POPIA Compliance

A plain-language summary of how we handle personal information under the Protection of Personal Information Act 4 of 2013 ("POPIA"). This page summarises our practices; the Privacy Policy is the fuller, governing document.

Who's responsible for your information

If you're a debt review client, the law firm or practice you applied through is the responsible party for your personal information under POPIA. We act as their operator, processing it only on their documented instructions, under a written agreement that requires us to keep it secure and confidential, and to notify them without undue delay if we ever become aware of a security compromise.

Consent, not assumption

We only process your ID number and financial details after you've explicitly consented to it, in addition to agreeing to our Terms of Service and Privacy Policy at registration. Both are recorded with a timestamp, not just a checkbox that vanishes.

Security measures in place

• Encryption in transit (TLS/HTTPS) between your browser and our server.
• Passwords are hashed, never stored in plain text.
• CSRF protection on every form submission, and rate limiting on public and authentication endpoints to blunt abuse.
• Role-based access for staff (a paralegal and an advocate see different permissions), and a per-case audit log of who accessed or changed what, and when.
• Document signing links are tied to your logged-in account, not just a link someone could forward.
• Periodic, integrity-checked backups.

Your rights

Subject to POPIA, you can ask to know what personal information we (or the practice you applied through) hold about you, request that inaccurate or unlawfully processed information be corrected or deleted, and object to processing on reasonable grounds. Start with the practice that submitted your application — they're best placed to action this directly. You can also lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

Our Information Officer

[FILL IN: INFO_OFFICER_NAME in .env] · [FILL IN: INFO_OFFICER_EMAIL in .env]

Sub-processors

We use a small number of infrastructure providers (hosting, email delivery) to operate the platform, each bound by a written agreement. A current list is available on request from our Information Officer above.

Questions

Email [FILL IN: PRIVACY_CONTACT_EMAIL in .env] and we'll get back to you.