Sonar · Last updated 29 October 2026
This agreement sets out how HBUFC Trading (Pty) Ltd processes personal information, including special personal information such as health information, for each business that uses Sonar. It is the written contract that section 21 of the Protection of Personal Information Act 4 of 2013 (POPIA) requires between a responsible party and its operator.
Version 2026-10-29. A business accepts it by ticking the box when it signs up or when Sonar asks, or by signing it in Sonar under My account.
| Responsible party (the business) | Operator | |
|---|---|---|
| Name | The business that accepts or signs this agreement | HBUFC Trading (Pty) Ltd, trading as Sonar by Whats-Hub |
| Registration | - | 2021/484119/07 |
| Address | - | 3 Scott Road, Hout Bay, Western Cape, 7806 |
| Information officer | - | privacy@whats-hub.co.za |
1.1 Words defined in POPIA, such as personal information, special personal information, processing, responsible party, operator, data subject and Regulator, have the same meaning here.
1.2 In this agreement:
2.1 The operator processes business data only to provide the Service to the business. That means sending and receiving messages, storing chats, contacts and files, recording consent and opt-outs, transcribing voice notes, writing AI drafts or replies where the business uses AI, and keeping the Service secure and working.
2.2 Annex A describes the data subjects, the kinds of personal information and the processing.
2.3 The operator does not use business data for its own purposes, sell it, use it for its own marketing, or share it with other Sonar customers. It may keep de-identified counts, which identify no one, to run and improve the Service.
3.1 The operator processes business data only with the business's knowledge or authorisation (section 20(a)). The business's instructions are its use of the Service as designed, the settings it chooses, and its written requests.
3.2 The operator treats business data as confidential and does not disclose it unless the business agrees or the law requires it (section 20(b)). If the law requires a disclosure, the operator tells the business first, unless the law forbids that.
3.3 Only one named person, the operator's technical lead, has access to the servers and databases that hold business data. That person is bound by confidentiality and opens the business's chats only when the business asks for help or to investigate a fault. The operator will tell the business in writing before giving anyone else that access.
3.4 When investigating a problem or support request for the business, the operator may use AI tools from Anthropic (Annex C).
3.5 If the operator believes an instruction from the business would break POPIA, it will tell the business and need not follow it.
4.1 The business is responsible for having a lawful basis to process any special personal information, under sections 26 to 33 of POPIA (section 32 for health information), and for telling people how their information is used.
4.2 The operator processes special personal information only as part of the Service and under this agreement. It does not analyse it for any purpose of its own.
4.3 Voice notes are transcribed on the operator's own server in South Africa. Audio and transcripts are not sent to an outside service to be transcribed.
4.4 Sonar's AI is optional, and the business controls it for each WhatsApp number with the "AI on this number" setting (Off, Drafts for you to check, or Answers by itself). When the AI writes a draft or reply, the recent messages in that conversation and the business's bot instructions are sent to Anthropic (Annex C). On a number set to Off, chats are not sent to Anthropic.
4.5 If the business uses AI to reply to a specific person about their health (symptoms, test results, a diagnosis, medication or treatment, or whether to seek care), legal position, money, insurance, job or housing, it must:
4.6 AI drafts can be wrong. The business remains responsible for its professional judgement and for every reply it sends.
5.1 The operator keeps appropriate, reasonable technical and organisational measures in place to prevent loss of, damage to, unauthorised destruction of, and unlawful access to business data, as sections 19 and 21(1) require. Annex B lists the current measures.
5.2 The operator reviews these measures regularly, updates them as risks change, and will not reduce the overall level of protection during this agreement.
5.3 The business is responsible for the security of its own accounts and devices: who it adds to its team, keeping passwords and API keys secret, switching on two-step sign-in for every team member, and the phones and computers its staff use.
6.1 The business authorises the operator to use the sub-operators listed in Annex C.
6.2 The operator uses only sub-operators bound by written data-protection terms that require them to keep business data secure and confidential and to use it only to provide their service. The operator remains responsible to the business for what its sub-operators do with business data.
6.3 The operator will give the business at least 30 days' notice, by email to its owners, before adding or replacing a sub-operator that processes business data. If the business objects on reasonable data-protection grounds and the parties cannot resolve it, the business may end this agreement and its use of the Service without penalty.
6.4 Messages are delivered by Meta. The business's WhatsApp Business account, and any Facebook Page or Instagram account it connects, is held with Meta under Meta's own terms, which the business accepted when it connected it.
7.1 The operator stores business data in South Africa: on its main server in Cape Town, and on its backup and restore server in Johannesburg (Annex C). It will not move that storage outside South Africa without the business's prior written agreement.
7.2 Business data leaves South Africa only in these cases:
7.3 For these transfers the operator relies on the sub-operators' binding data-protection terms (section 72(1)(a)). The business decides whether to use AI. It may also rely on consent (section 72(1)(b)), and its privacy notice should say that some messages may be processed outside South Africa.
8.1 If the operator has reasonable grounds to believe that business data has been accessed or acquired by an unauthorised person, it will notify the business immediately, as section 21(2) requires, and in any case within 24 hours of becoming aware of it.
8.2 The operator will notify the business's owners by email, and its information officer where the business has given one, and will phone or WhatsApp them where it has a number. The notice will say, as far as is then known:
Details not yet known will follow as soon as they are.
8.3 The operator will take reasonable steps to contain and fix the compromise and preserve evidence. It will help the business notify the Regulator and affected people under section 22, and will not notify them itself unless the business agrees or the law requires it.
8.4 The operator keeps a record of every security compromise that affects business data.
9.1 The business can view, correct, export and delete its contacts and messages in the Service itself. Deleting a contact deletes their files and irreversibly anonymises their identifying details.
9.2 Opt-in and opt-out requests are recorded with when and how they were made, and STOP and START replies are acted on automatically.
9.3 If a data subject contacts the operator about business data, the operator will pass the request to the business within 2 business days. It will not answer the request itself, other than to acknowledge it, unless the business asks it to.
9.4 The operator will give the business the help it reasonably needs to answer requests for access, correction, deletion or objection (sections 11, 23 and 24), to answer the Regulator, and to complete its own POPIA assessments.
10.1 While this agreement runs, messages and contacts are kept for as long as the business keeps its account. Files in chats (photos, documents, voice notes and videos) are deleted automatically 12 months after they were sent.
10.2 The business may ask the operator in writing to delete specific business data at any time. The operator will do so within 10 business days and confirm it in writing.
10.3 When this agreement ends, the operator will, if the business asks within 30 days, give it a copy of its business data in a common format. The operator will then delete business data from the Service within a further 30 days.
10.4 Backup copies are kept in South Africa and used only to restore the Service. They are deleted as they expire, within 6 months.
10.5 Copies held by sub-operators are deleted on their own schedules: Meta within 30 days, and Anthropic within 30 days (or up to 2 years for a conversation its safety systems flag).
11.1 The business will:
12.1 On written request, the operator will give the business the information it reasonably needs to check that the operator complies with this agreement. That includes the current security measures, the current sub-operator list and answers to a written questionnaire.
12.2 The operator will answer within 10 business days. The business may ask once a year, and again after any security compromise.
12.3 The operator will cooperate with any investigation by the Regulator that concerns business data.
13.1 Each party is responsible for its own compliance with POPIA and this agreement. Liability for a breach of this agreement is as set out in the Sonar Terms of Service, except that nothing in either limits liability that the law does not allow to be limited.
13.2 This agreement applies from the date the business first used the Service, and lasts for as long as the operator processes business data. Clauses 3, 8, 10 and 13 continue after it ends, for as long as the operator holds any business data.
13.3 When the operator publishes a new version, it applies to a business once the business accepts or signs it in Sonar; until then the version it last accepted applies. Any other change must be in writing and agreed by both parties.
13.4 Notices to the business go to its owners' email addresses in Sonar, and to the information officer it names when signing. Notices to the operator go to privacy@whats-hub.co.za.
13.5 This agreement is governed by the law of the Republic of South Africa. Accepting or signing it in Sonar makes it a written contract concluded electronically.
| Data subjects | Customers and other people who message the business or whom it adds as contacts; visitors to its website chat; the business's team members who use Sonar |
| Personal information | Phone number or WhatsApp user ID, name, profile name and photo, tags and notes, consent and opt-out records, message content (text, photos, documents, voice notes, videos), voice-note transcripts, delivery status; for team members, name, email address and sign-in records |
| Special personal information | Any that people or the business share in messages, such as health information |
| Processing | Receiving, storing, displaying, sending, transcribing, drafting replies with AI (only where the business uses it), exporting, backing up and deleting |
| Where | South Africa (Cape Town and Johannesburg), plus the transfers in clause 7 |
| How long | As set out in clause 10 |
| Access to servers | One named person; sign-in with SSH keys only, no password or direct root sign-in; repeated failed sign-ins blocked automatically |
| Network | Firewall open only to web traffic and SSH; web application firewall in front of the Service |
| In transit | HTTPS only, with HSTS |
| Sign-in to Sonar | Passwords stored only as salted hashes; two-step sign-in with an authenticator app for every user, its key stored encrypted and backup codes stored as hashes |
| Secrets | Meta access tokens and other secrets encrypted at rest |
| Separation | Each business's data kept to its own account; owner, admin and member roles; owners can limit a member to certain numbers or tags; API keys work only for their own business |
| Data kept in South Africa | Voice notes transcribed on the operator's own server; usage analytics mask contacts, messages, account details and form entries before anything leaves the browser |
| Retention | Chat files deleted after 12 months; deleting a contact deletes their files and anonymises their details |
| Backups | A copy of the database every minute, and nightly encrypted backups that the main server cannot change or delete, on the Johannesburg server |
| Change control | Every change goes through version control, review and automatic tests before release; errors alert the technical lead |
| Sub-operator | What it does | Where | Business data it receives |
|---|---|---|---|
| HostAfrica | Hosts the main server | Cape Town, South Africa | All business data, stored |
| Microsoft (Azure) | Hosts the backup and restore server | Johannesburg, South Africa | Copies of business data |
| Meta Platforms | Delivers WhatsApp, Messenger and Instagram messages | International, with a South Africa storage option for WhatsApp (clause 7.2) | Phone numbers or account IDs and message content; WhatsApp content kept up to 30 days |
| Anthropic | Writes AI drafts and replies, only where the business uses AI; AI tools in support (clause 3.4) | United States | Recent messages in the conversation and the business's bot instructions; deleted within 30 days, or up to 2 years if its safety systems flag a conversation |
| Microsoft (Microsoft 365 and Clarity) | Sends service emails; records how team members use the dashboard, with contacts, messages, account details and form entries masked | International | Team members' names and email addresses; with reply alerts on, the waiting customer's name, number and start of their last message |
| Infobip | Sends service emails when Microsoft 365 can't | International | Team members' email addresses |