences, and what Venuo has done and will do; Venuo updates it as it learns more.

7.2 The Venue, as responsible party, notifies the Information Regulator and the affected enquirers as soon as reasonably possible after the discovery (s.22), taking into account the legitimate needs of law enforcement and what is needed to find out how far the compromise went and to restore the system. POPIA sets no fixed number of hours. Venuo helps the Venue prepare those notices, and gives it draft wording.

7.3 Venuo may stop the Desk's sending while it investigates, if that reduces the harm.

7.4 Venuo keeps a record of each compromise (when it was suspected, contained and assessed, who was told and when) and gives each affected Venue a short written report within 10 working days after the compromise is contained.

7.5 For its own records (clause 1.2), Venuo notifies the Information Regulator and the people affected itself, as s.22 requires.

8. Requests from enquirers (POPIA s.23–25)

8.1 When an enquirer asks, in a message to the Desk, to see, correct or delete their information, objects, or asks for no further messages (STOP), the Desk never answers it automatically: it becomes a draft for the Venue (where there is a reply to make) and an alert to Venuo, whether it is the enquirer's first message or a reply. The Venue answers the enquirer.

8.2 If a request reaches Venuo directly, Venuo only acknowledges it and forwards it to the Venue within 2 working days.

8.3 On the Venue's written instruction, Venuo exports, corrects or deletes one enquirer's data within 5 working days and confirms in writing when that is done. Venuo does this by hand: it first finds what is held, and a wrong email address is not edited, because the address is the person's identity in the Desk: Venuo deletes the record and the person writes again.

8.4 On the Venue's written instruction, Venuo removes one person's opt-out record (clause 6.4) within 5 working days.

8.5 The Venue answers the enquirer within 30 days. Venuo logs each request it handles (when, which Venue, what kind, when completed), without the person's details.

9. The Venue's duties

The Venue:

• (a) has a lawful basis to process its enquirers' information (s.11); answering their own enquiry is the expected basis;
• (b) publishes a privacy notice that covers the Desk (Annex C is wording it may use), and keeps its form or site notice accurate;
• (c) keeps its profile, prices, blocked dates and viewing times accurate;
• (d) doesn't use the Desk for marketing or for messages to anyone who hasn't written to it;
• (e) has its own Information Officer registered with the Information Regulator (s.55);
• (f) honours an enquirer's request to stop: it does not send that person marketing, and approves a reply to them only to answer their request;
• (g) answers requests under s.23–25 that come to it, and passes to Venuo any it needs help with;
• (h) tells Venuo at once of any compromise it learns of;
• (i) does not use the Desk to send or collect a child's information or special personal information on purpose.

10. Information and audit

On reasonable written request (at most once a year, or after a compromise) Venuo gives the Venue this agreement's annexes as current, a summary of its security measures, a list of its sub-operators and the terms it holds with each, and the parts of its audit log that concern the Venue. If the Venue still has reasonable concerns after that, it may audit Venuo's compliance with this agreement remotely, on 30 days' notice, at its own cost, during working hours, without access to any other venue's information.

11. Liability

11.1 Each party's total liability under this agreement is limited to the fees the Venue paid Venuo in the 12 months before the claim, and at least R999. The limit does not apply to gross negligence, fraud or wilful misconduct, or to liability the law does not allow to be limited.

11.2 Each party is responsible for its own breaches of POPIA. Venuo is not liable for the Venue's instructions or its privacy notice; the Venue is not liable for Venuo's breaches of clauses 2–8.

11.3 Indemnities. The Venue indemnifies Venuo against claims by a third party, including a regulator's penalty, that arise from the Venue's instructions, from the Venue having no lawful basis for what it told Venuo to do, or from its privacy notice. Venuo indemnifies the Venue against claims by a third party, including a regulator's penalty, that arise from Venuo's breach of clauses 2–8. Each indemnity is subject to clause 11.1, and the indemnified party must tell the other promptly, let it handle the claim and help it.

12. Term, end, law and acceptance

12.1 This agreement starts when the Venue accepts it and lasts while Venuo processes the Venue's enquirers' information, and until clause 6.2 is complete. Clauses 2.3, 6.2, 6.4, 11 and 12.3 survive its end.

12.2 No real enquiry before acceptance. The Desk does not handle the Venue's real enquiries until this agreement is accepted.

12.3 South African law applies; the Magistrate's Court for the district of George, or the Western Cape High Court.

12.4 Acceptance. The Venue accepts by ticking that its representative is authorised, typing their full name and capacity, and pressing the button on the payment page that takes the Venue to payment (or, for a Venue accepting an updated version, the Accept button on the page we link in our email). The parties agree that this is a written agreement (ECTA s.12) and that the Venue's acceptance is a valid electronic signature (ECTA s.13). Venuo keeps a record of the text accepted (its version and fingerprint), the name, capacity and company typed, the time, and the IP address and browser used (clause 6.2).

12.5 Changes. Venuo proposes a new version by email at least 14 days before it takes effect, and the Venue accepts it in its dashboard (the Billing page links to it). Until the Venue accepts, the version it accepted keeps applying. If Venuo ends the service because the Venue didn't accept a change that the law requires, Venuo refunds the payment for the month in which it ends, in full. This version has not yet been reviewed by Venuo's attorney; when the reviewed version is ready, the Venue is asked to accept it the same way, and anything the attorney changes ships as a later version.

12.6 Ending. Either party may end the service as the terms of service say. The Venue may stop at any time. Venuo may end it on 5 working days' notice if the Venue breaks clause 9 or the terms, and at once if the law requires.

12.7 Notices go by email, to the Venue's account address and to [email protected].

Annex A: the processing

• Data subjects: people who enquire with the Venue through its web form or enquiry email (couples, their families and planners, function organisers); the Venue's own people who use the dashboard.
• Personal information: name, email address, phone number if given, event type, event dates, guest count, budget, questions and the full message text of each message in the conversation, including the enquirer's later messages; the replies and drafts; the lead's status, history and special-request note; viewing appointments (time, status, calendar invite) and changes to them; an enquirer's request for no further messages (the opt-out record, clause 6.4); delivery events. The Venue's people: name, email address, sign-in and session records.
• Special or children's information: not requested, not noted and not echoed (clause 3.2(e)). It may appear in an enquirer's own words.
• Automated processing: an AI model reads each message to sort it. The Desk then decides by fixed rules whether to answer or make a draft, and builds any reply from the Venue's own wording. No decision with legal effect on the enquirer, or that significantly affects them, is made by automated means alone: whatever is doubtful goes to the Venue. Automatic sending is the Venue's choice; if the Venue switches it on during its first days, the audit log records who did so, when, and which warning was shown (13 months).
• Purpose: to answer each enquirer's messages, offer and set viewings, keep the Venue's lead list, drafts and stats, and send the Venue its notices and daily summary. The dashboard's Ask box answers the Venue's questions from the Venue's own data only; the question text isn't stored.
• Operations: receive, store, read and classify (an AI model call), decide from fixed rules, compose from the Venue's wording, send, log, and delete on schedule.
• Retention: clause 6.1 (90 days for message text; 90 days after the latest message or viewing for the lead record, its history and viewings; 13 months for metadata with no message text).
• Duration: the service, then clause 6.2.

Annex B: sub-operators and countries

• Cloudflare, Inc. receives the forwarded mail (Email Routing), runs the Desk and the dashboard (Workers), stores its database (D1) and keeps technical logs of the Worker (codes and counts only). All of Annex A. A United States company; the database is in the European Union.
• OpenRouter, Inc. routes the model call. The conversation being answered, and for the Ask box the numbered lead summaries without names, email addresses or messages. United States.
• Amazon Web Services (Amazon Bedrock) and Google Cloud (Vertex AI), reached through OpenRouter, run Anthropic's Claude models under zero data retention: Claude Haiku 5.5 (the Fast tier, the only setting offered) and Claude Sonnet 5.5 (when Haiku 5.5 fails twice on one message). For a Venue whose desk started before 27 October 2026 and that Venuo keeps on its earlier models, Claude Haiku 4.5 and Claude Sonnet 5 (when Haiku 4.5 fails twice on one message) instead, until Venuo moves it with the notice in clause 4.2. The conversation being answered. OpenRouter picks the region within these two hosts; we do not pin one, and expect the United States.
• Resend, Inc. sends the replies, invites and the Venue's emails from desk.venuo.co.za and keeps delivery logs. Recipient address, message content, delivery events. Sent from Ireland; Resend, Inc. is a United States company, and its logs are kept for up to 30 days.
• Google hosts Venuo's own mailboxes ([email protected] and the operator mailbox). They receive Venuo's operational alerts (codes, venue names and counts, never an enquirer's name or message) and whatever a Venue or an enquirer writes to Venuo directly (clause 8.2). Not a sub-operator for the Desk's enquiries.

Paystack takes the Venue's payments and, for automatic renewal, keeps the card and charges it for Venuo. Meta (Facebook and Instagram) receives ad-measurement events about the Venue's own people, only when they consented. Both are Venuo's own processing as a responsible party, not processing for the Venue, and neither receives an enquirer's information.

Annex C: wording for the Venue's own privacy notice

Venuo gives this paragraph for the Venue to add to its privacy notice, adapt to its own words, and keep true. A short line for a web form follows it.