Operator (Data-Processing) Terms
How we process your financial data on your behalf. These terms form part of, and are subject to, the Terms of Service.
1. Roles
You (the merchant) are the responsible party; Crosspost (Gainly) is the operator, processing only on your documented instruction, given through your use of the service: connecting Zapper and Xero, choosing your settings, and enabling posting.
2. Scope & purpose
One purpose only: to read your Zapper settlement data and post the matching entries into your Xero. We do not use your data for any other purpose, sell it, share it for marketing, or use it to train any model.
3. What we process
Connection credentials (encrypted), your settings, and activity summaries. We do not process or storeyour customers’ card data, bank logins, or a copy of your Xero ledger.
4. Sub-processors
Trusted providers for cloud hosting and infrastructure, and a payment provider for billing; your Xero is your own. A current list is available on request. We give reasonable notice before adding or replacing a sub-processor.
5. Security
Strong, industry-standard encryption for credentials at rest; credentials are never stored in plain text or in logs; no card data; minimal Xero permissions; and restricted production access.
6. Data location
Reputable global cloud infrastructure; your data may be processed outside South Africa under appropriate safeguards, consistent with our Privacy Policy.
7. Retention, return and deletion
While your account is active, we retain data to run the service. On termination, we delete or anonymise it within a reasonable period (typically 30 days), except records we are legally required to keep. We will help you export your data on request before deletion. Your Xero ledger is left untouched.
8. Breach
On becoming aware of a compromise affecting your personal information, we notify you without undue delay and give you what you reasonably need to meet your own POPIA obligations; we cooperate to investigate and remediate.
9. Assistance
We provide reasonable assistance with data-subject requests and your POPIA obligations and, on reasonable request, information to demonstrate our compliance.
10. Operator duties
We process only with your authorisation, keep your data confidential, use it for no other purpose, and tell you if we believe an instruction would breach POPIA.
11. Governing law
These terms are governed by the law of the Republic of South Africa.