Legal
Acceptable Use Policy
Catalyst Digital Operations (Pty) Ltd, Last updated: July 2026
1. Purpose
This Acceptable Use Policy ("Policy") sets out the standards of acceptable use that apply to all digital systems, platforms, solutions, and tools developed, deployed, or managed by Catalyst Digital Operations (Pty) Ltd ("Catalyst") on behalf of clients, as well as to the use of our website and any client-facing portals or environments.
This Policy applies to clients, their employees, contractors, and any other individuals who access or use systems or solutions provided by Catalyst.
2. Permitted Use
Systems, platforms, and solutions provided by Catalyst are intended to be used:
- For the business purposes specified in the applicable Statement of Work or Service Agreement;
- In accordance with the licences and permissions granted for each technology or platform deployed;
- In compliance with applicable laws and regulations, including but not limited to POPIA, the Electronic Communications and Transactions Act (ECTA), and relevant industry-specific regulations;
- In a manner consistent with Microsoft's acceptable use policies where Microsoft Power Platform, Microsoft 365, or Azure services are involved.
3. Prohibited Use
The following uses are strictly prohibited:
- Using any system or solution provided by Catalyst to engage in unlawful activities, including fraud, data theft, harassment, or the distribution of malicious software;
- Processing or storing personal information in a manner that violates POPIA or other applicable data protection legislation;
- Accessing, modifying, or deleting data or system configurations beyond the scope of authorised access;
- Attempting to reverse-engineer, decompile, or otherwise circumvent security measures or access controls implemented in any solution;
- Using systems to send unsolicited commercial communications (spam) or to conduct phishing activities;
- Exceeding or circumventing Microsoft licence allocations or platform limits;
- Using AI-powered tools or features deployed by Catalyst to generate, distribute, or act upon content that is misleading, harmful, discriminatory, or in violation of applicable law;
- Sharing access credentials or granting unauthorised access to any system or solution to individuals not covered by the applicable engagement agreement;
- Using any Catalyst-built solution for a purpose substantially different from its intended design without prior written agreement.
4. AI and Automated Systems
Where solutions deployed by Catalyst incorporate AI capabilities, automation, or machine-learning components, the following additional standards apply:
- AI-generated outputs should be reviewed by appropriately qualified personnel before being acted upon for significant business decisions;
- Personal data processed through AI systems must be handled in accordance with POPIA and any additional terms imposed by the AI platform provider (such as Anthropic's usage policies for Claude-based integrations);
- Clients must not use AI capabilities to generate content intended to deceive, mislead, or manipulate individuals;
- Any concerns about AI outputs or system behaviour should be reported to Catalyst promptly.
5. Security Responsibilities
Clients are responsible for maintaining appropriate security controls within their own environments. This includes:
- Ensuring that access credentials (usernames, passwords, API keys) are kept secure and not shared with unauthorised individuals;
- Reporting any suspected security incidents, breaches, or vulnerabilities to Catalyst without undue delay;
- Implementing and maintaining appropriate endpoint security, including antivirus, patch management, and access control policies, as applicable to the client's environment;
- Ensuring that only authorised personnel have access to systems and solutions delivered by Catalyst.
6. Data Handling
Clients who process personal information through systems developed or managed by Catalyst are responsible for:
- Ensuring that such processing is conducted in accordance with POPIA and any other applicable data protection laws;
- Maintaining appropriate data processing agreements with Catalyst where Catalyst acts as an operator processing personal information on the client's behalf;
- Ensuring that data subjects are informed of and have consented to the processing of their personal information as required by law;
- Notifying Catalyst immediately of any data breaches or incidents that may involve personal information processed through Catalyst-built systems.
7. Consequences of Breach
Violation of this Policy may result in:
- Suspension of access to systems or solutions provided by Catalyst;
- Termination of the applicable engagement agreement in accordance with its termination provisions;
- Reporting of the violation to relevant regulatory authorities where legally required;
- Pursuit of damages or other legal remedies available under South African law.
Catalyst will investigate suspected breaches of this Policy and will cooperate with lawful requests from regulatory authorities or law enforcement agencies.
8. Updates to This Policy
Catalyst may update this Policy from time to time to reflect changes in technology, legal requirements, or our services. Material updates will be communicated to clients with active engagements. Continued use of systems or services following notification of an updated Policy constitutes acceptance of the updated terms.
9. Contact
Questions or concerns regarding this Policy should be directed to: