POPIA Manual and Privacy Notice

This POPIA Manual and Privacy Notice (“Manual”) explains how lawvero (Pty) Ltd (“lawvero”, “we”, “us”) collects, uses, stores, shares and protects personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”). It also serves as the notice to data subjects required by section 18 of POPIA.

This Manual applies to all personal information processed by lawvero, whether it relates to clients, persons connected to a client’s matter, employees, contractors, job applicants, suppliers, website users or any other data subject. It binds everyone who processes personal information on lawvero’s behalf.

This Manual should be read with our PAIA Manual and our Website Terms and Conditions, which are available on our website.

In this Manual, the following terms have the meanings given in POPIA, summarised here for convenience:

1. (a)“personal information”: information relating to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person (such as a company or trust), including names, identity numbers, contact details, financial information, and online identifiers;
2. (b)“special personal information”: personal information about a person’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour;
3. (c)“processing”: any operation involving personal information, including collecting, recording, storing, using, sharing, and destroying it;
4. (d)“responsible party”: the person who determines the purpose and means of processing, which for this Manual is lawvero;
5. (e)“operator”: a person who processes personal information for lawvero under a contract or mandate, without coming under lawvero’s direct authority;
6. (f)“data subject”: the person to whom personal information relates; and
7. (g)“Information Officer”: the person responsible for encouraging and ensuring lawvero’s compliance with POPIA and for dealing with requests from data subjects and the Information Regulator.

The Information Officer is registered with the Information Regulator.

We collect personal information:

1. (a)directly from you, through our website forms and chat assistant, by email, telephone or messaging, in questionnaires, and in the documents you send us;
2. (b)from persons who provide it on your behalf or on behalf of a client, such as a family member, trustee, director, accountant, financial adviser or other referrer, who must be authorised to share it with us;
3. (c)from public records, such as those of CIPC, the Master of the High Court and the Deeds Office, and from identity verification service providers used for client verification; and
4. (d)automatically when you use our website, through cookies and similar technologies (see section 13).

If you give us personal information about another person, you confirm that you are entitled to do so and that you will inform that person that we hold it and where they can find this Manual.

We process personal information only for specific, explicitly defined and lawful purposes, and only to the extent that it is adequate, relevant and not excessive for those purposes (sections 10, 11 and 13 of POPIA):

We will not process personal information for a new purpose that is not compatible with the purpose for which it was collected, unless you consent or POPIA otherwise permits it (section 15 of POPIA).

Providing personal information to us is voluntary, but where the law requires it or we need it to perform a service, it is mandatory for that service. In particular, client verification information is required by the Financial Intelligence Centre Act 38 of 2001, and certain information is required by the Trust Property Control Act 57 of 1988, the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011 for documents lodged under those Acts.

If you do not provide the information we need, we may be unable to accept your instruction, complete a document, or lodge it with the relevant authority.

We process special personal information only where POPIA authorises it, for example, with the data subject’s consent, or where it is necessary to establish, exercise or defend a right or obligation in law (section 27 of POPIA). We ask only for what the particular document or service requires.

Some documents we prepare (such as wills, trust deeds, beneficiary declarations and parenting plans) require information about children. We process children’s personal information only with the consent of a competent person (such as a parent or guardian), or where it is necessary to establish, exercise or defend a right or obligation in law, as permitted by section 35 of POPIA.

We send direct marketing by electronic communication (such as email, SMS or WhatsApp) only to persons who have consented to receive it, or to our existing clients about our own similar services, in accordance with section 69 of POPIA.

Every marketing message identifies lawvero and gives you a free and easy way to opt out. If you opt out, we will stop sending you marketing and will keep a record of your opt-out so that we do not contact you again.

We do not sell or rent personal information to anyone.

We share personal information only where necessary for the purposes in section 6, and only with:

• the Master of the High Court, CIPC, SARS, the Deeds Office, the courts and other authorities with which documents must be lodged;
• independent legal practitioners who perform Reserved Work (as defined in our Website Terms and Conditions);
• auditors, accountants and professional advisers, and the client’s own advisers where the client authorises it;
• banks, couriers and commissioners of oaths;
• operators who provide services to us, such as cloud hosting, email, document storage, practice-management and CRM software, identity verification, website analytics and advertising, and artificial-intelligence services;
• the Financial Intelligence Centre, SARS, the Information Regulator, law-enforcement agencies and courts, where the law or a court order requires it; and
• a purchaser of, or investor in, all or part of our business, subject to confidentiality obligations.

Before appointing an operator, we take reasonable steps to confirm that it can protect personal information. We conclude written agreements requiring operators to process personal information only with our authorisation, to treat it as confidential and to maintain appropriate security safeguards, and to notify us immediately of any security compromise (sections 20 and 21 of POPIA).

Some of our operators, including cloud, email, analytics and artificial-intelligence service providers, store or process information on servers outside South Africa. We transfer personal information outside South Africa only in accordance with section 72 of POPIA, in particular, where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA, where you consent, or where the transfer is necessary to perform a contract with you or in your interest.

We take appropriate, reasonable technical and organisational measures to prevent the loss of, damage to, unauthorised destruction of, and unlawful access to or processing of personal information (section 19 of POPIA). These include:

• access to personal information only for staff and contractors who need it for their work, with strong authentication on our systems;
• encrypted (HTTPS) connections on our website;
• the use of reputable cloud service providers, and written security and confidentiality obligations on operators;
• confidentiality undertakings from staff and contractors;
• secure handling and storage of physical documents and originals; and
• regular review of our safeguards against new risks.

Please help us protect your information: do not send identity numbers, banking details or sensitive information through our website chat assistant, and verify our banking details by telephone before making any payment.

Our website uses cookies and similar technologies. Some are strictly necessary for the website to work. Others help us understand how the website is used (analytics) or measure and improve our advertising, including on platforms such as Google and Meta.

You can block or delete cookies through your browser settings and, where offered, through the cookie preferences on our website. Blocking strictly necessary cookies may affect how the website works.

Our website may offer an automated chat assistant, operated with the help of an artificial-intelligence service provider. Chat content is processed to answer your questions and, if you ask for it, to compile a request for our team. Chat content may be processed outside South Africa as described in section 11.

We do not make decisions that have legal consequences for you, or that affect you to a substantial degree, based solely on automated processing (section 71 of POPIA). Every instruction is reviewed by a person.

We keep personal information only for as long as we need it for the purpose for which it was collected, or for as long as the law requires or permits (section 14 of POPIA). When it is no longer needed, we destroy or delete it securely, or de-identify it.

As a data subject, you have the right to:

1. (a)be told that your personal information is being collected, and that it has been accessed or acquired by an unauthorised person;
2. (b)ask us, free of charge, to confirm whether we hold personal information about you, and request access to it (section 23 of POPIA, read with our PAIA Manual);
3. (c)ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or to destroy or delete a record we are no longer authorised to keep (section 24 of POPIA);
4. (d)object, on reasonable grounds, to the processing of your personal information, and object at any time to processing for direct marketing (section 11(3) of POPIA);
5. (e)withdraw your consent at any time, without affecting processing that took place before the withdrawal;
6. (f)not be subject to a decision based solely on automated processing that has legal consequences for you; and
7. (g)lodge a complaint with the Information Regulator (section 74 of POPIA).

To exercise these rights, contact our Information Officer at office@lawvero.co.za. Objections may be made on Form 1, and requests for correction or deletion on Form 2, prescribed in the Regulations relating to the Protection of Personal Information, 2018; these forms are available from the Information Regulator’s website or from us. We may need to verify your identity before acting on a request, and will respond within a reasonable time.

Some rights may be limited where we are required by law to keep information (for example under the Financial Intelligence Centre Act 38 of 2001) or where information is needed to establish, exercise or defend legal rights. If so, we will explain why.

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will, as required by section 22 of POPIA:

1. (a)notify the Information Regulator in the prescribed manner as soon as reasonably possible;
2. (b)notify affected data subjects in writing as soon as reasonably possible, with enough information to allow them to take protective measures, unless the law or a public body directs a delay or the identity of the data subjects cannot be established; and
3. (c)record and investigate the compromise, contain it, and take steps to prevent it from happening again.

Everyone who processes personal information for lawvero is bound by confidentiality obligations and receives POPIA awareness training on joining us and periodically afterwards.

We encourage you to contact our Information Officer first so that we can try to resolve your concern. You may also lodge a complaint with the Information Regulator:

We will review this Manual at least once a year, and whenever there is a material change to our processing activities, systems or the applicable law. The current version is always available on our website.