Master Service Agreement (MSA)

1. Introduction

1.1 Purpose and Application

This Master Service Agreement (“MSA”) governs the provision of services by CyberJo (Pty) Ltd (“CJO”) to its clients (“Client”). Further details regarding the incorporation of terms, order of precedence, and operational communications are set out in Section 9.

2. Definitions

In this MSA, the following terms bear the meanings assigned to them below:

3. Service Model

3.1 Service Model

3.1.1 Due to the evolving nature of IT and cybersecurity, and the need to manage, maintain, monitor, service, and change assets, CJO does not sell fixed outcomes (e.g. a "finished server" or a "completed website"). CJO sells VU.

3.1.2 The amount of VU the Client purchases is added to the Client's VU pool for CJO to use while delivering services. VU is allocated based on the Client's defined requirements and priorities received via the Annexures and written instructions or requests.

3.1.3 Any document issued by CJO with a related title such as "Quote," "Proposal," or "Estimate" is strictly an operational roadmap and a good-faith forecast of the size of the VU pool required to achieve the Client's objectives. It does not constitute a guarantee of a fixed outcome.

3.1.4 CJO operates as a MSP. The Client will delegate responsibility for specified ICT functions to CJO, which delivers services remotely. The basis of the engagement is set out in a SO, the accepted Quote, and the Annexures. In most cases it is encouraged that the Annexures are maintained between CJO and the Client to ensure clear roles and responsibilities. Where CJO has a smaller role or only a few select responsibilities, the details contained on the SO or accepted Quote will serve as the reference.

3.2 Service Delivery Modes

3.2.1 Prepaid VU Pool

3.2.1.1 The Client engages with CJO with specific requirements. Where applicable, CJO will send a Quote showing the breakdown of the roadmap and the VU allocation, setting out how the VU pool was calculated on the line items.

3.2.1.2 Each line item is a best-effort estimate, based on CJO's experience and industry standards, of the amount of VU required. Line-item descriptions are priority guidelines and not guarantees of final delivery.

3.2.1.3 The Client approves the Quote and is invoiced for the approved Quote in accordance with clause 10.2. Work can commence as soon as the requirements are received from the Client.

3.2.1.4 For non-standard and custom work where a more accurate outcome quote is needed, CJO will provide a Quote for a Discovery/Scoping Phase. After scoping, CJO will provide a Quote to implement, or the Client may engage in a different service delivery mode.

3.2.1.5 If the purchased VU pool is completely depleted before all roadmap items are complete, CJO shall have no further obligation to deliver services until the pool is replenished. Any unspent prepaid VU remains available subject to clause 3.2.1.6. To continue receiving services, the Client must purchase additional VU, switch to the Top-up service mode, or subscribe to an alternative CJO package.

3.2.1.6 Unused VU purchased for a Prepaid VU Pool expires 365 calendar days after the date of purchase. CJO will record the purchase date and expiry date for each purchase. Expiry and non-refundability are subject to any rights that cannot lawfully be excluded or limited, including applicable rights under the Consumer Protection Act 68 of 2008 (CPA).

3.2.2 Top-up (12 Month Contract)

3.2.2.1 The Client's requirements are communicated progressively, and support requests are sent through by the Client as needed.

3.2.2.2 The Top-up mode allows the VU pool to go up to a -2 VU balance. When the VU pool is depleted, the Client is notified to top up and given the option to purchase either a minimum 3 VU bundle, a 5 VU bundle, or a 10 VU bundle at the pricing level they signed up on. The payment terms for top-up bundles are set out in clause 10.3.

3.2.2.3 If the VU pool reaches -2 VU and the Client has not purchased new VU, CJO shall have no further obligation to deliver services until the pool is replenished. VU expiry on termination is governed by clause 3.2.2.7.

3.2.2.4 CJO will not carry out preventative maintenance or security audits in a proactive manner in order to preserve VU, unless explicitly requested by the Client.

3.2.2.5 The Client is responsible for ensuring that sufficient VU remains available in the VU pool and for communicating its requirements timeously so that preventative maintenance, security audits, and other essential services can be scheduled and delivered. Where the Client fails to do so, whether due to VU pool constraints, a lack of communication, or a lack of oversight, CJO shall not be liable for any risks, vulnerabilities, incidents, system degradation, loss, or damage that arise from the non-performance or deferral of such services.

3.2.2.6 The Client acknowledges that deferred maintenance or security measures may expose the Client's systems and data to increased risk. CJO's obligations to deliver services are limited to the VU available in the Client's VU pool, and CJO shall not be in breach of this MSA where essential services could not be performed due to VU pool constraints or the Client's failure to provide timely communication and oversight.

3.2.2.7 On termination or expiry of a Top-up contract, any unused VU allocated or purchased under that contract expires and is not refundable, subject to rights that cannot lawfully be excluded or limited. Expiry does not extinguish any amount owed to CJO, including any negative VU balance or other accrued debt.

3.2.3 Service Package Subscription

3.2.3.1 On a Service Package Subscription, an agreed amount of VU is automatically loaded onto the VU pool of the account, and CJO takes on the assigned role and responsibilities based on the Annexures or as agreed in writing.

3.2.3.2 The Client is invoiced monthly in accordance with clause 10.4.

3.2.3.3 Service Package Subscriptions are available on a Month-to-Month or Annual (12 month) basis, with longer term subscriptions available. 12 month and longer term subscriptions automatically convert to Month-to-Month subscriptions when the term is over.

3.3 Available VU for Service Package Clients

3.3.1 For Service Package clients, the total VU they can use in any given month is not the amount available in their active VU pool balance; it works differently. To enable CJO to deliver its services effectively to all clients, to allow for future VU to be used, and to prevent clients from overloading CJO's capacity by demanding all the VU in the pool built up over months, CJO ties usage to a VU health score system. The system also provides insight into whether the contract needs to be upgraded or downgraded.

3.3.2 The VU health score is calculated by taking the total amount of VU purchased to date and dividing it by the VU in the pool.

3.3.3 The VU available for use in any given month is the VU the Client purchases each month multiplied by 1.5, provided the Client has a health score of more than 1.0. If the Client's health score is less than 1.0, the VU available is the VU the Client purchases each month multiplied by the VU health score.

3.3.4 If CJO has capacity and the Client has VU in their pool, CJO may choose to continue delivering services.

3.4 Service Tiers and VU Conversion

Every task is placed into one of four tiers, from basic, routine support (Tier 1, handled by entry-level staff) up to expert and strategic work (Tier 4, handled by senior specialists). The higher the tier, the more skilled and experienced the person required, but each Value Unit (VU) also covers less time, because that expertise is worth more.

Think of it as a scale of the skill and experience needed: the further along a task falls, the more senior the person handling it and the faster a VU is used up. The bar below shows how the tiers step up.

In short: the higher the tier, the more senior and experienced the person assigned to the work, and the faster a VU is used up. Tier 1 is handled by entry-level staff; Tier 4 only by principal-level experts.

3.5 Value Unit (VU) and VU Pool

3.5.1 VU purchased by the Client is added to the VU pool. VU allocated against an invoice is held until the invoice is paid, and is activated when payment is received, provided the account is not otherwise subject to a hold under this MSA. The Client must pay each invoice by its due date to ensure that the associated VU is available when required.

3.5.2 Any active VU in the pool will be placed on hold if an account is overdue by more than seven calendar days.

3.5.3 VU in the pool that is on hold cannot be used for service delivery. Once the Client's overdue account is settled, the VU is immediately activated and available for use.

3.5.4 Service delivery continues while active VU is available in the pool. Once the pool is depleted and no VU is available, service delivery will stop unless CJO authorises an emergency VU loan under clause 3.5.6. To resume standard services, the Client must purchase additional VU or await the next scheduled invoice.

3.5.5 VU purchases are non-refundable, except to the extent a refund or other remedy is required by law, including any non-excludable CPA rights. This clause does not convert expired VU into a cash entitlement.

3.5.6 If the VU pool is depleted or no active VU is available, CJO may, at its sole discretion, authorise an emergency VU loan strictly for a Medium, High, or Critical task reasonably required for immediate business continuity. Any VU placed on hold may be used for that task only if CJO expressly authorises the use. All work performed is charged at the applicable contracted VU rate and recorded against the VU pool. Any resulting negative balance is a deferred payment obligation, not free or discounted work. Subsequent VU purchases will first be applied automatically to clear the negative balance before standard work resumes. The Client must settle the invoiced value of the emergency loan upon securing funding and, in all cases, no later than 30 calendar days after the loan is incurred. CJO will record and notify the Client of the VU and amount incurred.

4. Onboarding Period

4.1 Requirement

The Onboarding Period is required for Clients on standard and full Service Package Subscriptions. It is not required for smaller or limited engagements, such as where CJO operates based on a SO or accepted Quote for a small number of select responsibilities.

4.2 Duration

The Onboarding Period is up to 10 business days, commencing from the Service Commence Date indicated on the Service Order, and may take longer depending on the availability of the Client and how long the Client takes to provide the required information. The purpose of this period is to establish essential operational controls, documentation, and the definitive delegation of responsibilities.

4.3 Information to be Obtained

During this period, CJO will work with the Client to obtain and establish the following:

4.3.1Organisational Structure Annexure: A comprehensive list of the Client's employees, contractors, and relevant third parties, including their specific authorisations. CJO will provide a template for this information, but the Client may supply it in an alternative format.

4.3.2IT Asset Register & Control Annexure: A list of all relevant assets, their purpose, the sensitivity of data stored on them, the primary administrator for each, and a clear indication of whether CJO will receive direct administrative control or must work through an existing administrator.

4.3.3Priority List Annexure: A list of the Client's ICT and cybersecurity objectives, along with their agreed-upon prioritisation.

4.3.4Responsibility Matrix Annexure: The Responsibility Matrix will be finalised and agreed upon through a formal consultation with the Client, detailing the specific roles CJO will fulfill.

4.3.5Governance Documentation: All existing company documentation detailing governance directives, policies, and procedures related to ICT and cybersecurity.

4.3.6Annexure Maintenance: CJO and the Client will review and maintain the Annexures and relevant IT governance documentation approximately every three to six months, or when reasonably required by a material change. This work is subject to sufficient VU being available. If the available VU is insufficient, CJO may request a separate VU allocation before undertaking the review.

4.4 Essential Services

During the Onboarding Period, CJO will only provide essential services upon request that do not rely on the full completion of the above requirements.

4.5 Scope of Essential Services

These essential services include user endpoint support up to the available access level and consultation limited to the information CJO is currently aware of.

4.6 VU Consumption

All labour for these services will still consume VU from the Client's VU pool.

4.7 Completion of Onboarding

Upon the successful completion of the Onboarding Period, the Responsibility Matrix will be officially in effect

4.8 Full Service Delivery

CJO will then commence full service delivery as detailed in the Service Order and must then follow all established protocols, policies, and procedures.

4.9 Client Integration Status

4.9.1 CJO may record and review the Client's integration status as an operational measure of how effectively the Client's personnel use the services and how well CJO understands the Client's systems, people, processes, and responsibilities. For Top-up and Service Package clients, the parties will use reasonable efforts to reach Full Integration within six months of service commencement. Progress depends on the Client's participation, timely information and access, and sufficient VU for the required work; the six-month objective is not a guaranteed outcome.

4.9.2 The status levels are: Full Integration, where relevant Client staff know how to use the agreed services, the Client's systems, staff, and practices are sufficiently documented for service delivery, and responsibilities are clear; Medium Integration, where some staff can use the services and CJO's delivery is generally consistent, but material context, documentation, or role clarity remains incomplete; and Low Integration, where delivery is inconsistent, knowledge is concentrated in selected individuals, and documentation or procedures are materially lacking. CJO may record the status and agreed actions in the service record and review it during Annexure maintenance.

5. General Responsibilities

5.1 CJO Responsibilities (MSP)

5.1.1Service Delivery: CJO is responsible for providing the services detailed in the Service Order with professional diligence and care, acting as a Managed Service Provider (MSP). The responsibility of delivering these services are subject to the Annexures which outlines the agreement with the Client.

5.1.2Remote Support: Deliver all services remotely, as specified in the service model.

5.1.3Personnel & Expertise: Ensure that personnel assigned to tasks possess the appropriate Service Tier expertise (e.g., User Support Agent, Junior Technician, Subject Matter Expert).

5.1.4Data Security and Privacy: Adhere strictly to the Protection of Personal Information Act (POPIA), acting as a data operator, and implementing strict access controls.

5.1.5Issue Resolution: Log all service requests via the ticketing system, even if received through other channels, to ensure they are handled according to service delivery standards.

5.1.6Transparency: Notify the client and receive written approval before proceeding with any client-requested after-hours work, which is charged at double the standard service rate.

5.2 Client Responsibilities

5.2.1Cooperation and Access: The Client must provide CJO with all necessary information, access, and cooperation (e.g., system credentials, clear delegation of responsibility) as outlined in the Annexures, agreed upon in consultations and the Service Order to allow for effective remote service delivery.

5.2.2Value Unit (VU) Purchase: Ensure a positive VU pool and purchase VU as required in advance before services are rendered, as the Client's VU pool is the billing metric consumed by labour for services. The Client understands that service delivery is subject to a positive VU pool.

5.2.3Reporting Protocol: Report all service requests by firstly logging a ticket on the specified Ticketing System. In cases where a ticket cannot be logged understand that one will be logged for them and the logging may consume VU from the Client's VU pool.

5.2.4Critical Issue Reporting: For critical issues, the client must use at least two communication channels in the specified priority order (e.g., email and cellular call; cellular call and WhatsApp).

5.2.5Invoicing and Payment: Pay invoices on or before their due date. VU allocated against an invoice remains on hold until payment is received and is activated in accordance with clause 3.5.1; late payment may interrupt access to VU and service delivery.

6. Pricing

6.1 Base Rate

R800 per VU.

6.2 Application of Base Rate

The Base Rate is charged for, prepaid, once-off, additional, or ad hoc purchases.

6.3 VU Price

The price the Client pays per VU is determined by the Service Order or accepted Quote.

6.4 VAT

All prices are VAT-exclusive and no VAT will be charged, unless CJO becomes obliged to register for VAT in terms of the Value-Added Tax Act 89 of 1991, in which event the applicable rate of VAT will be added to all prices and CJO will issue valid tax invoices. CJO shall notify the Client should it become required to register for VAT.

6.5 Price Increases

CJO may increase its prices once per year by up to 10%. Clients on fixed-term contracts will only receive an increase once their contract term expires. CJO will provide Clients with 30 calendar days' notice before any price increase takes effect.

6.6 Consumer Protection Act

Where the Client is a consumer as defined in the Consumer Protection Act 68 of 2008 ("CPA"), the CPA applies to the extent required by law, including the cooling-off right in section 16 thereof (five business days after signature or receipt of the agreement) and the provisions of section 14 relating to fixed-term contracts. CJO does not exclude any rights conferred on the Client by the CPA.

7. Service Delivery

7.1 Business Hours

CJO’s business operating hours are from 08:00 to 17:00, Monday to Friday.

7.2 Closures

The business is closed outside of these business operating hours, on official South African Public holidays, and closed annually for the 10 calendar days from 24 December until 02 January.

7.3 Remote Delivery

All services are delivered remotely. Site visits are at CJO's discretion and not guaranteed.

7.4 Site Visits and Travel

7.4.1 Site visits are not part of CJO's normal service. Where CJO elects to perform a site visit, the Client is charged for the time it takes CJO to travel to and from the Client's premises. Travel time is logged on the ticketing system separately as a Tier 1 site visit.

7.4.2 CJO will travel outside peak traffic hours to save time and cost to the Client. If the Client insists on travel during peak hours, the Client bears the cost of the additional time on the road.

7.4.3 Where the Client requires regular call-outs, CJO may customise the Service Order to include such call-outs.

7.4.4 CJO may, at its discretion, assist the Client in procuring local technicians in the Client's area to perform the required physical work instead of using CJO's own personnel. CJO may manage such technicians on the Client's behalf. These technicians will invoice the Client directly.

7.4.5 The Client must plan and confirm site-visit arrangements in advance and notify CJO at least one hour before the agreed time of any delay, access issue, or unavailability. Waiting caused by the Client, including a delayed or unavailable contact, consumes VU at the applicable service tier. CJO will wait for up to one hour. If the Client advises, or it is reasonably apparent, that the wait will exceed one hour, CJO may stop waiting and reschedule. The Client remains liable for VU consumed while waiting and for any applicable travel already incurred. A rescheduled visit may incur further travel and labour charges.

7.4.6 While attending the Client's site, CJO technicians may, during periods when they are not actively performing the planned work for that visit, perform remote tasks for other CJO clients. Time spent performing those other-client tasks will not be charged to this Client or deducted from this Client's VU pool. CJO will prioritise the planned work for the site visit and manage its resources reasonably to use onsite time productively and reduce the likelihood of a further call-out; this does not guarantee that all work can be completed during one visit. For this purpose, the Client permits technicians to use electricity, internet connectivity, and a safe, designated workspace that the Client makes available, subject to the Client's reasonable site security, safety, and acceptable-use rules. The technician will not use that access to access the Client's systems or information for another client's work.

7.4.7 A standard site visit is limited to a maximum of two hours at the Client's premises, including time spent waiting under clause 7.4.5. Travel time is additional and is charged as set out in clause 7.4.1. If the planned work cannot reasonably be completed within the two-hour onsite period, CJO may stop work and arrange a further site visit with the Client, which may result in additional travel and VU charges. CJO may, at its discretion, agree to extend the onsite period for a particular visit, subject to resource availability and the Client's approval of any additional VU.

7.4.8 Standard site visits, including the outbound and return travel, are available only during the business hours in clause 7.1 and must be scheduled so that the visit and travel fall within those hours. An after-hours site visit may be arranged only where the Client requests or insists on it, CJO has resources available, and CJO agrees to perform it. Any such visit requires written approval in accordance with clause 7.12 and consumes VU at twice the applicable standard VU consumption rate for the after-hours work and travel.

7.5 Support Guide

Our support guide on how to log tickets, where to send emails, and how to request support can be found at https://www.cyberjo.tech/.

7.5.1 All service requests must be logged via a ticket on the prescribed ticketing system as described in the support guide.

7.5.2 If the client gives a service request via a different channel the support personnel of CJO will log the ticket on the client's behalf.

7.5.3 Requests that are not logged have no basis or assurance that they will be resolved according to CJO's service delivery standards.

7.6 Default Priority and Escalation

All reported tasks default to Low priority unless CJO determines otherwise. To request a higher priority, the Client must report the issue through at least two communication channels, for example a ticket or email and a telephone call or WhatsApp. Until CJO receives the report through two channels, the task may be handled at Low priority and the Low response target may apply. High or Critical security incidents must be reported as such regardless of measured production impact; a production impact below 10% will ordinarily be treated as low impact unless security risk or other material circumstances justify a higher priority.

7.6.1 If email is unavailable, use cellular call and WhatsApp.

7.6.2 If cellular call is unavailable, use email and WhatsApp.

7.7 Prioritisation of Issues

The following table shows how we prioritise issues.

7.8 Response and Resolution Times

7.8.1 Services are rendered on a best-effort basis. CJO responds to requests as soon as reasonably possible. Simultaneous demand from Clients can be unpredictable. The times set out in clauses 7.8.3 are the operational standard. CJO aims never to fall below this standard.

7.8.2 Quick Tier 1 or Tier 2 tasks taking under five (5) minutes, such as password resets, brief telephone calls, or short remote support, are dealt with apart from the priority levels above. Such tasks logged at Low or higher priority may be escalated to the quick response priority level. Subject to resource availability during business hours, they are typically resolved promptly, though this clause sets no separately measured response standard. Escalation requires a known, authorised Client contact to telephone the office and, if the call is unanswered, to send a WhatsApp. If resources are unavailable, the task is handled at its designated priority.

7.8.3 The response times and target times for resolution during business hours are recorded in the following table:

7.9 Priority Support Add-on

CJO offers a Priority Support add-on that halves the target response and resolution times set out in the table above and places the Client at the front of the service queue ahead of clients who do not have Priority Support. The add-on is only available to Service Package clients and adds 30% to the Client's subscription.

7.10 Targets Not Guaranteed

The target response and resolution times set out in the table above are targets only. They cannot be guaranteed beyond what is possible within CJO's service delivery constraints and system limitations. CJO does not warrant that the services will be uninterrupted or error-free, and accepts no liability for any loss arising from interruptions beyond its reasonable control.

7.11 Voluntary After-Hours Work

CJO may choose to carry out tasks after its business operating hours at its personnel's own discretion. If done voluntarily by CJO, all service rates remain unchanged.

7.12 Client-Requested After-Hours Work

If after-hours work is requested or insisted upon by the Client, CJO will only do so if it is reasonably possible to make resources available. In that case personnel will:

7.12.1 Notify the client that after-hours support is charged at double the standard service rate.

7.12.2 Proceed only after receiving written approval from the client.

7.13 Out-of-Hours Responses

CJO will respond outside business hours only for high or critical security and production incidents that:

7.13.1 Have alerts configured, or

7.13.2 Are reported directly by a manager or director.

7.14 Out-of-Hours Response Time

Response times for the above mentioned case may be up to 8 hours.

7.15 Independent Contractors and Vendors

CJO may use independent contractors and third-party vendors to deliver the services, provided that such providers operate at the standards agreed in the Service Order and the MSA and do not exceed the set rate.

7.16 Incident Response Framework

7.16.1 This framework applies to cybersecurity incidents and to business continuity and disaster recovery (BCDR), and describes CJO's operational standard for those services. Unless a different level is expressly agreed in the Service Order, the Client is at Level 1. CJO will discuss progression to a higher level as the Client's information-security risk, criticality of its systems, or need to provide information-security assurance to its own clients increases. Levels 2 and 3 require the Client to approve and fund the required systems, configuration, monitoring, VU implementation, and ongoing maintenance. The framework and its targets do not guarantee that an incident will be detected, contained, or recovered within a stated period, or that any system will remain continuously available.

7.16.2 The following are operational targets only, subject to clause 7.10, the agreed service scope, business hours or separately purchased coverage, availability of third-party systems, backups, connectivity, Client cooperation, and the necessary authorisations. The Service Order must identify any monitoring or out-of-hours coverage included. These targets do not override clause 7.14 unless the Service Order expressly provides otherwise.

7.16.3 The Client is responsible for assessing its business and information-security risks, determining and maintaining an incident-response level it considers acceptable, and communicating that selection to CJO for recording in the Service Order or other written service record. CJO may recommend a higher level as risks or the Client's assurance obligations change, but the Client remains responsible for approving and funding the level and associated implementation. At Level 2, within the agreed scope and available VU, CJO will use reasonable efforts to implement or maintain at least weekly backups of identified critical systems and appropriate detection and response measures where technically and operationally practicable, together with applicable recovery plans and restoration procedures. At Level 3, where the Client identifies mission-critical software or systems or a high information-security risk, the Client must provide funding for the agreed security controls, monitoring, backup, recovery, and maintenance needed to support its security and continuity objectives. CJO and the Client will collaborate to scope and implement the Level 3 measures, with the Client providing timely decisions, access, licences, and resources. Neither party warrants uninterrupted uptime or successful recovery.

7.17 Incident Risk Acknowledgement

7.17.1 By selecting or remaining at a level, the Client acknowledges the residual risks associated with that level. The selection and any requested exceptions should be recorded in the Service Order or other written service record. This acknowledgement does not waive any right or remedy that cannot lawfully be waived.

7.17.2Level 1 risks: By selecting or remaining at Level 1, the Client accepts the risk of not having continuous detection and response from CJO. An attack outside business hours may remain undetected and spread before the next business cycle; an attacker may remain in the environment and access or exfiltrate data before discovery; manual or Client-managed backups may be unavailable, incomplete, or too old to prevent substantial data loss; and delayed discovery or notification may increase the Client's regulatory and operational exposure, including under POPIA. CJO does not provide continuous detection or response at Level 1.

7.17.3Level 2 risks: Scheduled reviews may not identify an incident until the next review, leaving time for damage to continue; incidents arising outside contracted business hours, including weekends and public holidays, may await the next covered period; and tools primarily based on known indicators may not identify novel malware or malicious use of legitimate system tools.

7.17.4Level 3 risks: EDR may isolate an infected device automatically within the applicable containment target, but complex threats requiring engineer-led investigation or clean-up may take approximately one to two hours for an initial human response during contracted coverage, and longer to resolve. New or highly sophisticated vulnerabilities or attack techniques may evade controls until detection content or vendor updates become available. No security control guarantees prevention, detection, or recovery.

8. Security, Data and IP Protection

8.1 Client Policies

The Client shall maintain comprehensive internal policies, including an Information Security Policy, Incident Response Policy, Acceptable Use Policy (AUP), and a Business Continuity and Disaster Recovery (BCDR) Plan (or functional equivalents). CJO agrees to adhere to these policies during the term of this Agreement.

8.2 CJO Standard Policies

Where the Client does not have the aforementioned policies in place, CJO’s standard policies will govern. In such cases:

8.2.1 CJO will consult with the Client regarding any procedures that may incur additional costs or operational risks.

8.2.2 CJO will collaborate with the Client throughout the engagement to assist them in establishing their own formal policies. The scope of this assistance will be defined in a separate Statement of Work (SOW), and the Priority List annexure will be updated accordingly to reflect the delivery of these policies.

8.2.3 A Client on a Standard or Full Service Package may separately engage CJO to assist with outsourcing its IT department and governance functions. If the Client wishes to adopt CJO's standard policies as its own, that adoption must be expressly agreed in writing and documented in the Service Order or SOW. The Client remains responsible for its own legal and regulatory obligations, approvals, and decisions, and any implementation or maintenance work consumes VU unless otherwise agreed.

8.3 Security Frameworks

In addition to the above, CJO shall use commercially reasonable efforts to align its service delivery, policies, and procedures with the principles of the NIST Cybersecurity Framework (CSF), the CIS Critical Security Controls, and the Incident Response Framework in clauses 7.16 and 7.17, as recognised practices for risk management and operational security. This alignment is not a certification, audit opinion, or guarantee of compliance or security.

8.4 POPIA Compliance

CJO adheres strictly to the Protection of Personal Information Act (POPIA):

8.4.1 Acts as a data operator when accessing client systems.

8.4.2 Does not copy or transfer client-stored personal information.

8.4.3 Implements strict access controls and data security measures.

8.4.4 Limits access to authorised personnel only.

8.4.5 Processes personal information only for the purposes of delivering the services and in accordance with the Client's documented instructions; and

8.4.6 Notifies the Client as soon as reasonably possible after becoming aware of a security compromise affecting the Client's personal information, so that the Client can assess and fulfil its notification obligations under section 22 of POPIA.

8.5 Client Privacy

CJO treats Client information accessed in delivering the services as confidential and respects the privacy of the Client, its personnel, and other data subjects:

8.5.1 CJO limits access to Client information to what is reasonably necessary for the authorised service purpose.

8.5.2 CJO personnel will not intentionally inspect, read, or assess content unrelated to the authorised task, or do so to obtain insider knowledge or out of curiosity. Incidental exposure reasonably necessary to provide support remains subject to confidentiality and applicable data-protection obligations.

8.5.3 CJO does not snoop on Client systems or content. Any access, copying, or handling of information must be reasonably necessary for service delivery, security, troubleshooting, or another purpose authorised by the Client or required by law.

8.6 Intellectual Property and Trade Secrets

CJO warrants its ongoing intention to neither misappropriate nor retain the Client’s IP, trade secrets, or other confidential information beyond the engagement scope.

8.7 Mutual Confidentiality

Both Parties agree to protect each other’s IP and trade secrets. Any information, business methods, or technical data shared during engagements must be kept strictly confidential. Neither Party may use the other’s IP for any reason other than to achieve goals within the scope of authorised agreements between CJO, the Client, and the Client’s authorised affiliates.

8.8 Non-Disclosure

CJO will not disclose Client information to third parties or affiliates, nor consult with them using such data, unless approved by the Client or legally enforced. Access is limited to personnel who strictly require it for the engagement and are bound by equivalent confidentiality terms.

8.9 Confidentiality Exceptions

Confidentiality obligations do not apply to information that was already known to the receiving Party, is publicly available through no fault of their own, is legally received from a third party, or was independently developed without using the other Party's confidential information.

8.10 Data Exchange Platforms

Parties must use official platforms for data exchange. If an alternative secure platform is required, any information shared must be transferred to the official system and erased from the temporary platform as soon as possible.

8.11 Archiving and Deletion

Once the engagement ends and no further services are required:

8.11.1 CJO will securely archive the project case for historical and evidential purposes.

8.11.2 This archive may be stored for a maximum of 7 years.

8.11.3 After 7 years, the project case and all related data will be permanently and securely deleted.

8.12 Remote Access and Communication Channels

CJO renders its services remotely and both parties acknowledge that remote service delivery and the use of communication channels carry inherent security risks. This risk includes, without limitation, the possibility that unauthorised parties may attempt to impersonate CJO or the Client, or may use leaked remote access details in an attempt to gain access to the Client's endpoints and systems.

8.12.1 CJO uses selected remote support software, including AnyDesk, to deliver its remote services, and communicates through specific authorised channels, including email sent from CJO's official domains, being cyberjo.co.za, cyberjo.tech, and cyberjo.on.spiceworks.com. Official communication channels beyond those referred to in this clause are available on the contact page at cyberjo.co.za and the support guide at cyberjo.tech.

8.12.2 CJO only permits permissive remote access to the Client's computers. CJO will contact the Client before connecting, and the Client must accept the connection before access is granted.

8.12.3 CJO cannot ensure the prevention of unauthorised parties impersonating CJO or the Client, or of the Client granting access to unauthorised or random requests, which could result in unauthorised access to the Client's systems.

8.12.4 The Client is responsible for ensuring that it does not change any configuration on its side to bypass the security measures referred to in this clause, and that communications are only received and acted upon through the authorised channels provided by CJO.

9. Governing Documents and Order of Precedence

9.1 Incorporation by Reference

The terms and conditions of this MSA shall only apply to engagements where a Service Order, Quote, Proposal, Statement of Work (SOW), or Task Order explicitly references this MSA. In such cases, the document is considered to have incorporated by reference. Acceptance of that document via signature or electronic means binds the Client to both the specific document and this MSA.

9.2 Amendments and Special Conditions

Where a document sent by CJO indicates that the MSA applies but also includes specific amendments or special conditions, those indicated amendments shall prevail over the standard terms of the MSA. For all other provisions not specifically amended, the MSA remains the governing authority.

9.3 Communication Channels

CJO communicates with Clients through various channels including email, WhatsApp, and the ticketing system. Timelines, estimates, or status updates shared via these channels are for coordination and operational purposes only. They do not overwrite the formal commitments, deadlines, or service levels defined in the MSA or the relevant Service Order.

9.4 Due Dates for Projects

For projects and SOWs, CJO operates based on specific due dates rather than fixed response times. CJO aims to meet these deadlines by dedicating a reasonable and average required amount of time to the task. The Client acknowledges that ancillary updates on these channels do not constitute a breach of contract as long as the formal deadlines in the Service Order are respected.

9.5 Extensions

In exceptional circumstances, CJO will notify the Client of required extensions and propose new dates. The Client must act reasonably when reviewing such proposals or countering with alternative dates. Once an extension is agreed upon via email or WhatsApp, those extended dates shall become the new governing timeline for that specific task. These adjustments are valid only when made by mutual agreement to facilitate project completion or avert a potential breach of contract. In all other cases of conflict between these communications and the MSA, the terms of the MSA shall prevail.

10. Payment

10.1 Basis of Payment

The basis on which the Client pays for services is determined by the service mode selected, as set out in Section 3 of this MSA. The payment terms applicable to each service mode are set out in clauses 10.2 to 10.4, and the general payment provisions apply to all service modes.

10.2 Prepaid VU Pool

10.2.1 The Client is invoiced for the approved Quote, which is due up front. The operational terms of the Prepaid VU Pool mode, including depletion of the pool, are set out in clause 3.2.1.

10.3 Top-up (12 month contract)

10.3.1 VU bundles purchased by the Client are invoiced at the pricing level they signed up on and are due up front. The operational terms of the Top-up mode, including the bundle sizes and the -2 VU balance, are set out in clause 3.2.2.

10.4 Service Package Subscription

10.4.1 The Client receives a monthly invoice for the agreed amount of VU between the 20th and 25th of each month, and the invoice is due on the 1st of the following month. The operational terms of the Service Package Subscription are set out in clause 3.2.3.

10.4.2 If the Client has selected the Priority Support add-on, the add-on adds 30% to the monthly subscription and is included on the monthly invoice.

10.5 General payment provisions

10.5.1 The price the Client pays per VU, and the applicable VAT treatment, are set out in Section 6.

10.5.2 If your Service Commencement Date is after the 20th day of the month you will receive only your next month's invoice. Your next invoice will only be between the 20th and the 25th. In this case, if your VU pool is depleted before the next Invoice you may request an early invoice.

10.5.3 Invoice and VU Disputes

Any dispute regarding an invoice or VU allocation must be submitted in writing within 30 days of the invoice date and must clearly state the invoice number, specific charges disputed, or the amount of VU in question, and the reason for the dispute. We will acknowledge receipt within 5 business days and investigate within 10 business days. Disputes are typically resolved through review of:

10.5.3.1 Service delivery records and time logs

10.5.3.2 VU consumed from the VU pool against services rendered

10.5.3.3 Your Service Order and Annexures

10.5.4 Undisputed invoices must be paid as normal. If a dispute is upheld, we will issue a credit note or adjust your next invoice accordingly. If a dispute is not upheld, the full invoice amount remains due.

10.5.5 Late Payment

If an undisputed invoice is not settled within thirty (30) calendar days of the invoice date:

10.5.5.1 The outstanding amount shall accrue interest at a rate of one and one-half percent (1.5%) per month on a simple (non-compounded) basis.

10.5.5.2 The parties record that this interest rate is a genuine pre-estimate of CJO's loss and is not a penalty.

11. Hardware and Equipment Sales

11.1 Supply of Hardware

CJO may, as a reseller, supply Hardware to the Client. Hardware is supplied separately from services and does not consume VU from the Client's VU pool.

11.2 Hardware Orders

Hardware is ordered by the Client via a Hardware Order, which is a Quote or Service Order for the supply of Hardware. The price of the Hardware is set out in the Hardware Order.

11.3 Invoicing of Hardware

Hardware is invoiced separately from service invoices and is due up front, before delivery or collection of the Hardware.

11.4 Ownership and Risk

Ownership of the Hardware remains with CJO, or its supplier, until full payment of the purchase price has been received. Risk in the Hardware passes to the Client on delivery or collection.

11.5 Warranty

CJO supplies the Hardware as a reseller only. The warranty applicable to the Hardware is the manufacturer's or supplier's warranty, which is passed through to the Client. CJO provides no additional warranty beyond such pass-through, subject to the Consumer Protection Act 68 of 2008 ("CPA") where it applies to the Client. Any implied warranties granted under the CPA cannot be excluded and remain in full force and effect.

11.6 Defective Hardware

Defective or dead-on-arrival Hardware is handled in accordance with the manufacturer's or supplier's return and repair process. CJO is not responsible for repair or replacement beyond such process.

11.7 Installation and Configuration

The installation and configuration of Hardware are services delivered in accordance with Sections 3 and 7 and consume VU from the Client's VU pool unless expressly included in an existing Service Order or other written agreement. All services rendered during the procurement and return of Hardware, including quotation, ordering, management, and return coordination, also consume VU unless expressly included. The Client must maintain sufficient VU for any labour not covered by an existing agreement.

11.8 Data Erasure

Where Hardware is returned or decommissioned, CJO will ensure that any Client personal information stored on the Hardware is securely erased in accordance with POPIA before the Hardware is disposed of or returned.

11.9 Liability

The supply of Hardware is separate from CJO's service obligations. Hardware sales fall within the limitation of liability in clause 13. CJO is not liable for defects in the Hardware beyond the warranty pass-through in clause 11.5, subject to the CPA where it applies.

11.10 Third-Party Licences and Subscriptions

Where CJO resells, procures, or administers a third-party licence or subscription for the Client, the Client's written approval of the order or acceptance of the relevant Quote creates a commitment to purchase the specified licence or subscription for the stated term, quantity, and price, subject to the supplier's applicable terms and any non-excludable rights under law. The Client is responsible for charges and minimum-term or cancellation commitments accepted for that purchase. CJO may retain the written approval or accepted Quote as evidence of the Client's purchase commitment and may provide it, together with relevant order or agreement details, to the supplier or its authorised partner where reasonably required to place, verify, administer, or support the order. Third-party licences and subscriptions are subject to the supplier's terms, availability, renewal and cancellation rules, and any applicable price or tax changes.

12. Termination

12.1 Termination Terms

The termination of this Agreement is subject to the specific duration, Initial Term, and Renewal Term(s) specified in the relevant Service Order (SO) and the further terms detailed within this Master Service Agreement.

12.2 Month-to-Month Cancellation

For month-to-month agreement, cancellation notice must be provided before the 20th of the month for service to end at the end of that month. Cancellation requests received on or after the 20th will result in service termination on the last day of the following month. The Client remains liable for the full invoice amount covering the entire notice period, and CJO shall continue to deliver services, consuming VU from the Client's VU pool, unless the Client explicitly requests the suspension of all or part of the services.

12.3 Fixed-Term Notice

For fixed-term agreements (Annual or otherwise), either Party may prevent automatic renewal by giving at least thirty (30) calendar days' written notice to the other Party before the end of the current term; should the Client fail to provide timely notice of non-renewal, the agreement will automatically transition to a Month-to-Month Agreement upon expiration of the Initial or Renewal Term, subject to the termination terms set forth in the clause above.

12.4 Early Termination

Should the Client terminate a fixed-term agreement before the expiration of the stated contract term for any reason other than CJO’s proven material breach, the Client shall be liable for Liquidated Damages (representing CJO’s loss) calculated as: 100% of all Expected Payments remaining in the contract term if the Remaining Term is less than or equal to 60 days, 80% of all Expected Payments remaining in the contract term if the Remaining Term is greater than 60 days, where "Expected Payments" means the Monthly Recurring Charge for the amount of VU allocated to the Client's VU pool and any fixed services specified in the Service Order, multiplied by the number of full months remaining in the contract term. The parties record that the amounts set out above are a genuine pre-estimate of CJO's loss arising from early termination and are not a penalty.

12.5 Offboarding Agreement

Where a fair offboarding agreement is prepared by CJO in terms of clause 13.8, the termination mechanism for the Agreement shall be as set out in that offboarding agreement, read together with this Section 12. The offboarding agreement is intended to provide for an early exit with a clean break. The Client must expect to pay reasonable fees in terms of the offboarding agreement, calculated with reference to the contract the Client held with CJO, including the services, value units and payment terms applicable under that contract. For the avoidance of doubt, the liquidated damages in clause 12.4 do not apply to termination under a fair offboarding agreement.

13. Service Delivery Breaches, Liability and Indemnity

13.1 Limitation of Liability

CJO shall not be liable for indirect, incidental, or consequential damages. Total liability is limited to the value of services rendered in the preceding 6 months.

13.2 Indemnity

The Client indemnifies CJO against all claims, damages, losses, costs and expenses arising from the Client's misuse of the services, breach of this Agreement, or the negligence, wilful misconduct or breach of the Client, its personnel or its other service providers, provided that this indemnity does not apply to the extent that such claim arises from CJO's gross negligence or wilful misconduct.

13.3 Claims and Notice

Any claim by the Client arising out of or in connection with this Agreement, including any alleged failure by CJO to meet a response or resolution time set out in clause 7.8.3, must be submitted in writing to CJO within thirty (30) days of the date of the alleged breach. The notice must state the clause said to be breached, the date of the alleged breach, and the basis of the claim. Where a claim relates to a response or resolution time, the notice must reference the ticket logged in terms of clauses 5.2.3 and 7.5.1, and a claim that does not reference such a ticket may be rejected. A claim submitted after the thirty (30) day period may be raised as a reference as a failure, but shall not on its own constitute grounds for termination.

13.4 Compliance Reports

To determine whether CJO is in breach, or to raise a specific claimed breach, the Client may request a compliance report from CJO. Clause 13.4.1 sets out the timelines for providing the report.

13.4.1 CJO will provide the compliance report, with supporting ticket data, within ten (10) business days of the request. If the Client requires the report within a shorter timeframe, CJO will log the request as a Medium priority ticket and provide the report within two (2) business days, with the time logged and consuming VU from the Client's VU pool.

13.5 Service Level Compliance

CJO targets a service level compliance rate of ninety-five percent (95%) (the "Compliance Rate"), assessed over the current calendar month and the two (2) calendar months immediately preceding it.

13.5.1 Each eligible ticket under clause 7.8.3 is assessed on response and resolution. A ticket passes where it is closed within the applicable resolution time. A ticket that is not closed within the applicable resolution time is counted as a success where the labour logged or the context recorded on the ticket shows that the failure to close was not due to any fault on CJO's side. Periods during which a ticket is awaiting a response from the Client are excluded.

13.5.2 The Client is notified when a ticket is closed and must reopen the ticket where it does not agree with the resolution. A ticket that is not closed, or that is closed without notice to the Client or without a solution accepted by the Client for sound reason, counts as a failure. Tickets logged by CJO on the Client's behalf in terms of clause 7.5.2 are excepted from the closed-without-notice requirement, and the Client must accordingly aim to log tickets itself.

13.5.3 The Compliance Rate is the number of tickets assessed as a pass or a success under clauses 13.5.1 and 13.5.2, expressed as a percentage of the total number of eligible tickets, across the assessment window in clause 13.5. For the avoidance of doubt, clause 7.10 remains applicable to individual claims, and this clause 13.5 sets the compliance standard governing termination under clause 13.7.

13.6 Active Breach

An active breach exists where the Compliance Rate falls below ninety-five percent (95%) and there are failures recorded within the thirty (30) days preceding the compliance report, which failures the Client has raised as a dispute in terms of clause 13.3.

13.7 Remedies and Termination

Where an active breach exists as set out in clause 13.6, the Client's remedies are governed by clause 13.7.1 and clause 13.7.2, with termination effected in accordance with Section 12.

13.7.1 CJO shall have until the end of the calendar month following the compliance report to restore the Compliance Rate to ninety-five percent (95%) or above (the "Cure Period"). If the Compliance Rate falls below fifty percent (50%), or the failure is otherwise irrecoverable, the Client may terminate this Agreement immediately by written notice in terms of Section 12. Termination on this basis is not an early termination attracting clause 12.4.

13.7.2 Where the Client gives notice before the twentieth (20th) day of the month and the Compliance Rate cannot be recovered in accordance with clause 13.7.1, termination is effective at the end of that month, subject to clause 12.2. In all other cases, termination is effective at the end of the following month. Any outstanding balances must be paid in full before termination takes effect. Clause 12.4 shall not apply to termination under this clause.

13.8 Fair Offboarding

The clauses in this Section 13 are intended to keep compliance assessment objective and to provide an agreed basis for measuring CJO's service delivery against the operational standard. However, where the Client genuinely experiences prolonged poor service, and either Party presents metrics with the intent to prove a breach (from the Client's side) or to prove compliance (by CJO) beyond what is reasonably allowed, and the outcome sought by the Client is termination, CJO will prepare a fair offboarding agreement within ten (10) business days to allow the Client an early exit with a clean break, and the termination mechanism for such offboarding agreement is set out in clause 12.5. If the Client rejects the offboarding agreement and does not propose a fair and acceptable alternative, the standard termination clauses in Section 12 shall apply.

14. Governing Law

14.1 Governing Law

This Agreement is governed by the laws of the Republic of South Africa.

14.2 Dispute Resolution

The parties shall endeavour to resolve any dispute arising out of or in connection with this Agreement through negotiation and, failing resolution within fourteen (14) days, through mediation at CJO's election. Failing resolution by mediation, either party may refer the dispute to arbitration in accordance with the Arbitration Act 42 of 1965, or to the High Court of South Africa, Western Cape Division, Cape Town, which shall have jurisdiction to hear and determine the dispute. This clause does not prevent either party from approaching a court for urgent or interim relief.

15. Authorisation and Effective Date

15.1 Authorisation

This Master Services Agreement (MSA) Version 7 has been duly authorised by the Director, Jacques Oostenbrink, on behalf of CJO.

15.2 Effective Date and Application

This version shall apply to all Clients entering into a service agreement with CJO on or after 1 October 2026, subject to clause 15.4 for existing Clients.

15.3 Updated Versions

CJO reserves the right to issue updated versions of this MSA. New versions will be communicated to existing Clients via email to their registered address.

15.3.1 CJO may update this MSA as reasonably required to enable it to continue delivering its services effectively and to comply with applicable laws, regulations, and industry standards. Such updates may reflect changes to CJO's service offering, business practices, technology, and legal or regulatory obligations. CJO will notify Clients of any such updates as set out in this Section 15.

15.4 Application of Updates

The updated terms shall apply to the Client's current contract only after thirty (30) calendar days' prior written notice to the Client, unless the Client provides written notice of non-acceptance within thirty (30) calendar days of such notice, in which event clause 15.4.1 shall apply.

15.4.1 In the event of a formal dispute arising from the proposed changes, the Client may elect in writing to remain governed by the terms of the original MSA for the remainder of their contract term. Such election must be formally lodged with CJO and will ensure the original terms remain in full force and effect until the next renewal period or termination of the agreement.

16. General Provisions

16.1 Entire Agreement

This MSA, together with any Service Order, Quote, Hardware Order and the Annexures, constitutes the entire agreement between the parties and supersedes all prior agreements, representations and understandings.

16.2 Severability

If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

16.3 Notices and Domicilium

The parties choose their respective addresses set out in the Service Order (or, for CJO, the address on the first page of this MSA) as their domicilium citandi et executandi for all purposes under this Agreement. Notices may be sent by email to the registered email addresses of the parties, which shall be deemed received on the business day following despatch.

16.4 No Waiver

A failure by either party to enforce any provision of this Agreement shall not constitute a waiver of that provision or of any other provision.

16.5 Cession

The Client may not cede or assign any of its rights or obligations under this Agreement without CJO's prior written consent.

16.6 Independent Contractor

CJO renders services as an independent contractor and nothing in this Agreement creates a partnership, joint venture or employment relationship between the parties.

Annexure A: Previous Versions

* The current version of the MSA. For the latest version, please contact [email protected].